joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407272
Capabilities:
Get disk information

Disassembly:
mov eax, 0x58916c
call fcn.00414dac
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x4072cf
push edi
call fcn.00413dd0
test eax, eax
pop ecx
je 0x4072cf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push edi
call fcn.0040859b
pop ecx
test eax, eax
pop ecx
jne 0x4072e2
cmp dword [0x5f3320], ebx
je 0x4072cf
push 0x5d5904
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
push 0x5d5900
lea ecx, [ebp + 8]
call fcn.00579c8c
mov al, byte [edi]
lea ecx, [ebp + 8]
push eax
push ebx
mov dword [ebp - 4], ebx
call fcn.0057a1d0
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [ebp - 0x118]
push eax
call fcn.004159a1
mov dword [esp], 0x103
lea eax, [ebp - 0x118]
push str.NTFS
push eax
call fcn.004158b2
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
je 0x40737e
cmp eax, 0x8000
jb 0x407370
mov ebx, 0x3c00
jmp 0x4073d2
cmp eax, 0x4000
jb 0x40737e
mov ebx, 0x1c00
jmp 0x4073d2
cmp eax, 0x2000
jb 0x40738c
mov ebx, 0xc00
jmp 0x4073d2
cmp eax, 0x1000
jb 0x40739a
mov ebx, 0x800
jmp 0x4073d2
cmp eax, 0x800
jb 0x4073a8
mov ebx, 0x400
jmp 0x4073d2
cmp dword [0x5f3320], ebx
je 0x4073c9
push str.CSDSafeDiskMgr::CalcDefaultSafeDiskSize___DiskFreeSize_too_small__1GB___r_n
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x10
push 1
mov ecx, esi
call fcn.00408a86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00579c1e
mov eax, ebx
jmp 0x4072d1

Function at 0x4073e5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x589180
call fcn.00414dac
push ecx
cmp dword [ecx], 0
push esi
jne 0x407491
lea esi, [ecx + 0x40]
push 0x104
push esi
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407461
push esi
lea ecx, [ebp - 0x10]
call fcn.00579c8c
and dword [ebp - 4], 0
push str.TSDMnt32.dll
lea ecx, [ebp - 0x10]
call fcn.00579ffa
push dword [ebp - 0x10]
call fcn.0040932e
pop ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.00579da7
push str.TSDFmt32.dll
lea ecx, [ebp - 0x10]
call fcn.00579ffa
push dword [ebp - 0x10]
call fcn.00408ee5
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00579c1e
call fcn.00409135
mov esi, eax
call fcn.0040990c
cmp dword [0x5f3320], 0
je 0x407491
push eax
push esi
push str.CSDSafeDiskMgr::Initialize___TSDInstall_Result:_d_d
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x18
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4074dc
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004073e5
mov ecx, esi
xor edi, edi
call fcn.004081c9
test eax, eax
je 0x407526
mov ecx, esi
call fcn.00407d05
test eax, eax
je 0x407526
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or al, 6
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.00407570
mov edi, eax
test edi, edi
je 0x407526
mov ecx, esi
call fcn.00407f51
mov eax, edi
pop edi
pop esi
ret

Function at 0x4082a7
Capabilities:
Get disk information

Disassembly:
mov eax, 0x589253
call fcn.00414dac
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 0x5efa58
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
call fcn.00426f50
cmp dword [esi + 4], ebx
push 1
pop edi
mov dword [ebp - 4], edi
jne 0x4082ea
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00426e60
mov dword [ebp - 0x18], edi
jmp 0x4083c4
push dword [esi + 0x38]
lea ecx, [ebp - 0x1c]
call fcn.00579c8c
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.00408928
pop ecx
pop ecx
push dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00427bc0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00579c1e
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00579c1e
mov eax, dword [0x5f3320]
mov edi, 0x5f2a8c
cmp eax, ebx
je 0x408355
push dword [esi + 0x38]
push dword [ebp - 0x10]
push str.CSDSafeDiskMgr::GetRealAccessPath_strPath:_S__Volume:_S_r_n
push str.safedisk
push 4
push edi
call fcn.00472c70
add esp, 0x18
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x4083b1
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4083b1
cmp dword [0x5f3320], ebx
je 0x40839d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi]
push str.CSDSafeDiskMgr::GetRealAccessPath_VolumeSN:_d__Gle__d__r_n
push str.safedisk
push 4
push edi
call fcn.00472c70
add esp, 0x18
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jl 0x408363
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00426e60
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00427900
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40862d
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x408645
xor eax, eax
