joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405520
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x24]
mov edx, dword [ebx + 8]
push ebp
push esi
sub edx, dword [ebx]
mov esi, dword [ebx + 4]
add edx, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0xc]
mov ebp, ecx
mov ecx, dword [esp + 0x28]
sub eax, esi
add eax, ecx
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea ebx, [ebx]
mov al, byte [ebp + 0x124]
mov edx, dword [ebp + 0x130]
mov ecx, dword [edi]
test al, 4
push 0
lea eax, [esp + 0x14]
je 0x40557f
push 0x1008000
jmp 0x405584
push 0x1000000
push ebx
push edx
push eax
push edi
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jge 0x4055c6
cmp esi, 0x887601c2
jne 0x4055e7
mov eax, dword [ebp + 0x130]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
test esi, esi
jl 0x4055d5
mov eax, dword [0x493aa8]
mov edx, dword [eax]
push eax
call dword [edx + 0x6c]
mov esi, eax
test esi, esi
jl 0x4055dc
cmp esi, 0x887601c2
je 0x405560
jmp 0x4055e7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0x10
push 0x46f688
jmp 0x4055e1
push 0x46f670
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00405070
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10

Function at 0x405720
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov eax, dword [0x493aa8]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x20
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
mov esi, eax
test esi, esi
jge 0x40577e
push 0x46f6a0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00405070
add esp, 4
xor eax, eax
pop esi
add esp, 0x20
ret
mov edx, dword [esp + 0x14]
xor al, al
test dl, 1
mov byte [0x493a6c], al
jne 0x40579e
mov edi, edi
shr edx, 1
inc al
test dl, 1
je 0x405790
mov byte [0x493a6c], al
mov eax, dword [esp + 0x18]
xor cl, cl
test al, 1
mov byte [0x493a70], dl
mov byte [0x493a6d], cl
jne 0x4057c2
shr eax, 1
inc cl
test al, 1
je 0x4057b4
mov byte [0x493a6d], cl
mov ecx, dword [esp + 0x1c]
push ebx
xor bl, bl
test cl, 1
mov byte [0x493a71], al
mov byte [0x493a6e], bl
jne 0x4057ef
lea esp, [esp]
shr ecx, 1
inc bl
test cl, 1
je 0x4057e0
mov byte [0x493a6e], bl
cmp dword [esp + 0x14], 0x10
mov byte [0x493a72], cl
pop ebx
ja 0x405827
cmp dl, 0x1f
sete dl
add dl, 2
cmp al, 0x1f
sete al
add al, 2
cmp cl, 0x1f
sete cl
add cl, 2
mov byte [0x493a74], dl
mov byte [0x493a75], al
mov byte [0x493a76], cl
mov eax, 1
pop esi
add esp, 0x20
ret
Function at 0x405840
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4058aa
mov edx, dword [ecx + 0x130]
test edx, edx
je 0x4058aa
push esi
xor edx, edx
mov esi, eax
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
mov dword [eax], 0x20
mov ecx, dword [ecx + 0x130]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x54]
mov esi, eax
test esi, esi
jge 0x4058a1
push 0x46f6a0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00405070
add esp, 4
xor eax, eax
pop esi
ret 4
mov eax, 1
pop esi
ret 4
xor eax, eax
ret 4

Function at 0x4058b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xe0
push ebx
mov ebx, dword [esp + 0xec]
push ebp
push esi
xor esi, esi
cmp ebx, esi
push edi
mov edi, ecx
jne 0x4058fe
mov eax, dword [edi + 0x130]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x6c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea ebx, [esp + 0x10]
mov edx, dword [esp + 0xf4]
mov ebp, dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [esp + 0x8c], 0x64
mov dword [esp + 0xdc], edx
lea ecx, [ecx]
mov eax, dword [edi + 0x130]
mov ecx, dword [eax]
lea edx, [esp + 0x8c]
push edx
push 0x1000400
push 0
push 0
push ebx
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jge 0x40597b
push 0x46f6b8
call ebp
push esi
call fcn.00405070
add esp, 4
cmp esi, 0x887601c2
jne 0x40596c
mov eax, dword [edi + 0x130]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
test eax, eax
jge 0x405920
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe0
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xe0
ret 8

