joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60f968
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x60f999
dec al
je 0x60f9d4
dec al
je 0x60fa18
dec al
je 0x60fa8a
jmp 0x60fb25
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x60fb25
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x60f9a9
jmp 0x60fb25
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60fb25
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x60f9e4
jmp 0x60fb25
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60fb25
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x60fa4b
xor edx, edx
mov dword [esp + 4], edx
jmp 0x60fa60
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x60fa78
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x60fa28
jmp 0x60fb25
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60fb25
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x60faf1
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0060c8a4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x60faa6
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6153d8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov dword [esp], 0x11
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x615401
mov edx, ebx
lea eax, [esp + 4]
call fcn.00426858
jmp 0x61540d
mov eax, ebx
mov edx, 0x615420
call fcn.0040a6c0
add esp, 0x28
pop ebx
ret

Function at 0x401060
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x4010d0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401120
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]

Function at 0x401120
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00401110
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40118e
xor ecx, ecx
xor edx, edx
jmp 0x401166
cmp al, 0x5c
jne 0x4011e8
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x401183
cmp al, 9
je 0x40116e
cmp al, 0x20
jne 0x401150
test ecx, ecx
je 0x401183
xor edx, edx
jmp 0x40115b
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401180
cmp al, 0x20
je 0x401180
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x4011a9
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401000
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x401172
and edx, 1
jne 0x401172
xor ecx, 1
jmp 0x40115b
Function at 0x405b20
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49a208
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d4028]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi + 0x2c0]
mov edx, eax
mov ecx, eax
shr ecx, 0x18
shr edx, 0x10
push ebx
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], dl
push ebx
mov ecx, eax
lea edx, [esp + 0x1c]
mov byte [esp + 0x1b], al
push edx
lea eax, [esp + 0x1c]
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
call fcn.00462dd4
cmp dword [esp + 0x14], ebx
jne 0x405bba
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00403bb0
lea eax, [ebx + 1]
jmp 0x405c03
push 0x930
lea edi, [esi + 0xf44]
push ebx
push edi
call fcn.00491fe0
mov ecx, dword [esi + 0xde8]
add esp, 0xc
push edi
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045ebc7
mov edx, dword [esi + 0xe0c]
push 1
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00403bb0
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00490f79
mov esp, ebp
pop ebp
ret
Function at 0x406610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494774
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call dword [0x4a2ef4]
push 0
push 0
mov dword [esp + 0x40], 0
mov eax, dword [esi + 0x3b0]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x14b
push eax
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ef4]
push 0x1c
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x40], 1
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x4d6674
call ebp
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
push 0x97e
push eax
lea ecx, [esp + 0x14]
call dword [0x4a2ec8]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x3b0]
push edx
push 0
push 0x14a
push eax
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ee8]
mov ecx, dword [esi + 0x3b0]
push 0
push 0
push 0x151
