joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4144b0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x45a813
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x477c1c]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
xor ebx, ebx
mov dword [esp + 0x274], ebx
cmp dword [ecx + 0x848], ebx
mov byte [esp + 0x16], bl
mov dword [esp + 0x1c], ebx
jle 0x4146a1
lea edi, [ecx + 0x138]
push 0x103
lea eax, [esp + 0x169]
push ebx
push eax
mov byte [esp + 0x170], bl
call fcn.00440d10
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
lea ecx, [edi - 0x100]
push ecx
lea edx, [esp + 0x168]
push edx
call esi
push 0x45ecf4
lea eax, [esp + 0x168]
push eax
call esi
push edi
lea ecx, [esp + 0x168]
push ecx
call esi
push str..src
lea edx, [esp + 0x168]
push edx
call esi
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea edx, [esp + 0x164]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414584
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea ecx, [esp + 0x17c]
push ecx
mov byte [esp + 0x33], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4145c1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x4145f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x4145d6
cmp eax, 2
je 0x4145d6
cmp eax, 3
jne 0x414653
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov byte [esp + 0x17], 1
cmp esi, 0xffffffff
je 0x414653
mov eax, dword [esp + 0x44]
cmp eax, ebx
jbe 0x414653
sub esp, 0x1c
mov ecx, esp
mov eax, edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x3c], esp
mov byte [ecx + 4], bl
lea ebp, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x414618
sub eax, ebp
push eax
push edi
call fcn.00401da0
mov byte [esp + 0x290], 1
mov byte [esp + 0x290], bl
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 8]
call fcn.004111d0
cmp al, bl
jne 0x414662
mov dword [edi + 0x100], 2
jmp 0x41465d
mov dword [edi + 0x100], 1
mov byte [esp + 0x16], 1
cmp byte [esp + 0x17], bl
je 0x414676
cmp esi, 0xffffffff
je 0x414682
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x414682
cmp esi, 0xffffffff
je 0x414682
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
inc eax
add edi, 0x204
cmp eax, dword [edx + 0x848]
mov dword [esp + 0x1c], eax
jl 0x414512
mov dword [esp + 0x274], 0xffffffff
cmp dword [esp + 0x294], 0x10
jb 0x4146c6
mov eax, dword [esp + 0x280]
push eax
call fcn.00421b49
add esp, 4
mov al, byte [esp + 0x16]
mov dword [esp + 0x294], 0xf
mov dword [esp + 0x290], ebx
mov byte [esp + 0x280], bl
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.0044014d
add esp, 0x264
ret 0x1c
Function at 0x4153f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45aa19
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.MYFileManager.0
xor ebx, ebx
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esp + 0x18], ebx
lea ecx, [esi + 0x84c]
call fcn.0040f210
mov byte [esp + 0x18], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x848], ebx
mov byte [esi + 4], bl
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x415480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45aa59
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.MYFileManager.0
mov dword [esp + 0x14], 1
call fcn.004141f0
mov byte [esp + 0x14], 0
lea ecx, [esi + 0x84c]
call fcn.0040f5e0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x34], 0x10
jb 0x4154e5
mov eax, dword [esi + 0x20]
push eax
call fcn.00421b49
add esp, 4
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], 0
mov byte [esi + 0x20], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x415910
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x20]
neg ecx
xor eax, eax
mov dword [esi + 0x34], 0x20000000
mov dword [esi + 0x38], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
pop esi
add esp, 0x24
ret

Function at 0x415950
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x415983
mov dword [esi + 0x20], edi
pop edi
xor al, al
pop esi
ret 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x28], eax
pop edi
xor al, al
pop esi
ret 4
Function at 0x415e27
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp ebx, eax
jae 0x415f81
mov ebp, dword [esp + 0x18]
lea edx, [ebx + ebp]
mov dword [esp + 0x14], edx
cmp edx, eax
ja 0x415f81
cmp dword [esi + 0x34], 0
push edi
je 0x415f0c
mov ecx, dword [esi + 0x2c]
cmp ebx, ecx
jb 0x415e72
mov eax, dword [esi + 0x30]
add eax, ecx
cmp eax, edx
jb 0x415e72
mov eax, dword [esi + 0x3c]
pop edi
pop esi
sub eax, ecx
pop ebp
add eax, ebx
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x415e87