Function at 0x4059c0
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push 0
push ebp
push edx
mov edx, dword [ebx + 0x130]
push edx
mov edx, dword [esp + 0x24]
mov edi, ecx
mov eax, dword [edi + 0x130]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jge 0x405a46
cmp esi, 0x887601c2
jne 0x405a64
mov eax, dword [ebx + 0x130]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
test esi, esi
jl 0x405a52
mov eax, dword [edi + 0x130]
mov edx, dword [eax]
push eax
call dword [edx + 0x6c]
mov esi, eax
test esi, esi
jl 0x405a59
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 0x130]
mov ecx, dword [eax]
push 0
push ebp
push edx
mov edx, dword [ebx + 0x130]
push edx
mov edx, dword [esp + 0x24]
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jl 0x4059f4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x10
push 0x46f6e4
jmp 0x405a5e
push 0x46f6c8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00405070
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x405df0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x800
lea eax, [esp + 0x808]
push eax
push ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.user32.dll_wvsprintfA]
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 0x800
ret

Function at 0x406740
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
mov esi, ecx
mov dword [esp + 0x34], 0x46464952
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x45564157
mov dword [esp + 0x40], 0x20746d66
mov dword [esp + 0x44], ebx
mov dword [esp + 0x2c], 0x61746164
mov dword [esp + 0x30], ebx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4067d5
mov ecx, dword [esi + 0x3c8]
push ecx
call fcn.0045d8b0
lea edx, [esi + 0xf8]
push edx
mov dword [esi + 0x3c8], ebx
call fcn.0044eb30
add esp, 8
or eax, edi
pop edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
pop esi
pop ebx
add esp, 0x20
ret 0xc
push ebp
mov ebp, dword [esp + 0x3c]
push ebx
push ebx
lea eax, [ebp + 0x1c]
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [esi + 0x3dc], ebx
mov dword [esp + 0x3c], ebx
mov ebx, dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, esi
call fcn.00406080
test eax, eax
mov dword [esp + 0x10], eax
jl 0x4068c8
mov edx, dword [esi + 0x3d4]
mov eax, dword [esi + 0x3c8]
push 0
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
push edi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x406849
mov eax, dword [esi + 0x3dc]
test eax, eax
je 0x4067f7
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
push 1
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub eax, 8
push 0
mov dword [esp + 0x24], eax
push 0
sub eax, ebp
push 0
sub eax, 0x14
push edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x38]
push ecx
push 0x14
lea edx, [esp + 0x28]
push edx
push edi
call ebx
mov ecx, dword [esp + 0x38]
push 0
lea eax, [esp + 0x38]
push eax
push ebp
push ecx
push edi
call ebx
push 0
lea edx, [esp + 0x38]
push edx
push 8
lea eax, [esp + 0x20]
push eax
push edi
call ebx
push edi
mov dword [esi + 0x3dc], 1
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
mov ecx, esi
call fcn.00405f20
push edi
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4074a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.kernel32.dll_WriteFile]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x1c]
push eax
mov ebp, ecx
push 4
lea ecx, [ebp + 0x20]
push ecx
push edi
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
cmp esi, eax
je 0x407548
jmp 0x4074d0
mov edx, dword [ebp]
mov ecx, esi
sub ecx, edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x24], ecx
call ebx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esi + 8]
push edx
push edi
call ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esi + 0xc]
push ecx
push edi
call ebx
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esi + 0x10]
push eax
push edi
call ebx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esi + 0x14]
push edx
push edi
call ebx
mov esi, dword [esi]
lea eax, [ebp + 8]
cmp esi, eax
jne 0x4074d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x407690
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00407450
mov esi, dword [esp + 0x30]
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
jg 0x407776
push ebp
xor eax, eax
xor ebp, ebp
cmp ecx, eax
jle 0x407775
jmp 0x4076d6
xor eax, eax
lea edx, [esp + 0x18]
push eax
mov ecx, edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push 4
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x2c], ecx
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x30]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x34]
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x38]
push edx
push esi
call edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.004073a0
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, eax
jl 0x4076d4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x4087c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
push edi
je 0x4087da
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov dword [esi + 4], 0
mov eax, dword [esp + 0x10]
push 0
push 0x8000001
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x408821
push 0
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push 0
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 4], eax
jne 0x408829
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 4]
lea ecx, [eax + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [eax]
add ecx, edx
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 4]
add edx, ecx
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 8]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x24], eax
pop edi
mov dword [esi + 0x20], edx
mov word [esi + 0x28], 0
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x408880
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
mov cx, word [eax]
mov edx, dword [esi + 0x1c]
mov word [esi + 0x28], cx
mov ecx, dword [esi + 0x10]
add eax, 8
add edx, ecx
cmp eax, edx
mov dword [esi + 0x24], eax
jae 0x4088a3
xor eax, eax
pop esi
ret
push 0x46fd58
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x24], eax
mov word [esi + 0x28], 0
mov eax, 1
pop esi
ret