push ecx
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ef4]
push 0x1c
lea edx, [esp + 0x18]
push edx
push 0x4d6674
mov byte [esp + 0x44], 2
call ebp
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
push 0x982
push eax
lea ecx, [esp + 0x14]
call dword [0x4a2ec8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x3b0]
push eax
push 1
push 0x14a
push ecx
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ee8]
mov edx, dword [esi + 0x3b0]
push 4
push 1
push 0x151
push edx
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ef4]
push 0x1c
lea eax, [esp + 0x18]
mov byte [esp + 0x3c], 3
push eax
push 0x4d6674
call ebp
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
push 0x97d
push eax
lea ecx, [esp + 0x14]
call dword [0x4a2ec8]
mov byte [esp + 0x38], 0
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x3b0]
push ecx
push 2
push 0x14a
push edx
call edi
lea ecx, [esp + 0xc]
call dword [0x4a2ee8]
mov eax, dword [esi + 0x3b0]
push 6
push 2
push 0x151
push eax
call edi
mov ecx, dword [esi + 0x3b0]
push 0
push 0
push 0x146
push ecx
call edi
mov ecx, dword [0x7f6014]
cmp ecx, eax
jl 0x4067c0
xor ecx, ecx
mov dword [0x7f6014], ecx
mov edx, dword [esi + 0x3b0]
push 0
push ecx
push 0x14e
push edx
call edi
mov ecx, esi
call fcn.00406b60
mov ecx, esi
call fcn.00406c20
lea ecx, [esp + 0x10]
call dword [0x4a2ee8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x30
ret
Function at 0x40b540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0dc1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [edi + 0x1e0], esi
call fcn.0040b360
lea ecx, [esp + 0xc]
call dword [0x4a2ef4]
push 0x1c
lea eax, [esp + 0x14]
push eax
push 0x4d6674
mov dword [esp + 0x44], esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x14]
call dword [0x4a2ec8]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [edi + 0x1cc]
mov dword [esp + 0x3c], 1
call dword [0x4a2ea0]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call dword [0x4a2ee8]
lea eax, [esi - 0xf8d]
cmp eax, 5
ja case.default.0x40b5eb
jmp dword [eax*4 + 0x40b838]
push 0x1465
push 0x160
push 0xfa1
mov ecx, edi
call fcn.0040b130
push 0x1466
push 0x161
push 0xfa2
mov ecx, edi
call fcn.0040b130
push 0x1467
push 0x15f
push 0xfa3
mov ecx, edi
call fcn.0040b130
mov dword [edi + 0x214], 0xfa1
mov dword [edi + 0x218], 0xfa2
mov dword [edi + 0x21c], 0xfa3
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x146f
push 0x164
push 0xfab
mov ecx, edi
call fcn.0040b130
push 0x1470
push 0x166
push 0xfac
mov ecx, edi
call fcn.0040b130
mov dword [edi + 0x214], 0xfab
mov dword [edi + 0x218], 0xfac
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x1458
push 0x16a
push 0xfb5
mov ecx, edi
call fcn.0040b130
push 0x1456
push 0x167
push 0xfb4
mov ecx, edi
call fcn.0040b130
push 0x1459
push 0x16b
push 0xfba
mov ecx, edi
call fcn.0040b130
mov dword [edi + 0x214], 0xfb5
mov dword [edi + 0x218], 0xfb4
mov dword [edi + 0x21c], 0xfba
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x1451
push 0x175
push 0xfc8
mov ecx, edi
call fcn.0040b130
push 0x1452
push 0x178
push 0xfca
mov ecx, edi
call fcn.0040b130
push 0x1453
push 0x176
push 0xfcb
mov ecx, edi
call fcn.0040b130
push 0x1455
push 0x17a
push 0xfcd
mov ecx, edi
call fcn.0040b130
mov dword [edi + 0x218], 0xfca
mov dword [edi + 0x21c], 0xfcb
mov dword [edi + 0x220], 0xfcd
mov dword [edi + 0x214], 0xfc8
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x1451
push 0x15d
push 0xfc8
mov ecx, edi
call fcn.0040b130
push 0x1450
push 0x15d
push 0xfc9
mov ecx, edi
call fcn.0040b130
mov dword [edi + 0x218], 0xfc9
mov dword [edi + 0x214], 0xfc8
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40da10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x49b78d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov eax, dword [edi + 0x1d40]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40dc2e
movzx ecx, byte [edi + 0x1cc8]
cmp ecx, 0x7f
ja 0x40dc2e
lea ecx, [esp + 0x18]
call dword [0x4a2ef4]
mov dword [esp + 0x2c], 0
mov edx, dword [edi + 0x43c]
lea esi, [edi + 0x43c]
push edx
lea eax, [esp + 0x1c]