jmp 0x4087a2
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
mov eax, dword [0x5d66d0]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
mov esi, 0x103
mov ecx, dword [ebp - 4]
push 1
pop eax
shl eax, cl
mov ecx, dword [ebp + 8]
test ecx, eax
je 0x408774
mov al, byte [ebp - 4]
lea edi, [ebp - 0x14]
add al, 0x41
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x20], al
xor eax, eax
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x408774
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jb 0x408774
ja 0x4086bf
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jbe 0x408774
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [ebp - 0x124]
push eax
call fcn.004159a1
push esi
lea eax, [ebp - 0x124]
push str.NTFS
push eax
call fcn.00415a7d
add esp, 0x10
test eax, eax
je 0x40872e
push esi
lea eax, [ebp - 0x124]
push str.FAT32
push eax
call fcn.00415a7d
add esp, 0xc
test eax, eax
jne 0x408774
push ebx
push 0x2000000
push 3
push ebx
push 3
lea eax, [ebp - 0x20]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40875a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x408774
jmp 0x408761
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jl 0x408669
cmp dword [ebp - 0x10], ebx
je 0x40879d
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x40879d
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
push 0x14
pop ecx
call fcn.00414e00
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4087a5
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x5892a7
call fcn.00414dac
sub esp, 0x60
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 0x5efa58
lea ecx, [ebp - 0x10]
call fcn.00426f50
mov eax, dword [0x5d6700]
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
stosd dword es:[edi], eax
mov esi, str._TSD_VOLUME_X:_
lea edi, [ebp - 0x6c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xf
lea edi, [ebp - 0x59]
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call esi
or edi, 0xffffffff
cmp eax, edi
jne 0x40881f
lea eax, [ebp - 0x6c]
push eax
call esi
cmp eax, edi
jne 0x40881f
push 0x5d65bc
lea ecx, [ebp - 0x10]
call fcn.00427bc0
jmp 0x40886b
mov bl, 0x5a
movsx eax, bl
push eax
lea eax, [ebp - 0x6c]
push str._TSD_VOLUME__c:_
push eax
mov byte [ebp - 0x1c], bl
call fcn.00415a2b
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40884d
lea eax, [ebp - 0x6c]
push eax
call esi
cmp eax, edi
je 0x408856
dec bl
cmp bl, 0x41
jg 0x408821
jmp 0x40886b
movsx eax, bl
push eax
lea eax, [ebp - 0x10]
push 0x5d66d4
push eax
call fcn.0042aa90
add esp, 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00426e60
mov dword [ebp - 0x14], 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00427900
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4089d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, ecx
call fcn.00407e07
test eax, eax
je 0x408a7c
xor ebx, ebx
cmp dword [esi + 0x30], ebx
je 0x408a7c
mov edx, dword [esi + 0x38]
cmp dword [edx - 8], ebx
je 0x408a7c
push edi
push 0x13
pop ecx
xor eax, eax
lea edi, [ebp - 0x53]
mov byte [ebp - 0x54], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], ebx
stosb byte es:[edi], al
movsx eax, byte [edx]
push eax
lea eax, [ebp - 0x54]
push str.__tsd_volume__c:_
push eax
call fcn.00415a2b
add esp, 0xc
lea eax, [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [0x5f3320], ebx
pop edi
je 0x408a6c
push eax
lea eax, [ebp - 0x54]
push dword [esi + 0x30]
push dword [ebp - 4]
push eax
push 0x5d6704
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x20
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x30]
jne 0x408a7c
push 1
pop eax
mov dword [esi + 4], eax
jmp 0x408a7e
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x408d7e
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x58937c
call fcn.00414dac
sub esp, 0x20
push esi
push edi
push str.SeDebugPrivilege
lea ecx, [ebp - 0x10]
call fcn.0042c8f0
push dword [eax]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00408e89
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0042d270
lea ecx, [ebp - 0x2c]
call fcn.0057845b
push 0xfffffffffffffffe
lea eax, [ebp - 0x2c]
push str.csrss.exe
push eax
mov dword [ebp - 4], 1
call fcn.00493f90
mov eax, dword [ebp - 0x24]
shl eax, 2
push eax
call fcn.00415cc7
mov esi, eax
add esp, 0x10
cmp esi, edi
je 0x408e6f
cmp dword [ebp - 0x24], edi
push ebx
mov ebx, 0x5f2a8c
jle 0x408e24
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + edi*4]
mov dword [esi + edi*4], eax
cmp dword [0x5f3320], 0
je 0x408e1e
push eax
push str.WhiteList_ID:__d__n
push str.safedisk
push 8
