joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x19c
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1a8]
push ebx
mov ebx, dword [esp + 0x1b4]
push ebp
mov ebp, dword [esp + 0x1bc]
push esi
mov esi, dword [esp + 0x1b8]
mov dword [esp + 0x10], eax
mov eax, esi
push edi
mov edi, dword [esp + 0x1b0]
mov dword [esp + 0x18], edi
cmp esi, 0x40
jb 0x41e5e6
mov eax, 0x40
push eax
push ecx
lea eax, [esp + 0x14c]
push eax
call fcn.00468820
add esp, 0xc
cmp esi, 0x44
jae 0x41e7fd
lea eax, [esi + 1]
mov byte [esp + esi + 0x144], 0
cmp eax, 0x44
jae 0x41e7fd
mov byte [esp + eax + 0x144], 0
lea eax, [esi + 2]
cmp eax, 0x44
jae 0x41e7fd
push 0
push 0
push 0
mov byte [esp + eax + 0x150], 0
lea eax, [esp + 0x130]
push 0
push eax
lea eax, [esi + 4]
mov byte [esp + esi + 0x15b], 1
push eax
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x1d0]
push edi
call fcn.0041e320
mov eax, dword [esp + 0x1cc]
lea esi, [esp + 0x124]
dec eax
mov dword [esp + 0xfc], ebp
mov ecx, 8
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x104]
xor ebp, ebp
mov dword [esp + 0xf0], 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xf4], 0x10
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x100], eax
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], ebp
jmp 0x41e6d0
mov ebx, dword [esp + ebp + 0xec]
test ebx, ebx
je 0x41e781
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x198]
push eax
push 0x20
lea eax, [esp + 0x13c]
push eax
push dword [esp + 0x1d0]
push ebp
call fcn.0041e320
mov ecx, 8
lea esi, [esp + 0x188]
lea edi, [esp + 0x124]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + eax + 0x124]
xor byte [esp + eax + 0x104], cl
movzx ecx, byte [esp + eax + 0x125]
xor byte [esp + eax + 0x105], cl
movzx ecx, byte [esp + eax + 0x126]
xor byte [esp + eax + 0x106], cl
movzx ecx, byte [esp + eax + 0x127]
xor byte [esp + eax + 0x107], cl
add eax, 4
cmp eax, 0x20
jb 0x41e730
sub ebx, 1
jne 0x41e6e3
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + ebp + 0xf8]
lea esi, [esp + 0x104]
add ebp, 4
mov ecx, 8
mov dword [esp + 0x14], ebp
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0xc
jb 0x41e6d0
push 0x44
lea eax, [esp + 0x148]
push eax
call fcn.00454020
push 0x20
lea eax, [esp + 0x108]
push eax
call fcn.00454020
push 0x20
lea eax, [esp + 0x128]
push eax
call fcn.00454020
push 0x20
lea eax, [esp + 0x18c]
push eax
call fcn.00454020
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004669f1
add esp, 0x19c
ret 0x20
call fcn.00466e7e
int3
Function at 0x41f700
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov edx, dword [esi]
mov eax, dword [edi]
cmp eax, edx
jbe 0x41f770
mov ebx, 1
cmp edx, ebx
jb 0x41f748
mov eax, dword [esp + 0x18]
lea ecx, [esi + 4]
mov ebp, edi
sub ebp, esi
sub eax, esi
mov edi, eax
lea ecx, [ecx]
mov eax, dword [ecx + ebp]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc ebx
mov dword [edi + ecx - 4], eax
mov edx, dword [esi]
cmp ebx, edx
jbe 0x41f730
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov esi, dword [esp + 0x18]
sub eax, edx
shl eax, 2
push eax
lea eax, [edi + ebx*4]
push eax
lea eax, [esi + ebx*4]
push eax
call fcn.00468820
mov eax, dword [edi]
add esp, 0xc
mov dword [esi], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
jae 0x41f7cc
mov edx, 1
cmp eax, edx
jb 0x41f7a4
mov ebp, dword [esp + 0x18]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
jmp 0x41f790
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
mov eax, dword [edi]
cmp edx, eax
jbe 0x41f790
mov ecx, dword [esi]
mov ebx, dword [esp + 0x18]
sub ecx, eax
shl ecx, 2
lea eax, [esi + edx*4]
push ecx
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.00468820
mov eax, dword [esi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test eax, eax
je 0x41f7e6
mov ebx, edi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + ebx]
cmp ecx, dword [edx]
jne 0x41f7e6
sub edx, 4
sub eax, 1
jne 0x41f7d7
mov ebx, dword [esp + 0x18]
mov dword [ebx], eax
test eax, eax
je 0x41f809
sub edi, esi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + edi]
lea edx, [edx - 4]
xor ecx, dword [edx + 4]
mov dword [edx + ebx + 4], ecx
sub eax, 1
jne 0x41f7f7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x41fc60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5c
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
push ebx
mov ebx, dword [esp + 0x68]
push esi
mov esi, dword [esp + 0x68]
mov dword [esp + 0x10], esi
cmp dword [ebx], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
je 0x41fda0
mov ecx, dword [eax]
test ecx, ecx
je 0x41fda0