Function at 0x409840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d02e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi], 0x46fdb4
mov dword [esp + 0x18], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea edi, [esi + 0x44]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.00405290
mov dword [edi], 0x46fdac
lea edi, [esi + 0x17c]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.00405290
mov dword [edi], 0x46fdac
mov dword [esi + 4], ebx
mov byte [esi + 0xc], bl
xor eax, eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2c0], ebx
mov dword [esi + 0x2c4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2d0], ebx
mov dword [esi + 0x2d4], ebx
pop edi
mov dword [esi + 0x2c8], 0xff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a310
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [sym.imp.kernel32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
mov ebx, eax
mov eax, dword [esp + 0x3c]
push 0
lea eax, [eax + eax*2]
push 0
lea ecx, [ebx + eax*4]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 0xc
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [esp + 0x2c]
test eax, eax
jg 0x40a364
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
push 0
push 0
add eax, ebx
push eax
push esi
call edi
push 0
push 0
push 0
push 0x46f548
call fcn.0043fe60
push eax
mov dword [esp + 0x20], eax
call fcn.00440730
mov ecx, dword [esp + 0x20]
push 0x409b60
push esi
push ecx
mov dword [esp + 0x30], eax
call fcn.004407d0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.0043f080
mov esi, dword [esp + 0x70]
push 0
push 0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x48]
push esi
push ecx
push edx
push eax
call fcn.0043ff70
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
add esp, 0x4c
push ecx
push edx
call fcn.0043ff50
mov ebx, dword [esp + 0x54]
mov dword [ebx], eax
add eax, 4
imul eax, dword [esi]
push eax
call fcn.0044ea7e
mov edi, dword [esp + 0x4c]
mov dword [edi], eax
mov edx, dword [esi]
add esp, 0xc
xor ecx, ecx
test edx, edx
lea eax, [eax + edx*4]
jle 0x40a41e
nop
mov edx, dword [edi]
mov dword [edx + ecx*4], eax
add eax, dword [ebx]
mov edx, dword [esi]
inc ecx
cmp ecx, edx
jl 0x40a410
mov eax, dword [edi]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0043f8f0
mov edi, dword [esp + 0x58]
add esp, 8
test edi, edi
je 0x40a497
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
push edx
call fcn.004400d0
mov eax, dword [esp + 0x4c]
add esp, 0x10
test eax, eax
jne 0x40a468
mov dword [edi], eax
mov eax, dword [esp + 0x54]
mov dword [eax], 0
jmp 0x40a497
lea ecx, [eax + eax*2]
push ecx
call fcn.0044ea7e
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x18]
mov dword [edi], eax
mov eax, dword [esp + 0x40]
mov dword [edx], eax
mov edi, dword [edi]
lea ecx, [eax + eax*2]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0043fe90
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x40b460
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x104
push 0x493e50
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
push 0x4700cc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.kernel32.dll_lstrcatA]
lea edx, [esp]
push edx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b499
test al, 0x10
jne 0x40b4c7
push 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40b4c7
mov ecx, dword [0x4817b4]
push eax
push ecx
push 0x470020
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor al, al
add esp, 0x104
ret
mov al, 1
add esp, 0x104
ret