push ebx
call fcn.00472c70
add esp, 0x14
inc edi
cmp edi, dword [ebp - 0x24]
jl 0x408df6
lea ecx, [ebp - 0x18]
call fcn.0040c1f5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push esi
call fcn.0040d003
cmp dword [0x5f3320], 0
je 0x408e5b
push eax
push 0x5d6830
push str.safedisk
push 8
push ebx
call fcn.00472c70
add esp, 0x14
push esi
call fcn.00415bde
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040c21e
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0057848e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x408f09
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
xor edi, edi
cmp dword [0x5efc78], edi
jne 0x4090de
push 1
pop ebx
push dword [esp + 0xc]
mov dword [0x5efc78], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x5efc80], eax
je 0x4090de
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallDriver
push eax
call esi
push str.UninstallDriver
mov dword [0x5efc84], eax
push dword [0x5efc80]
call esi
push str.FmttoVolume
mov dword [0x5efc88], eax
push dword [0x5efc80]
call esi
push str.TSDInstall
mov dword [0x5efc8c], eax
push dword [0x5efc80]
call esi
push str.TSDUninstall
mov dword [0x5efc90], eax
push dword [0x5efc80]
call esi
push str.TSDGetLastError
mov dword [0x5efc94], eax
push dword [0x5efc80]
call esi
push str.TSDSetLastError
mov dword [0x5efc98], eax
push dword [0x5efc80]
call esi
push str.TSDFormat
mov dword [0x5efc9c], eax
push dword [0x5efc80]
call esi
push str.TSDFormatW
mov dword [0x5efca0], eax
push dword [0x5efc80]
call esi
push str.TSDIsSupport
mov dword [0x5efca4], eax
push dword [0x5efc80]
call esi
push str.TSDFormatEx
mov dword [0x5efca8], eax
push dword [0x5efc80]
call esi
push str.TSDFormatExW
mov dword [0x5efcac], eax
push dword [0x5efc80]
call esi
push str.TSDExpandVolume
mov dword [0x5efcb0], eax
push dword [0x5efc80]
call esi
push str.TSDExpandVolumeW
mov dword [0x5efcb4], eax
push dword [0x5efc80]
call esi
push str.TSDGetDeviceCryptoInfo
mov dword [0x5efcb8], eax
push dword [0x5efc80]
call esi
push str.TSDGetDeviceCryptoInfoW
mov dword [0x5efcbc], eax
push dword [0x5efc80]
call esi
cmp dword [0x5efc84], edi
mov dword [0x5efcc0], eax
pop esi
je 0x4090de
cmp dword [0x5efc88], edi
je 0x4090de
cmp dword [0x5efc8c], edi
je 0x4090de
cmp dword [0x5efc90], edi
je 0x4090de
cmp dword [0x5efc94], edi
je 0x4090de
cmp dword [0x5efc98], edi
je 0x4090de
cmp dword [0x5efc9c], edi
je 0x4090de
cmp dword [0x5efca0], edi
je 0x4090de
cmp dword [0x5efca4], edi
je 0x4090de
cmp dword [0x5efca8], edi
je 0x4090de
cmp dword [0x5efcac], edi
je 0x4090de
cmp dword [0x5efcb0], edi
je 0x4090de
cmp dword [0x5efcb4], edi
je 0x4090de
cmp dword [0x5efcb8], edi
je 0x4090de
cmp dword [0x5efcbc], edi
je 0x4090de
cmp eax, edi
je 0x4090de
mov dword [0x5efc7c], ebx
mov eax, dword [0x5efc7c]
pop edi
pop ebx
ret
Function at 0x409787
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov ecx, dword [ebp + 8]
push esi
test ecx, ecx
je 0x40980b
push edi
mov esi, 0x5d6bf8
lea edi, [ebp - 8]
xor eax, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 5]
and byte [ebp - 0x408], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [ecx]
mov ecx, 0xff
and al, 0xdf
lea edi, [ebp - 0x407]
mov byte [ebp - 8], al
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x400
lea eax, [ebp - 0x408]
push esi
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
pop edi
jbe 0x40980b
cmp eax, esi
jae 0x40980b
push 0x17
lea eax, [ebp - 0x408]
push str.DeviceTSafeDiskVolume
push eax
call fcn.004153b3
add esp, 0xc
test eax, eax
jne 0x40980b
push 1
pop eax
jmp 0x40980d
xor eax, eax
pop esi
leave
ret

Function at 0x40a8db
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x5893d8
call fcn.00414dac
sub esp, 0xc
mov eax, dword [0x59f144]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
push str.OutSendSetting.dat
push str.__OeaSDPolicy
push dword [ecx + 4]
lea eax, [ebp - 0x10]
xor esi, esi
push 0x5d700c
push eax
mov dword [ebp - 4], esi
call fcn.00430280
add esp, 0x14
mov dword [ebp - 0x18], esi
push esi
push 0x2000000
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a984
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a9bf
cmp edi, esi
je 0x40a9bf
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edi
call fcn.004611d0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
push edi
mov dword [ebp - 0x14], esi
call fcn.00461900
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a9aa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 1
jmp 0x40a9eb
cmp dword [0x5f3320], esi
je 0x40a9eb
push dword [ebp - 0x10]