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x34], 0
je 0x415ef4
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi + 0x34]
cmp ecx, ebp
jb 0x415ef4
mov eax, dword [esi + 0x38]
and eax, ebx
lea edx, [eax + ecx]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
cmp edx, dword [esi + 0x28]
jbe 0x415ec5
mov ecx, dword [esi + 0x24]
push 0
push eax
push 0
push 4
push ecx
call edi
mov edx, dword [esi + 0x28]
sub edx, dword [esi + 0x2c]
mov dword [esi + 0x30], edx
jmp 0x415ee1
push ecx
push eax
push 0
push 4
cmp edx, dword [esp + 0x28]
jbe 0x415ed7
mov eax, dword [esi + 0x24]
push eax
jmp 0x415edb
mov ecx, dword [esi + 0x24]
push ecx
call edi
mov ebp, dword [esp + 0x1c]
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x415f71
shr dword [esi + 0x34], 1
cmp dword [esi + 0x34], eax
jne 0x415e93
mov edx, dword [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
cmp dword [esi + 0x30], ebp
jae 0x415f34
push 0
lea edi, [esi + 0x40]
push ebp
mov ecx, edi
mov dword [esi + 0x30], ebp
call fcn.00415d80
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
jne 0x415f2e
call fcn.004408d8
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x3c], ecx
mov edx, dword [esi + 0x20]
push 0
push 0
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 0x50]
sub eax, dword [esi + 0x4c]
jne 0x415f50
call fcn.004408d8
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x2c]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
pop ecx
ret 8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x416670
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0041ace0
test al, al
je 0x416732
cmp dword [esi + 0x64], 0
mov dword [esp + 8], 0
jbe 0x416732
push ebx
push ebp
push edi
mov edi, edi
mov ebp, dword [esi + 0x70]
add ebp, dword [esp + 0x14]
mov ebx, dword [esi + 0x1c]
mov al, byte [ebp]
mov edi, dword [esi + 0x14]
and ebx, 0xfffd
or ebx, 2
mov byte [esp + 0x10], al
call fcn.0041c3e0
movsx ecx, byte [esp + 0x10]
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
movzx eax, al
add eax, dword [esi + 0x18]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
call fcn.0041c3e0
movsx edx, byte [esp + 0x10]
xor edx, edi
and edx, 0xff
shr edi, 8
xor edi, dword [eax + edx*4]
mov eax, ebx
xor eax, 1
imul eax, ebx
sar eax, 8
mov dword [esi + 0x1c], edi
xor byte [ebp], al
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esi + 0x64]
jb 0x4166a0
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x416740
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0041ace0
test al, al
je 0x4167d8
push ebp
xor ebp, ebp
cmp dword [esp + 0xc], ebp
jbe 0x4167d7
push ebx
push edi
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x70]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor edx, 1
imul edx, ecx
add eax, ebp
sar edx, 8
xor byte [eax], dl
mov bl, byte [eax]
mov edi, dword [esi + 0x14]
call fcn.0041c3e0
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
movzx ebx, al
add ebx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
imul ebx, ebx, 0x8088405
inc ebx
mov dword [esi + 0x18], ebx
shr ebx, 0x18
call fcn.0041c3e0
movsx edx, bl
xor edx, edi
and edx, 0xff
shr edi, 8
xor edi, dword [eax + edx*4]
inc ebp
mov dword [esi + 0x1c], edi
cmp ebp, dword [esp + 0x14]
jb 0x416761
pop edi
pop ebx
pop ebp
pop esi
ret 4

Function at 0x416a80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
cmp dword [esi + 0x10], ebp
jbe 0x416afd
push ebx
push edi
mov eax, dword [esi + 0xc]
mov bl, byte [eax + ebp]
mov edi, dword [esi + 0x14]
call fcn.0041c3e0
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
movzx ebx, al
add ebx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
imul ebx, ebx, 0x8088405
inc ebx
mov dword [esi + 0x18], ebx
shr ebx, 0x18
call fcn.0041c3e0
movsx edx, bl
xor edx, edi
and edx, 0xff
shr edi, 8
xor edi, dword [eax + edx*4]
inc ebp
mov dword [esi + 0x1c], edi
cmp ebp, dword [esi + 0x10]
jb 0x416aa2
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x416b00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push 0xffffffffffffffff
push 0x45ac88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
push ebp
push 0xc
lea ecx, [esp + 0x20]
call fcn.00418e50
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x1c]
push ebp
push 0xc
push eax
lea ecx, [esi + 0x78]
call fcn.0041c310
jmp 0x416b50
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi + 0x14]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, byte [ecx + ebp]
call fcn.0041c3e0
movsx edx, bl
xor edx, edi
and edx, 0xff