push 0xbf1
push eax
call dword [0x4a2db8]
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
push 0x20000024
push ecx
call fcn.004900cc
cmp eax, 6
jne 0x40dc1c
mov eax, dword [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebp
test eax, eax
jne 0x40dad7
mov edx, dword [esi]
push edx
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
push 0x4a5e08
lea ecx, [esp + 0x18]
call dword [0x4a2ed8]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call ebx
lea ecx, [esp + 0x14]
mov edi, eax
call dword [0x4a2ee8]
test edi, edi
je 0x40db7d
push esi
lea ecx, [esp + 0x18]
call dword [0x4a2ec0]
push str..xmf
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 1
call dword [0x4a2ed8]
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
mov byte [esp + 0x30], 2
call fcn.0046bb74
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call dword [0x4a2ee8]
mov edx, dword [esp + 0x14]
push edx
call ebp
test eax, eax
jne 0x40db6e
mov eax, dword [esp + 0x14]
push eax
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call dword [0x4a2ee8]
push 0x4a5e1c
lea ecx, [esp + 0x20]
call dword [0x4a2ed8]
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
lea ecx, [esp + 0x1c]
mov edi, eax
call dword [0x4a2ee8]
test edi, edi
je 0x40dc18
push esi
lea ecx, [esp + 0x18]
call dword [0x4a2ec0]
mov bl, 3
push str..bin
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call dword [0x4a2ed8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.0046bb74
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call dword [0x4a2ee8]
mov eax, dword [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x40dc0e
mov ecx, dword [esp + 0x14]
push ecx
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
lea ecx, [esp + 0x14]
call dword [0x4a2ee8]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call dword [0x4a2ee8]
push 1
lea ecx, [edi + 0x440]
call fcn.004900fc
push 1
lea ecx, [edi + 0x1af0]
call fcn.004900fc
push 1
lea ecx, [edi + 0x1b50]
call fcn.004900fc
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x40fd10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x49b78d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov eax, dword [edi + 0x19e0]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40ff2e
movzx ecx, byte [edi + 0x2458]
cmp ecx, 0x7f
ja 0x40ff2e
lea ecx, [esp + 0x18]
call dword [0x4a2ef4]
mov dword [esp + 0x2c], 0
mov edx, dword [edi + 0x43c]
lea esi, [edi + 0x43c]
push edx
lea eax, [esp + 0x1c]
push 0xbf1
push eax
call dword [0x4a2db8]
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
push 0x20000024
push ecx
call fcn.004900cc
cmp eax, 6
jne 0x40ff1c
mov eax, dword [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebp
test eax, eax
jne 0x40fdd7
mov edx, dword [esi]
push edx
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
push 0x4a5e08
lea ecx, [esp + 0x18]
call dword [0x4a2ed8]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call ebx
lea ecx, [esp + 0x14]
mov edi, eax
call dword [0x4a2ee8]
test edi, edi
je 0x40fe7d
push esi
lea ecx, [esp + 0x18]
call dword [0x4a2ec0]
push str..xmf
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 1
call dword [0x4a2ed8]
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
mov byte [esp + 0x30], 2
call fcn.0046bb74
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call dword [0x4a2ee8]
mov edx, dword [esp + 0x14]
push edx
call ebp
test eax, eax
jne 0x40fe6e
mov eax, dword [esp + 0x14]
push eax
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call dword [0x4a2ee8]
push 0x4a5e1c
lea ecx, [esp + 0x20]
call dword [0x4a2ed8]
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
lea ecx, [esp + 0x1c]
mov edi, eax
call dword [0x4a2ee8]
test edi, edi
je 0x40ff18
push esi
lea ecx, [esp + 0x18]
call dword [0x4a2ec0]
mov bl, 3
push str..bin
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call dword [0x4a2ed8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.0046bb74
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call dword [0x4a2ee8]
mov eax, dword [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x40ff0e