push str.GetOeaSecProp_fail_to_open_file__s_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x14
jmp 0x40a9eb
cmp dword [0x5f3320], esi
je 0x40a9e4
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.GetOeaSecProp_fail_to_ReadFile__file__s__dwRead__lu_
jmp 0x40a9d0
cmp dword [0x5f3320], esi
je 0x40a9e4
push edi
push dword [ebp - 0x10]
push str.GetOeaSecProp_fail_to_get_size__file__s__dwFileSize__lu_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042d270
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40aa0b
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x5893f4
call fcn.00414dac
sub esp, 0x14
mov eax, dword [0x59f144]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
push str.OutSendSettingEX.xml
push str.__OeaSDPolicy
push dword [ecx + 4]
lea eax, [ebp - 0x10]
xor ebx, ebx
push 0x5d700c
push eax
mov dword [ebp - 4], ebx
call fcn.00430280
add esp, 0x14
mov dword [ebp - 0x20], ebx
push ebx
push 0x2000000
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x14], edi
je 0x40ab05
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ab92
cmp esi, ebx
je 0x40ab92
push esi
call fcn.0057985d
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40ab32
push esi
push ebx
push edi
call fcn.00413c50
add esp, 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push ebx
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ab59
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
shr esi, 1
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.0042cd00
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0042d420
push edi
call fcn.00579886
pop ecx
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0042d270
jmp 0x40abbe
cmp dword [0x5f3320], ebx
je 0x40abbe
push dword [ebp - 0x10]
push str.GetOeaSettingEx_fail_to_open_file__s_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x14
jmp 0x40abbe
cmp dword [0x5f3320], ebx
je 0x40ab54
push esi
push str.GetOeaSettingEx_fail_to_new_memory__dwFileSize__lu_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x14
push dword [ebp - 0x14]
jmp 0x40abb8
cmp dword [0x5f3320], ebx
je 0x40ab80
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push str.GetOeaSettingEx_fail_to_ReadFile__file__s__dwRead__lu_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x18
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00579886
pop ecx
jmp 0x40abbe
cmp dword [0x5f3320], ebx
je 0x40abb7
push esi
push dword [ebp - 0x10]
push str.GetOeaSettingEx_fail_to_get_size__file__s__dwFileSize__lu_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042d270
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40bc42
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x5895c0
call fcn.00414dac
sub esp, 0x20c
mov eax, dword [0x59f144]
push esi
push edi
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x5d79a0
push str.__OeaSDPolicy
lea eax, [ebp - 0x10]
push dword [ecx + 4]
push 0x5d700c
push eax
call fcn.00430280
and word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
add esp, 0x14
stosw word es:[edi], ax
push dword [ebp - 0x10]
lea eax, [ebp - 0x218]
push 0x103
push eax
push 0x5d799c
push str.OpenTimes
push str.oedx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [ebp + 8]
mov esi, eax
test esi, esi
je 0x40bcd9
push edi
lea eax, [ebp - 0x218]
push 0x5d78ac
push eax
call fcn.00415e01
add esp, 0xc
mov eax, dword [0x5f3320]
test eax, eax
je 0x40bd08
push dword [ebp - 0x10]
lea eax, [ebp - 0x218]
push dword [edi]
push eax
push esi
push str.GetOpenTimes_bRet__d__Var__s__Times__lu__ini__s_
push str.OutSendOead
push 0xffffffffffffffff
push 0x5f2a8c
call fcn.00472c70
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042d270
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40c0d1
Capabilities:
Delete file

Disassembly:
mov eax, 0x5896a4
call fcn.00414dac
sub esp, 0xc
mov eax, dword [0x59f144]
push esi
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push str.Local_SettingsTempOEATemp
push eax
call fcn.0046a5b0
pop ecx
pop ecx
push dword [eax]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042c8f0
push dword [eax]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push str._sIsRunning
push eax
call fcn.00430280
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042d270
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00579c1e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40c155
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x40c155
push 1
pop esi
jmp 0x40c157
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042d270
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret