joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10fbf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10fbf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10fbf07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fbf06a
add dl, dl
jne 0x10fbf089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fbf0dc
xor eax, eax
add dl, dl
jne 0x10fbf096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fbf17d
add dl, dl
jne 0x10fbf0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fbf0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fbf0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fbf0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10fbf0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10fbf075
mov eax, 1
add dl, dl
jne 0x10fbf0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fbf0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fbf0e1
sub eax, ebx
mov ebx, 1
jne 0x10fbf128
mov ecx, 1
add dl, dl
jne 0x10fbf10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fbf119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fbf105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fbf075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10fbf13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fbf14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fbf136
cmp eax, 0x7d00
jae 0x10fbf16d
cmp eax, 0x500
jb 0x10fbf168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fbf075
cmp eax, 0x7f
ja 0x10fbf170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fbf075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10fbf19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10fbf075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x408114
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408166
test eax, edx
je 0x408169
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408129
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40814f
add ecx, 4
js 0x40813f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40814c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408175
test edx, edx
jne 0x40811c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b3a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3e1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404b74
jmp 0x40b3ea
mov eax, ebx
mov edx, esi
call fcn.00404ad8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b3f4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b416
movzx eax, byte [esp]
jmp 0x40b418
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40baa8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b920
mov eax, dword [0x428e50]
cmp byte [eax], 0
je 0x40bb24
mov eax, dword [0x428d14]
call fcn.00403374
call fcn.00402f90
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408c6c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bb6c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bb5a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x428cd8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42b7f8]
call fcn.00406034
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x41cd68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x42d9e8
cmp dword [edi], 0
jne 0x41cde4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x42d9e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x428b48
mov ecx, 2
call fcn.00403024
mov edx, 0x41cd40
lea eax, [esi + 5]
call fcn.0041cd60
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041cd60
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cdb9
mov dword [0x42d9e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f2e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x41f378
push 0
mov eax, ebx
call fcn.00404f14
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x41f353
mov ebx, esi
test ebx, ebx
je 0x41f329
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.00404f14
push eax
push 1
push 0
mov eax, edi
call fcn.00404f14
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x41f36e
mov ecx, dword [0x428d2c]
mov dl, 1
mov eax, dword [0x41d880]
call fcn.0040bc2c
call fcn.004044cc
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4245a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x4245e8
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4245da
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x4245b8
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x424c84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004066a4
xor eax, eax
push ebp
push 0x424dbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0041f248
xor eax, eax
push ebp
push 0x424d8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x424d73
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0041f248
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x424d6b
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x424d6b
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.0041f248
lea eax, [ebp - 8]
call fcn.00406630
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.0041f248
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0041f248
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.00406648
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00424bec
inc esi
dec ebx
jne 0x424ce6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424d95
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret

Function at 0x4255c8
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x42db00]
mov ecx, 0x40
call fcn.00403024
mov dword [0x42da4c], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x42da4c
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x4255f6
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x42da4c]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.004254a8
mov esi, eax
mov dword [ebx*4 + 0x42da4c], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.004254a8
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x425666
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x425616
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4256f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x42daf8]
sub dword [ebx + 8], eax
mov eax, dword [0x42daf4]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.004254a8
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.004254a8
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42da50]
mov edx, edi
call fcn.004254b0
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42da4c]
mov edx, ebp
call fcn.004254b0
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x42570a
mov eax, dword [0x42da50]
sub dword [ebx + 0xc], eax
mov eax, dword [0x42da4c]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4013a1
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
push esi
push edi
mov edi, dword [ebp + 0xfb0]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401445
push esi
call fcn.004041a1
test al, al
je 0x401445
push esi
call fcn.004041b9
test al, al
jne 0x401445
push 0x800
push edi
lea eax, [ebp - 0x60]
push eax
call fcn.00406e4c
lea eax, [ebp - 0x60]
push eax
call fcn.0040d948
pop ecx
lea eax, [eax*2 + 2]
cmp eax, 0x1002
jae 0x40145e
xor ecx, ecx
push 0x1e
mov word [ebp + eax - 0x60], cx
lea eax, [ebp - 0x80]
push ecx
push eax
call fcn.0040aea0
add esp, 0xc
mov dword [ebp - 0x7c], 3
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp + 0xfa4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409f4a
lea esp, [ebp + 0xfa8]
pop ebp
ret 4
call fcn.00409e6e
int3

