joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
xor eax, dword [ecx + 0x10a8]
mov edx, dword [edi]
mov ebp, dword [edi + 8]
xor edx, dword [ecx + 0x10a4]
xor ebp, dword [ecx + 0x10ac]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
mov edi, eax
xor edi, dword [ecx + 0x10b0]
xor eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov edi, edi
and eax, 3
mov edx, edi
rol edx, 0xb
add edx, ebp
mov esi, dword [ecx + eax*4 + 0x10a4]
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ebx, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + ecx + 0xfa4]
or ebx, eax
movzx eax, dl
mov edx, ebp
shl ebx, 8
ror edx, 0xf
xor edx, edi
movzx eax, byte [eax + ecx + 0xfa4]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ebx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
movzx esi, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
movzx eax, dl
shl esi, 8
mov edx, ebp
mov ebp, ebx
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
mov eax, dword [esp + 0x18]
xor esi, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], edi
mov edi, esi
mov dword [esp + 0x18], eax
cmp eax, 0x20
jl 0x40b860
mov eax, dword [ecx + 0x10a4]
mov edi, dword [esp + 0x24]
xor eax, ebx
push edi
mov dword [edi], eax
mov eax, dword [ecx + 0x10a8]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x10ac]
xor eax, edx
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x10b0]
xor eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
call fcn.0040c460
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x40bb10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov word [ecx + 0x10b5], 0
mov byte [ecx + 0x10b4], 0
mov dl, byte [esi]
test dl, dl
je 0x40bb56
push ebx
xor al, al
xor bl, bl
xor ah, ah
add al, dl
lea esi, [esi + 1]
add ah, dl
rol al, 1
xor bl, dl
mov byte [ecx + 0x10b4], ah
mov byte [ecx + 0x10b5], bl
mov byte [ecx + 0x10b6], al
mov dl, byte [esi]
test dl, dl
jne 0x40bb32
pop ebx
pop esi
ret 4
Function at 0x40bb60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xba4]
push eax
call fcn.0040af90
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bb80
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.0040ae60
mov word [esi + 0x10b8], ax
shr eax, 0x10
mov word [esi + 0x10ba], ax
xor eax, eax
mov dword [esi + 0x10bc], eax
mov dl, byte [edi]
test dl, dl
je 0x40bbf3
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
movzx eax, dl
lea edi, [edi + 1]
movzx edx, dl
lea ecx, [esi + eax*4]
movzx eax, word [ecx + 0xba4]
xor ax, dx
xor bp, ax
mov word [esi + 0x10bc], bp
movzx eax, word [ecx + 0xba6]
add ax, dx
add bx, ax
mov word [esi + 0x10be], bx
mov dl, byte [edi]
test dl, dl
jne 0x40bbb7
pop ebp
pop ebx
pop edi
pop esi
ret 4
Function at 0x40c460
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, edx
push ebx
mov ebx, dword [ecx + 0x10a8]
push ebp
mov ebp, dword [ecx + 0x10ac]
push esi
lea esi, [edx + 1]
mov dword [esp + 0xc], 4
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, edx
sub eax, esi
add eax, 2
sub edx, esi
mov dword [esp + 0x18], eax
push edi
mov edi, dword [ecx + 0x10a4]
lea eax, [edx + 3]
mov edx, dword [ecx + 0x10b0]
mov dword [esp + 0x20], eax
lea ebx, [ebx]
mov eax, dword [esp + 0x18]
lea esi, [esi + 4]
movzx eax, byte [eax + esi - 4]
xor edi, dword [ecx + eax*4 + 0xba4]
mov dword [ecx + 0x10a4], edi
movzx eax, byte [esi - 4]
xor ebx, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x10a8], ebx
movzx eax, byte [eax + esi - 4]
xor ebp, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x10ac], ebp
movzx eax, byte [eax + esi - 4]
xor edx, dword [ecx + eax*4 + 0xba4]
sub dword [esp + 0x10], 1
mov dword [ecx + 0x10b0], edx
jne 0x40c4b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x40c7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x19c
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1a8]
push ebx
mov ebx, dword [esp + 0x1b4]
push ebp
mov ebp, dword [esp + 0x1bc]
push esi
mov esi, dword [esp + 0x1b8]
mov dword [esp + 0x10], eax
mov eax, esi
push edi
mov edi, dword [esp + 0x1b0]
mov dword [esp + 0x18], edi
cmp esi, 0x40
jb 0x40c7f6
mov eax, 0x40
push eax
push ecx
lea eax, [esp + 0x14c]
push eax
call fcn.00431df0
add esp, 0xc
cmp esi, 0x44
jae 0x40ca0d
lea eax, [esi + 1]
mov byte [esp + esi + 0x144], 0
cmp eax, 0x44
jae 0x40ca0d
mov byte [esp + eax + 0x144], 0
lea eax, [esi + 2]
cmp eax, 0x44
jae 0x40ca0d
push 0
push 0
push 0
mov byte [esp + eax + 0x150], 0
lea eax, [esp + 0x130]
push 0
push eax
lea eax, [esi + 4]
mov byte [esp + esi + 0x15b], 1
push eax
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x1d0]
push edi
call fcn.0040c520
mov eax, dword [esp + 0x1cc]
lea esi, [esp + 0x124]
dec eax
mov dword [esp + 0xfc], ebp
mov ecx, 8
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x104]
xor ebp, ebp
mov dword [esp + 0xf0], 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xf4], 0x10
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x100], eax
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], ebp
jmp 0x40c8e0
mov ebx, dword [esp + ebp + 0xec]
test ebx, ebx
je 0x40c991
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x198]
push eax
push 0x20
lea eax, [esp + 0x13c]
push eax
push dword [esp + 0x1d0]
push ebp
call fcn.0040c520
mov ecx, 8
lea esi, [esp + 0x188]
lea edi, [esp + 0x124]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + eax + 0x124]
xor byte [esp + eax + 0x104], cl
movzx ecx, byte [esp + eax + 0x125]
xor byte [esp + eax + 0x105], cl
movzx ecx, byte [esp + eax + 0x126]
xor byte [esp + eax + 0x106], cl
movzx ecx, byte [esp + eax + 0x127]
xor byte [esp + eax + 0x107], cl
add eax, 4
cmp eax, 0x20
jb 0x40c940
sub ebx, 1
jne 0x40c8f3
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + ebp + 0xf8]
lea esi, [esp + 0x104]
add ebp, 4
mov ecx, 8
mov dword [esp + 0x14], ebp
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0xc
jb 0x40c8e0
push 0x44
lea eax, [esp + 0x148]
push eax
call fcn.00420960
push 0x20
lea eax, [esp + 0x108]
push eax
call fcn.00420960
push 0x20
lea eax, [esp + 0x128]
push eax
call fcn.00420960
push 0x20
lea eax, [esp + 0x18c]
push eax
call fcn.00420960
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x19c
ret 0x20
call fcn.0042fab0
int3
Function at 0x410f80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44359b
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3010]
push 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x411168