Function at 0x40b8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46d068
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [esp], 0
mov ecx, dword [0x481880]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
mov dword [esp + 0x24], 0
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b966
mov edx, dword [0x48189c]
mov eax, dword [0x4817b4]
mov ecx, dword [0x493b80]
push edx
push eax
push 0x10
push ecx
call fcn.00405080
mov eax, dword [esp + 0x10]
add esp, 0x10
test eax, eax
je 0x40b955
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x481884]
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea edx, [esp + 8]
push edx
push 0x493e50
push 0
push 0
push eax
push ecx
mov dword [esp + 0x20], 0x104
call esi
test eax, eax
je 0x40b9d2
mov edx, dword [0x4818a0]
mov eax, dword [0x4817b4]
mov ecx, dword [0x493b80]
push edx
push eax
push 0x10
push ecx
call fcn.00405080
mov eax, dword [esp + 0x14]
add esp, 0x10
test eax, eax
je 0x40b9c0
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x481888]
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x493ce8
push 0
push 0
push eax
push ecx
mov dword [esp + 0x20], 0x104
call esi
test eax, eax
je 0x40ba01
mov edx, dword [0x4818a4]
jmp 0x40b999
mov eax, dword [0x48188c]
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x493f90
push 0
push 0
push eax
push ecx
mov dword [esp + 0x20], 0x104
call esi
test eax, eax
je 0x40ba33
mov edx, dword [0x4818a8]
jmp 0x40b999
mov eax, dword [esp + 4]
test eax, eax
je 0x40ba42
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40ed70
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
push 0
push 0x400
lea eax, [esp + 8]
push eax
push 0
push ecx
push 0
push 0x1200
call dword [sym.imp.kernel32.dll_FormatMessageA]
lea edx, [esp]
push edx
mov byte [esp + eax + 4], 0xa
mov byte [esp + eax + 5], 0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 0x404
ret

Function at 0x40edc0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0x800
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.user32.dll_wvsprintfA]
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call fcn.00412ca0
test al, al
jne 0x40edf6
call fcn.00405240
mov ecx, dword [esp + 0x808]
mov edx, dword [esp + 0x80c]
push ecx
mov ecx, dword [esp + 0x808]
push edx
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
add esp, 0x800
ret

Function at 0x40eea0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x5c3a41
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x120]
mov edi, dword [sym.imp.kernel32.dll_GetVolumeInformationA]
mov ebp, dword [sym.imp.kernel32.dll_lstrcmpA]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x14]
test ecx, eax
je 0x40ef22
mov dl, bl
lea eax, [esp + 0x10]
add dl, 0x41
push eax
mov byte [esp + 0x14], dl
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x40ef22
push 0
push 0
push 0
push 0
push 0
push 0x100
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x2c]
push edx
call edi
push esi
lea eax, [esp + 0x1c]
push eax
call ebp
test eax, eax
je 0x40ef35
inc ebx
cmp ebx, 0x1a
jb 0x40eed1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [ecx], edx
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x40efc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x3c
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40efef
xor eax, eax
pop esi
add esp, 0x3c
ret
push edi
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xe
lea edx, [esp + 0x18]
push edx
push esi
call edi
push 0
lea eax, [esp + 0xc]
push eax
push 0x28
lea ecx, [esp + 0x28]
push ecx
push esi
call edi
cmp word [esp + 0xc], 0x4d42
jne 0x40f066
cmp word [esp + 0x2a], 8
jne 0x40f066
cmp dword [esp + 0x2c], 1
jne 0x40f066
mov edx, dword [esp + 0x16]
push 0
push 0
push edx
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x48]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
push edx
push esi
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x3c
ret
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x3c
ret