mov edx, dword [0x49d0e4]
mov esi, eax
mov eax, dword [esi + ecx*4]
mov eax, dword [edx + eax*4]
mov dword [esp + ecx*4 + 0x14], eax
sub ecx, 1
jne 0x41fca3
mov esi, dword [esp + 0x10]
push edi
push 0x90
push ecx
push esi
call fcn.00468da0
mov edi, dword [ebx]
add esp, 0xc
test edi, edi
je 0x41fd3a
mov ecx, dword [0x49d0e4]
push ebp
mov ebp, dword [0x49d0e0]
lea esp, [esp]
mov eax, dword [ebx + edi*4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0x7fff
je 0x41fd30
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x41fd30
lea edx, [eax - 1]
add edx, edi
lea edx, [esi + edx*4]
mov ecx, dword [esp + eax*4 + 0x1c]
cmp ecx, 0x7fff
je 0x41fd22
add ecx, ebx
cmp ecx, 0x7fff
jb 0x41fd1c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
sub edx, 4
sub eax, 1
jne 0x41fd00
mov ecx, dword [0x49d0e4]
mov ebx, dword [esp + 0x14]
sub edi, 1
jne 0x41fce0
pop ebp
mov eax, dword [esp + 0xc]
mov edx, dword [ebx]
pop edi
mov ecx, dword [eax]
dec ecx
add edx, ecx
mov dword [esi], edx
cmp edx, 0x11
jle 0x41fd6e
lea ecx, [esi - 0x38]
lea ecx, [ecx + edx*4]
add edx, 0xffffffef
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub edx, 1
jne 0x41fd56
cmp dword [esi], 0x11
jbe 0x41fda6
mov dword [esi], 0x11
mov eax, 0x11
mov edi, edi
cmp dword [esi + eax*4], 0
jne 0x41fda6
add eax, 0xffffffff
mov dword [esi], eax
jne 0x41fd80
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004669f1
add esp, 0x5c
ret 0xc
mov dword [esi], 0
mov ecx, dword [esp + 0x60]
pop esi
pop ebx
xor ecx, esp
call fcn.004669f1
add esp, 0x5c
ret 0xc
Function at 0x41fed0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx]
test ecx, ecx
je 0x41ffe1
mov eax, dword [ebx + ecx*4]
push ebp
mov ebp, dword [0x49d0e0]
push esi
mov esi, dword [0x49d0e4]
mov eax, dword [esi + eax*4]
cmp eax, 0x7fff
je 0x41ff19
lea esi, [eax*8]
add eax, eax
cmp eax, 0x7fff
jb 0x41ff14
add esi, 0xfffe0004
mov esi, dword [esi + ebp]
jmp 0x41ff1b
xor esi, esi
mov eax, 8
imul eax, ecx
mov dword [eax + edx - 4], esi
mov esi, dword [ebx]
sub esi, 1
je 0x41ff83
mov ecx, dword [0x49d0e4]
push edi
lea edi, [ebx + esi*4]
jmp 0x41ff40
mov dword [edx + esi*8], 0
mov eax, dword [edi]
mov eax, dword [ecx + eax*4]
cmp eax, 0x7fff
je 0x41ff74
lea ecx, [eax*8]
add eax, eax
cmp eax, 0x7fff
jb 0x41ff69
add ecx, 0xfffe0004
mov eax, dword [ecx + ebp]
mov ecx, dword [0x49d0e4]
jmp 0x41ff76
xor eax, eax
mov dword [edx + esi*8 - 4], eax
sub edi, 4
sub esi, 1
jne 0x41ff40
pop edi
mov eax, dword [ebx]
lea esi, [eax*2 - 1]
mov dword [edx], esi
cmp esi, 0x11
jle 0x41ffb8
lea eax, [edx - 0x38]
lea eax, [eax + esi*4]
add esi, 0xffffffef
lea esp, [esp]
mov ecx, dword [eax + 0x38]
lea eax, [eax - 4]
xor dword [eax - 8], ecx
xor dword [eax + 4], ecx
mov dword [eax + 0x3c], 0
sub esi, 1
jne 0x41ffa0
cmp dword [edx], 0x11
pop esi
pop ebp
jbe 0x41ffe7
mov dword [edx], 0x11
mov eax, 0x11
lea ebx, [ebx]
cmp dword [edx + eax*4], 0
jne 0x41ffe7
add eax, 0xffffffff
mov dword [edx], eax
jne 0x41ffd0
pop ebx
ret 8
mov dword [edx], 0
pop ebx
ret 8
Function at 0x4277f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ae60
mov eax, dword fs:[0]
push eax
mov eax, 0x503c
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3010]
push 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x4279d8
cmp eax, 0x800
jae 0x4279d8
push 0x800
lea eax, [ebp - 0x4010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4279d8
cmp eax, 0x800
jae 0x4279d8
lea eax, [ebp - 0x3010]
push eax
call fcn.0043cb30
mov ebx, eax
lea eax, [ebp - 0x4010]
push eax
call fcn.0043cb30
mov esi, eax
cmp word [esi], 0
je 0x4279d8
push esi
push ebx
call fcn.0045a3c0
test eax, eax
je 0x4279d8
push esi
push edi
call fcn.0043cb30
push eax
call fcn.0045a3c0
test eax, eax
jne 0x4279d8
mov word [ebp - 0x1010], ax
xor esi, esi
test ax, ax
jne 0x427931
push 0x800
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.00456ab0
push esi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.0043cb30
push eax
call fcn.00407ec0
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00429bd0
test al, al
je 0x427916
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x42791d
mov ax, word [ebp - 0x1010]
add esi, 0x7b
cmp esi, 0x2710
jl 0x4278c4
test ax, ax
je 0x4279d8
push 0x800
push edi
lea eax, [ebp - 0x2010]
push eax
call fcn.00456ab0
push 0x800
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.0043cc40
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4279d8
lea ecx, [ebp - 0x5048]
call fcn.00427a00
push edi
mov dword [ebp - 4], 0
xor bl, bl
call fcn.00429bd0
test al, al
jne 0x42799b
push 0x12
push edi