cmp eax, 0x800
jae 0x411168
push 0x800
lea eax, [ebp - 0x4010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x411168
cmp eax, 0x800
jae 0x411168
lea eax, [ebp - 0x3010]
push eax
call fcn.00417280
mov ebx, eax
lea eax, [ebp - 0x4010]
push eax
call fcn.00417280
mov esi, eax
cmp word [esi], 0
je 0x411168
push esi
push ebx
call fcn.004251f0
test eax, eax
je 0x411168
push esi
push edi
call fcn.00417280
push eax
call fcn.004251f0
test eax, eax
jne 0x411168
mov word [ebp - 0x1010], ax
xor esi, esi
test ax, ax
jne 0x4110c1
push 0x800
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.00422a80
push esi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00417280
push eax
call fcn.00405860
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.004124b0
test al, al
je 0x4110a6
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x4110ad
mov ax, word [ebp - 0x1010]
add esi, 0x7b
cmp esi, 0x2710
jl 0x411054
test ax, ax
je 0x411168
push 0x800
push edi
lea eax, [ebp - 0x2010]
push eax
call fcn.00422a80
push 0x800
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.00417380
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x411168
lea ecx, [ebp - 0x5034]
call fcn.00411190
push edi
mov dword [ebp - 4], 0
xor bl, bl
call fcn.004124b0
test al, al
jne 0x41112b
push 0x12
push edi
lea ecx, [ebp - 0x5034]
call fcn.00411320
mov bl, al
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x411159
lea ecx, [ebp - 0x5034]
call fcn.004112c0
lea ecx, [ebp - 0x5034]
call fcn.00411440
lea ecx, [ebp - 0x5034]
call fcn.004111d0
mov al, 1
jmp 0x41116a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f943
mov esp, ebp
pop ebp
ret 4
Function at 0x4114a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x4114b7
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov ebx, dword [esp + 0x14]
push 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41155f
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x41150e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4114f2
cmp eax, 3
jne 0x41150e
cmp edi, 0x4e20
jbe 0x41150e
push 0x4e20
push ebx
mov ecx, esi
call fcn.004114a0
pop edi
pop esi
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 1
jne 0x411528
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x411528
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 0
jne 0x411555
cmp edi, 0x8000
jbe 0x411555
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x411555
push 0x8000
push ebx
mov ecx, esi
call fcn.004114a0
pop edi
pop esi
pop ebx
pop ecx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x411680
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1014
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1010], eax
mov edx, dword [esp + 0x1018]
push ebx
mov ebx, dword [esp + 0x1020]
push ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp byte [edi + 0x1d], 0
mov dword [edi + 0x1020], 0
jne 0x4116c8
test bl, 4
jne 0x4116c8
xor cl, cl
jmp 0x4116ca
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x4116ef
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x4116fe
or ebx, 2
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
cmp byte [edi + 0x1c], 0
mov dword [esp + 0x18], eax
je 0x41171c
or esi, 0x100
push 0
push eax
push 3
push 0
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x411792
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0x800
push eax
push dword [esp + 0x1c]
call fcn.00416a90
test al, al
je 0x411781
push 0
push dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41177c
mov dword [esp + 0x10], eax
cmp ebp, 0xffffffff
jne 0x411792
cmp dword [esp + 0x10], 2
jne 0x411792
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x4117be
cmp ebp, 0xffffffff
je 0x4117be
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebp, 0xffffffff
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
setne bl
mov byte [edi + 0x10], 0
cmp ebp, 0xffffffff
je 0x4117ed
push 0x800
push dword [esp + 0x14]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.00422a80
mov ecx, dword [esp + 0x101c]
mov al, bl
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1014
ret 8
Function at 0x411d40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x411d6f
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042f943
add esp, 0x1c
ret 8
cmp dword [ebp + 0xc], 1
jne 0x411d80
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp + 4], eax
push esi
push edi
cmp dword [ebp + 0xc], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x411de2
xor esi, esi
test ebx, ebx
je 0x411e09
jmp 0x411da0
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x411db0
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
je 0x411e09
add esi, 0x4000
cmp esi, ebx
jb 0x411da0
jmp 0x411e01
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
jne 0x411f0a
cmp byte [ebp + 0x14], 0
je 0x411f0a
cmp dword [ebp + 0xc], 0
jne 0x411f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x445258]
mov ecx, ebp
call esi
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.00412590
push edi
mov dword [esp + 0x1c], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x411ea1
ja 0x411e63
cmp dword [esp + 0x18], ebx
jbe 0x411ea1
mov esi, dword [esp + 0x1c]
mov edx, esi
mov edi, dword [esp + 0x20]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x411ea1
jl 0x411e7e
cmp edx, 0xffffffff
ja 0x411ea1
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x24], ecx
js 0x411ea1
jg 0x411e91
cmp eax, 0xffffffff
jbe 0x411ea1
lea esi, [ebp + 0x1e]
mov ecx, 0x45c338
push esi
call fcn.0040d460
jmp 0x411ea4
lea esi, [ebp + 0x1e]
push 0
push esi
mov ecx, 0x45c338
call fcn.0040cdb0
test al, al
je 0x411efa
mov eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x411d82
test eax, eax
je 0x411d82
mov edi, dword [ebp]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x445258]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x18]
mov esi, dword [edi + 0x10]
mov ecx, esi
sbb edx, 0
push edx
push eax
call dword [0x445258]
mov ecx, ebp
call esi
jmp 0x411d82
lea edx, [ebp + 0x1e]
mov ecx, 0x45c338
push edx
push 0
call fcn.0040d3f0
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 8], 1
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1c
ret 8
Function at 0x412430
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x412487
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412487
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x412489
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4