mov eax, dword [eax + edx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
movzx eax, al
add eax, dword [esi + 0x18]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x14], al
call fcn.0041c3e0
movsx ecx, byte [esp + 0x14]
xor ecx, edi
and ecx, 0xff
shr edi, 8
xor edi, dword [eax + ecx*4]
inc ebp
cmp ebp, 0xc
mov dword [esi + 0x1c], edi
jl 0x416b50
mov ecx, dword [esi + 0x110]
call fcn.0041acf0
mov esi, dword [esi + 0x110]
test al, al
je 0x416be0
cmp byte [esi + 0x11], bl
jmp 0x416be3
cmp byte [esi + 0x17], bl
sete bl
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00418e80
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x416f10
Capabilities:
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x12c]
sub esp, 0x12c
push 0xffffffffffffffff
push 0x45acf0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x477c1c]
xor eax, ebp
mov dword [ebp + 0x128], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 0x134]
cmp byte [esi + 0xe4], 0xff
je 0x416f64
xor eax, eax
jmp 0x417057
mov dword [ebp - 0x14], 1
xor ebx, ebx
cmp byte [ebp + 0x138], bl
jne 0x41702d
cmp dword [esi + 0x60], ebx
jne 0x416f97
mov eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x416f9e
push 0xffffffffffffff9a
mov ecx, esi
call fcn.00416cc0
jmp 0x416f9e
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [esi + 0x110]
cmp word [eax + 0xe], 8
jne 0x416fb7
lea edx, [esi + 0x28]
push edx
call fcn.0041dee0
add esp, 4
cmp edi, ebx
je 0x41702d
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
lea eax, [ebp - 0x20]
push eax
call fcn.00416880
mov ecx, dword [eax]
mov dword [ebp + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], eax
mov dword [ebp], ecx
mov dword [ebp + 4], eax
mov byte [ebp + 0x20], bl
mov ecx, dword [esi + 0x110]
lea edx, [ebp - 0x20]
push edx
call fcn.0041af20
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], edx
lea eax, [ebp]
push eax
push edi
call fcn.0043109b
mov eax, dword [esi + 0x110]
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x41702d
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xe8]
call fcn.00419d20
mov byte [esi + 0xe4], bl
lea ecx, [esi + 0x6c]
call fcn.00418d10
mov ecx, esi
call fcn.004167e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.0044014d
add ebp, 0x12c
mov esp, ebp
pop ebp
ret 8
Function at 0x417260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xe8]
push ebp
mov ecx, edi
call fcn.00419310
test al, al
jne 0x417283
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.0041b480
cmp eax, 1
je 0x41727b
cmp byte [esi + 0xe4], 0
jne 0x41727b
lea ecx, [esi + 0x20]
call fcn.0041b320
push ebp
mov ecx, edi
call fcn.00419c50
mov ecx, dword [esi + 0x110]
call fcn.0041ace0
test al, al
je 0x4172d9
cmp dword [esi + 0x10], 0
je 0x41727b
mov ecx, esi
call fcn.00416a80
mov ecx, esi
call fcn.00416b00
test al, al
jne 0x4172d9
push 0xffffffffffffff94
mov ecx, esi
call fcn.00416cc0
mov eax, dword [esi + 0x110]
movzx edi, word [eax + 0xe]
test di, di
je 0x4172f7
cmp di, 8
je 0x4172fd
push 0xffffffffffffff9b
mov ecx, esi
call fcn.00416cc0
cmp di, 8
jne 0x41732d
cmp byte [esi + 4], 0
je 0x41730b
lea eax, [esi + 0xc8]
jmp 0x41730d
xor eax, eax
push 0x38
push 0x4603ac
lea ecx, [esi + 0x28]
push 0xfffffffffffffff1
push ecx
mov dword [esi + 0x50], eax
call fcn.0041c710
add esp, 0x10
push eax
mov ecx, esi
call fcn.00416d70
mov ecx, dword [esi + 0x110]
mov edx, dword [ecx + 0x18]
mov dword [esi + 0x64], edx
call fcn.0041ace0
test al, al
je 0x417346
add dword [esi + 0x64], 0xfffffff4
mov eax, dword [esi + 0x110]
mov ecx, dword [eax + 0x1c]
pop edi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x68], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe4], 0xff
pop esi
mov al, 1
pop ebp
ret 4

Function at 0x417b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ae98
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x477c1c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov eax, dword [esp + 0x138]
mov esi, dword [esp + 0x134]
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 0
call fcn.00441dbc
add esp, 0x14
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00404b00
mov edi, eax
mov dword [esp + 0x12c], 1
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404b00
mov byte [esp + 0x12c], 2
push edi
push eax
push esi
call fcn.00417780
add esp, 0xc
mov dword [esp + 0x18], 1
mov byte [esp + 0x12c], 1
lea ecx, [esp + 0x10]
call fcn.004032f0
mov byte [esp + 0x12c], 0
lea ecx, [esp + 0x14]
call fcn.004032f0
mov eax, esi
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0044014d