Function at 0x4039eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x403a04
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403a77
mov ecx, esi
call fcn.00403acc
test al, al
je 0x403a3f
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x403a3f
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004039eb
jmp 0x403a7a
cmp dword [esi + 0xc], 1
jne 0x403a54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x403a54
xor eax, eax
jmp 0x403a7a
cmp dword [esi + 0xc], 0
jne 0x403a72
mov ebx, 0x8000
cmp dword [ebp + 0xc], ebx
jbe 0x403a72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x403a72
push ebx
jmp 0x403a33
or eax, 0xffffffff
jmp 0x403a7a
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403af7
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x105c
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x1058], eax
push ebx
mov ebx, dword [esp + 0x1068]
push ebp
mov ebp, dword [esp + 0x1068]
push edi
mov edi, ecx
mov dword [esp + 0x18], ebp
and dword [edi + 0x1020], 0
cmp byte [edi + 0x1d], 0
jne 0x403b3c
test bl, 4
jne 0x403b3c
xor cl, cl
jmp 0x403b3e
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x403b63
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x403b72
or ebx, 2
xor eax, eax
lea ecx, [esp + 0x20]
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov dword [esp + 0x10], eax
call fcn.0040120f
cmp byte [edi + 0x1c], 0
je 0x403b99
or esi, 0x100
push 0
push dword [esp + 0x14]
push 3
push 0
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x403c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push 0x800
push eax
push dword [esp + 0x24]
call fcn.00404fa3
test al, al
je 0x403c01
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x403bfc
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x403c12
cmp dword [esp + 0x14], 2
jne 0x403c12
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x403c38
cmp ebp, 0xffffffff
je 0x403c38
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
or dword [esp + 0x14], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x12], al
setne bl
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
cmp ebp, 0xffffffff
je 0x403c63
push 0x800
push dword [esp + 0x1c]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.00406e4c
mov ecx, dword [esp + 0x1064]
mov al, bl
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409f4a
add esp, 0x105c
ret 8
Function at 0x403e9c
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, ecx
test ebp, ebp
jne 0x403eb2
mov al, 1
jmp 0x40402d
cmp dword [ebx + 0xc], 1
jne 0x403ec3
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebx + 4], eax
push esi
push edi
and dword [esp + 0x2c], 0
cmp dword [ebx + 0xc], 0
mov byte [esp + 0x10], 0
je 0x403f1c
xor esi, esi
test ebp, ebp
je 0x403f44
mov eax, ebp
sub eax, esi
cmp eax, 0x4000
jb 0x403eeb
mov eax, 0x4000
push 0
lea ecx, [esp + 0x30]
push ecx
push eax
mov eax, dword [esp + 0x34]
add eax, esi
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
add al, 1
mov dword [esp + 0x10], eax
je 0x403f44
add esi, 0x4000
cmp esi, ebp
jb 0x403edb
jmp 0x403f3c
push 0
lea eax, [esp + 0x30]
push eax
push ebp
push dword [esp + 0x34]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
mov dword [esp + 0x10], eax
test al, al
jne 0x404023
cmp byte [ebx + 0x14], 0
je 0x404023
cmp dword [ebx + 0xc], 0
jne 0x404023
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
mov edi, eax
call dword [edx + 0x14]
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x1e]
push eax
mov dword [esp + 0x20], edx
call fcn.00404114
push edi
mov dword [esp + 0x18], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
jb 0x403fd3
ja 0x403f93
cmp dword [esp + 0x14], ebp
jbe 0x403fd3
mov edx, dword [esp + 0x18]
mov ecx, edx
mov esi, dword [esp + 0x1c]
sub ecx, ebp
mov eax, esi
sbb eax, edi
cmp eax, edi
jg 0x403fd3
jl 0x403fae
cmp ecx, 0xffffffff
ja 0x403fd3
mov ecx, ebp
mov eax, edi
add ecx, edx
adc eax, esi
mov dword [esp + 0x20], eax
js 0x403fd3
jg 0x403fc3
cmp ecx, 0xffffffff
jbe 0x403fd3
lea esi, [ebx + 0x1e]
mov ecx, 0x42d070
push esi
call fcn.00403693
jmp 0x403fd6
lea esi, [ebx + 0x1e]
push edi
push esi
mov ecx, 0x42d070
call fcn.00403506
test al, al
je 0x404014
cmp dword [esp + 0x2c], ebp
jae 0x403ec5
cmp dword [esp + 0x2c], edi
jbe 0x403ec5
mov esi, dword [ebx]
mov ecx, ebx
push edi
call dword [esi + 0x14]
sub eax, dword [esp + 0x30]
mov ecx, ebx
sbb edx, edi
push edx
push eax
call dword [esi + 0x10]
jmp 0x403ec5
lea eax, [ebx + 0x1e]
mov ecx, 0x42d070
push eax
push edi
call fcn.00403690
mov al, byte [esp + 0x10]
pop edi
mov byte [ebx + 8], 1
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x4040b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404100
push 0x800
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00404fa3
test al, al
je 0x404100
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f4a
mov esp, ebp
pop ebp
ret 4
Function at 0x404114
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0xf9c]
mov eax, 0x101c
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp + 0xf98], eax
mov eax, dword [ebp + 0xfa4]
lea ecx, [ebp - 0x68]
push 0x800
push ecx
push eax
call fcn.00404ed8
and dword [ebp - 0x6c], 0
lea eax, [ebp - 0x78]
and dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
movzx eax, word [ebp - 0x68]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x404186
mov edx, dword [ebp - 0x6c]
cmp edx, dword [ebp - 0x74]
ja 0x404186
xor eax, eax
add eax, dword [ebp - 0x70]
adc edx, 0
jmp 0x40418a
xor eax, eax
xor edx, edx
mov ecx, dword [ebp + 0xf98]
xor ecx, ebp
call fcn.00409f4a
lea esp, [ebp + 0xf9c]
pop ebp
ret 4

Function at 0x4041c6
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040528a
movzx eax, word [eax]
cmp eax, 0x2e
je 0x404201
cmp eax, 0x20
je 0x404201
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404234
push esi
call fcn.0040409d
test al, al
jne 0x404247
push 0x800
lea eax, [ebp - 0x1004]
push eax
push esi
call fcn.00404fa3
test al, al
je 0x404247
push 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404247
cmp byte [ebp + 0xc], 0
je 0x404243
push dword [ebp + 0x10]
push esi
call fcn.00404270
xor eax, eax
jmp 0x40425f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40425c
cmp eax, 3
je 0x40425c
xor eax, eax
inc eax
jmp 0x40425f
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409f4a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404270
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x4042ca
push 0x800
lea eax, [ebp - 0x1004]
push eax
push esi
call fcn.00404fa3
test al, al
je 0x4042ca
push dword [ebp + 0xc]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f4a
mov esp, ebp
pop ebp
ret 8