mov ecx, dword [esp + 0x14]
push ecx
push str.Error_deleting_following_file:__s_n
mov eax, 0x100
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
lea ecx, [esp + 0x14]
call dword [0x4a2ee8]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call dword [0x4a2ee8]
push 1
lea ecx, [edi + 0x440]
call fcn.004900fc
push 1
lea ecx, [edi + 0x227c]
call fcn.004900fc
push 1
lea ecx, [edi + 0x22dc]
call fcn.004900fc
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x410500
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4946ed
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call dword [0x4a2ef4]
lea eax, [esp + 0xc]
push eax
xor esi, esi
push 0x4c2
mov ecx, edi
mov dword [esp + 0x48], esi
call fcn.00490168
mov ecx, eax
call fcn.00490162
push 2
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [0x4a2d94]
mov esi, eax
mov byte [esp + 0x40], 1
call fcn.0040eb70
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x40], 0
call dword [0x4a2ee8]
test bl, bl
je 0x4105a9
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
jmp 0x4105dc
push 3
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [0x4a2d94]
mov eax, dword [eax]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea ecx, [esp + 0x18]
call dword [0x4a2ee8]
lea ecx, [esp + 0x14]
call dword [0x4a2ef4]
push 0x88b
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 2
call dword [0x4a2eb8]
lea ecx, [esp + 0x10]
call dword [0x4a2ef4]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
mov ebx, 0x4a5d60
mov byte [esp + 0x44], 3
call fcn.0040ec10
add esp, 4
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 4
call dword [0x4a2ea0]
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 3
call dword [0x4a2ee8]
mov eax, dword [esp + 0x20]
test eax, eax
mov ecx, dword [esp + 0x1c]
ja 0x41064e
test ecx, ecx
jbe 0x41066e
mov edx, dword [esp + 0x14]
shrd ecx, eax, 0x14
push edx
push ecx
shr eax, 0x14
lea eax, [esp + 0x18]
push str._d__s
push eax
call dword [0x4a2ee0]
add esp, 0x10
mov ecx, dword [esp + 0x10]
push ecx
push 0x4c5
mov ecx, edi
call fcn.00490168
mov ecx, eax
call fcn.0049016e
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
shrd esi, edx, 0xa
lea ecx, [esp + 0x10]
shr edx, 0xa
call dword [0x4a2ee8]
lea ecx, [esp + 0x14]
call dword [0x4a2ee8]
lea ecx, [esp + 0xc]
call dword [0x4a2ee8]
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4965ef
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x20], esi
call fcn.00490300
mov dword [ebp - 4], esi
mov edi, dword [ebx]
lea esi, [ebp - 0x1c]
call fcn.004178b0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0049030c
push 0
mov byte [ebp - 4], 3
mov ebx, dword [ebx]
push 0x1021
push ebx
lea ecx, [ebp - 0x40]
call fcn.00490228
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x200]
add ebx, 0x1fc
cmp esi, dword [ebx + 8]
mov dword [ebp - 0x18], ebx
jbe 0x414be6
call dword [0x4a3094]
mov edi, ebx
jmp 0x414bf0
mov ebx, dword [ebx + 8]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], ebx
jbe 0x414c01
call dword [0x4a3094]
test edi, edi
je 0x414c0a
cmp edi, dword [ebp - 0x18]
je 0x414c10
call dword [0x4a3094]
cmp esi, ebx
je 0x414c92
test edi, edi
mov ebx, dword [0x4a3094]
jne 0x414c20
call ebx
cmp esi, dword [edi + 8]
jb 0x414c27
call ebx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
test al, 1
je 0x414c80
push esi
lea ecx, [ebp + 8]
call dword [0x4a2ec0]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
push 0x4a4090
push ecx
lea ecx, [ebp + 8]
call dword [0x4a2ecc]
push 0x4a6a78
lea ecx, [ebp + 8]
call dword [0x4a2dbc]
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x40]
call fcn.0049029a
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call dword [0x4a2ee8]
cmp esi, dword [edi + 8]
jb 0x414c87
call ebx
mov ebx, dword [ebp - 0x18]
add esi, 0x20
jmp 0x414bf0
lea ecx, [ebp - 0x40]
call fcn.00490246
mov dword [ebp - 4], 2
mov byte [ebp - 4], 1
call fcn.00490312
lea ecx, [ebp - 0x1c]
call dword [0x4a2ee8]
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00490306
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4