Function at 0x4124b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412503
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00416a90
test al, al
je 0x412500
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop edi
pop esi
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4

Function at 0x412520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412572
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00416a90
test al, al
je 0x412570
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x412572
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4

Function at 0x412590
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.00416800
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x412621
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x412621
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.0042f943
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.0042f943
add esp, 0x101c
ret 4
Function at 0x412660
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
lea ecx, [esp + 0x20c]
push 0x800
push ecx
push eax
call fcn.00416850
push 0x105
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x412764
mov ecx, 0x445b30
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4126ea
test dx, dx
je 0x4126e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4126ea
add eax, 4
add ecx, 4
test dx, dx
jne 0x4126c4
xor eax, eax
jmp 0x4126ef
sbb eax, eax
or eax, 1
test eax, eax
je 0x412748
mov ecx, str.FAT32
lea eax, [esp]
jmp 0x412700
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412726
test dx, dx
je 0x412722
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412726
add eax, 4
add ecx, 4
test dx, dx
jne 0x412700
xor eax, eax
jmp 0x41272b
sbb eax, eax
or eax, 1
test eax, eax
je 0x412748
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.0042f943
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.0042f943
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor al, al
xor ecx, esp
call fcn.0042f943
add esp, 0x1210
ret 4

Function at 0x412790
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
lea ecx, [esp]
push 0x800
push ecx
push eax
call fcn.00416850
movzx eax, word [esp]
lea ecx, [esp]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4127f5
cmp eax, 5
je 0x4127f5
xor al, al
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
mov al, 1
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4
Function at 0x412810
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.00417250
movzx eax, word [eax]
cmp eax, 0x2e
je 0x412850
cmp eax, 0x20
je 0x412850
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4128a5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4128d6
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412880
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4128d6
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.00416a90
test al, al
je 0x4128d6
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4128d6
cmp byte [esp + 0x1010], 0
je 0x4128bc
push dword [esp + 0x1014]
push esi
call fcn.00412c20
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4128eb
cmp eax, 3
mov eax, 1
jne 0x4128f0
mov eax, 2
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 0xc

Function at 0x412910
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41295e
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.00416a90
test al, al
je 0x41295e
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4

Function at 0x412980
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x2014]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test bl, bl
jne 0x4129ff
push 0x800
lea eax, [esp + 0x1010]
push eax
push edi
call fcn.00416a90
test al, al
je 0x4129ff
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00416a90
test al, al
je 0x4129ff
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x412a01
mov al, bl
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x2004
ret 8