lea ecx, [ebp - 0x5048]
call fcn.00427e30
mov bl, al
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x4279c9
lea ecx, [ebp - 0x5048]
call fcn.00427c40
lea ecx, [ebp - 0x5048]
call fcn.00427f40
lea ecx, [ebp - 0x5048]
call fcn.00427a50
mov al, 1
jmp 0x4279da
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004669f1
mov esp, ebp
pop ebp
ret 4
Function at 0x427f80
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 1
jne 0x427f98
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 8], eax
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
mov ebp, dword [esp + 0x18]
push 0
push eax
push ebx
push ebp
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x428044
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x427ff0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x427fd3
cmp eax, 3
jne 0x427ff0
cmp ebx, 0x4e20
jbe 0x427ff0
push 0x4e20
push ebp
mov ecx, esi
call fcn.00427f80
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 1
jne 0x42800b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x42800b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 0
jne 0x428039
cmp ebx, 0x8000
jbe 0x428039
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x428039
push 0x8000
push ebp
mov ecx, esi
call fcn.00427f80
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x428160
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1020]
mov dword [esp + 0xc], ecx
cmp byte [esi + 0x30], 0
mov dword [esi + 0x1034], 0
jne 0x4281a8
test bl, 4
jne 0x4281a8
xor al, al
jmp 0x4281aa
mov al, 1
push edi
mov edi, ebx
shr edi, 1
not edi
and edi, 1
inc edi
shl edi, 0x1e
test bl, 1
je 0x4281c3
or edi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test al, al
je 0x4281d2
or ebx, 2
cmp byte [esi + 0x24], 0
je 0x4281de
or edi, 0x100
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x428245
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x18]
call fcn.0043bf70
test al, al
je 0x428252
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42824d
mov dword [esp + 0x14], eax
jmp 0x42824d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x428263
cmp dword [esp + 0x14], 2
jne 0x428263
mov dword [esi + 0x1034], 1
cmp byte [esi + 0x24], 0
pop edi
je 0x4282a2
cmp ebp, 0xffffffff
je 0x4282a2
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov byte [esi + 0x1c], 0
mov bl, 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
jmp 0x4282b9
cmp ebp, 0xffffffff
mov byte [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
setne bl
je 0x4282d2
push 0x800
push dword [esp + 0x10]
lea ecx, [esi + 0x32]
mov dword [esi + 8], ebp
push ecx
call fcn.00456ab0
mov byte [esi + 0x25], 0
mov ecx, dword [esp + 0x1018]
mov al, bl
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004669f1
add esp, 0x1010
ret 8
Function at 0x428c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x428c29
pop ebp
mov al, 1
pop ebx
add esp, 0x1c
ret 8
cmp dword [ebp + 0x10], 1
push esi
push edi
lea edi, [ebp + 8]
mov dword [esp + 0x18], edi
jne 0x428c44
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
jmp 0x428c50
mov dword [esp + 0x18], edi
jmp 0x428c50
cmp dword [ebp + 0x10], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x428caf
xor esi, esi
test ebx, ebx
je 0x428cd5
lea esp, [esp]
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x428c80
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
jne 0x428ccd
add esi, 0x4000
cmp esi, ebx
jb 0x428c70
jmp 0x428ccd
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
test cl, cl
jne 0x428ddb
cmp byte [ebp + 0x1e], 0
je 0x428ddb
cmp dword [ebp + 0x10], 0
jne 0x428ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x47d2b8]
mov ecx, ebp
call esi
mov dword [esp + 0x20], eax
lea eax, [ebp + 0x32]
push eax
mov dword [esp + 0x28], edx
call fcn.00429d20
push edi
mov dword [esp + 0x20], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x428d6d
ja 0x428d2f
cmp dword [esp + 0x1c], ebx
jbe 0x428d6d
mov esi, dword [esp + 0x20]
mov edx, esi
mov edi, dword [esp + 0x24]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x428d6d
jl 0x428d4a
cmp edx, 0xffffffff
ja 0x428d6d
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x28], ecx
js 0x428d6d
jg 0x428d5d
cmp eax, 0xffffffff
jbe 0x428d6d
lea esi, [ebp + 0x32]
mov ecx, 0x49d17c
push esi
call fcn.00421f30
jmp 0x428d70
lea esi, [ebp + 0x32]
push 0
push esi
mov ecx, 0x49d17c
call fcn.00420f60
test al, al
je 0x428dce
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp eax, ebx
jae 0x428c50
test eax, eax
je 0x428c50
mov edi, dword [ebp]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x47d2b8]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x18]