add esp, 0x124
ret
Function at 0x417ef0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x45b029
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00404b00
mov dword [esp + 0x20], 0
push 0x45ecf4
lea ecx, [esp + 0x10]
call fcn.00417710
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00417b20
add esp, 8
mov byte [esp + 0x20], 1
mov ecx, dword [esp + 0xc]
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x10], 1
test edx, edx
jne 0x417f79
push 0x80004005
call fcn.004029c0
mov eax, dword [eax]
push ecx
push eax
call fcn.00441781
add esp, 8
test eax, eax
sete al
or edi, 0xffffffff
test al, al
jne 0x417fa6
mov eax, dword [esp + 0xc]
push eax
call fcn.00416580
add esp, 4
cmp eax, edi
je 0x417fa6
xor bl, bl
jmp 0x417fa8
mov bl, 1
mov dword [esp + 0x20], 0
mov eax, 1
mov dword [esp + 0x10], eax
and eax, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.004032f0
test bl, bl
jne 0x418035
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00417b20
mov byte [esp + 0x28], 2
mov eax, dword [eax]
push eax
call fcn.00417ef0
add esp, 0xc
test al, al
sete bl
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x14]
call fcn.004032f0
test bl, bl
je 0x418024
mov dword [esp + 0x20], edi
lea ecx, [esp + 0xc]
call fcn.004032f0
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418003
mov dword [esp + 0x20], edi
lea ecx, [esp + 0xc]
call fcn.004032f0
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret
Function at 0x418c80
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x45b1b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00418c00
add esp, 8
mov dword [esp + 0x14], 0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
sete bl
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 8]
call fcn.004032f0
mov al, bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x10
ret
Function at 0x41aad0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x45b728
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x2e
lea ecx, [esp + 0x20]
call fcn.00418e50
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x34]
push 1
push 0x2e
push eax
mov ecx, edi
call fcn.0041c310
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
movzx edx, word [eax + 4]
mov word [esi + 8], dx
movzx ecx, word [eax + 6]
mov word [esi + 0xa], cx
movzx edx, word [eax + 8]
mov word [esi + 0xc], dx
movzx ecx, word [eax + 0xa]
mov word [esi + 0xe], cx
movzx edx, word [eax + 0xc]
mov word [esi + 0x10], dx
movzx ecx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
movzx ecx, word [eax + 0x20]
movzx edx, word [eax + 0x22]
movzx ebx, word [eax + 0x1c]
movzx ebp, word [eax + 0x1e]
mov word [esi + 0x20], dx
mov dword [esp + 0x34], ecx
movzx ecx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x18]
mov dword [esi + 0x28], eax
call fcn.00418d10
mov ecx, dword [esi + 4]
cmp ecx, dword [0x47671c]
jne 0x41ac44
mov ecx, edi
call fcn.0041b4a0
movzx ebx, bx
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x1c], eax
call fcn.00418d40
mov eax, dword [esi + 0x3c]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
push ebx
push eax
mov eax, dword [edx + 0x34]
call eax
test bp, bp
je 0x41abfb
movzx ebx, bp
push 0
push ebx
lea ecx, [esi + 0x2c]
call fcn.00418d40
mov eax, dword [esi + 0x30]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
push ebx
push eax
mov eax, dword [edx + 0x34]
call eax
mov eax, dword [esp + 0x34]
test ax, ax
je 0x41ac21
movzx ebx, ax
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.00418d40
mov ecx, dword [edi + 0x1c]
mov esi, dword [esi + 0x48]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
push ebx
push esi
call eax
mov ecx, edi
call fcn.0041b4a0
cmp eax, dword [esp + 0x14]
sete bl
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00418e80
mov al, bl
jmp 0x41ac57
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00418e80
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x41b640
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x45b940
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x477c1c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
lea edx, [esp + 0xc]
push edx
call eax
mov dword [esp + 0x28], 0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00418c00
add esp, 8
mov byte [esp + 0x28], 1
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
sete bl
mov byte [esp + 0x28], 0
lea ecx, [esp + 8]
call fcn.004032f0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004032f0
test bl, bl
je 0x41b6e8
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x24
ret