mov esi, dword [edi + 0x10]
mov ecx, esi
sbb edx, 0
push edx
push eax
call dword [0x47d2b8]
mov ecx, ebp
call esi
mov edi, dword [esp + 0x18]
jmp 0x428c50
push esi
push 0
mov ecx, 0x49d17c
call fcn.00421e50
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 0xc], 1
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x429550
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x4295a7
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0043bf70
test al, al
je 0x4295a7
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x4295a9
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4

Function at 0x4295d0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x429627
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0043bf70
test al, al
je 0x429627
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x429629
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4
Function at 0x429bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x429c23
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.0043bf70
test al, al
je 0x429c20
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop edi
pop esi
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4

Function at 0x429c40
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
cmp dword [ecx + 0x14], 0
jbe 0x429ca3
mov eax, 0x54
mov dword [ecx + 0x14], 0
mov word [esp + 0x10], ax
mov eax, dword [ecx]
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x429cb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x429d02
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.0043bf70
test al, al
je 0x429d00
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x429d02
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4

Function at 0x429d20
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.0043bbd0
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x429db1
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x429db1
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004669f1
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.004669f1
add esp, 0x101c
ret 4
Function at 0x429fb0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
lea ecx, [esp + 0x20c]
push 0x800
push ecx
push eax
call fcn.0043bc60
push 0x105
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x42a098
mov ecx, 0x47e064
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a03a
test dx, dx
je 0x42a036
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a03a
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a014
xor eax, eax
jmp 0x42a03f
sbb eax, eax
or eax, 1
test eax, eax
je 0x42a07f
mov ecx, str.FAT32
lea eax, [esp]
jmp 0x42a050
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a076
test dx, dx
je 0x42a072
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a076
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a050
xor eax, eax
jmp 0x42a07b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42a098
mov al, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004669f1
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor al, al
xor ecx, esp
call fcn.004669f1
add esp, 0x1210
ret 4

Function at 0x42a0d0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
lea ecx, [esp]
push 0x800
push ecx
push eax
call fcn.0043bc60
movzx eax, word [esp]
lea ecx, [esp]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x42a135
cmp eax, 5
je 0x42a135
xor al, al
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
mov al, 1
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 4
Function at 0x42a160
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00466a00
mov eax, dword [0x48d1f4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.0043cb00
movzx eax, word [eax]
cmp eax, 0x2e
je 0x42a1a0
cmp eax, 0x20
je 0x42a1a0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42a1f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42a226
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.0043bf70
test al, al
je 0x42a1d0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42a226
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.0043bf70
test al, al
je 0x42a226
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42a226
cmp byte [esp + 0x1010], 0
je 0x42a20c
push dword [esp + 0x1014]
push esi
call fcn.0042a870
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 2
je 0x42a254
xor eax, eax
cmp ecx, 3
pop esi
sete al
inc eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 0xc
mov ecx, dword [esp + 0x1004]
mov eax, 2
pop esi
xor ecx, esp
call fcn.004669f1
add esp, 0x1004
ret 0xc