joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4414b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x464e1d], 0xc
je 0x4414d4
cmp byte [eax + 1], 0x3a
jne 0x4414d4
mov dword [ebp - 4], eax
jmp 0x4414f3
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0x104
push eax
call sub.KERNEL32.dll_GetFullPathNameA
lea eax, [ebp - 0x118]
mov dword [ebp - 4], eax
push 3
mov ecx, dword [ebp - 4]
push ecx
lea eax, [ebp - 8]
push eax
call fcn.00453048
add esp, 0xc
lea edx, [ebp - 0x21c]
mov byte [ebp - 5], 0
push 0x104
push edx
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x10]
push ecx
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x118]
push edx
push 0x104
push ecx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
push 3
push 0x46211c
lea edx, [ebp - 0x21c]
push edx
call fcn.00458bd8
pop ecx
push eax
call fcn.00452f54
add esp, 0xc
test eax, eax
je 0x44158f
push 4
push 0x462120
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00452f54
add esp, 0xc
test eax, eax
je 0x44158f
push 4
push 0x462125
lea eax, [ebp - 0x21c]
push eax
call fcn.00452f54
add esp, 0xc
test eax, eax
je 0x44158f
xor eax, eax
jmp 0x441594
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4416b8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
cmp dword [0x475820], 0
je 0x4416d8
mov eax, dword [0x481fc4]
push eax
call fcn.004559e4
pop ecx
jmp 0x4417ee
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 8]
push eax
call fcn.0044159c
mov esi, eax
mov eax, dword [0x481fc4]
push eax
call fcn.004559e4
pop ecx
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x481fdc
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
mov eax, dword [0x475ec4]
mov ebx, dword [eax + 0x10]
cmp dword [0x462aec], 0
je 0x44172c
and ebx, 0xffffffdf
test bl, 0x5f
jne 0x44173a
cmp dword [0x462aec], 0
je 0x44174a
mov eax, ebx
and eax, 0x7f
push eax
push 0x481fdc
call sub.KERNEL32.dll_SetFileAttributesA
mov eax, dword [0x481f04]
test eax, eax
je 0x441769
movzx edx, word [0x481f36]
push edx
push eax
push 0x481fdc
call fcn.004412cc
cmp eax, 0x4f
cmp edi, 0xffffffff
jne 0x441794
push 0x481fdc
push 0x1f5
call fcn.00408028
push eax
mov ecx, dword [0x481ef0]
push ecx
call fcn.00408c78
add esp, 0xc
call fcn.00408e44
jmp 0x4417ee
test esi, esi
je 0x4417d1
test esi, 1
je 0x4417a4
mov eax, esp
jmp 0x4417a6
xor eax, eax
test esi, 2
je 0x4417b4
lea edx, [esp + 8]
jmp 0x4417b6
xor edx, edx
test esi, 4
je 0x4417c4
lea ecx, [esp + 0x10]
jmp 0x4417c6
xor ecx, ecx
mov esi, ecx
push eax
push edx
push esi
push edi
call sub.KERNEL32.dll_SetFileTime
push edi
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x462aec], 0
je 0x4417ee
and ebx, 0x7f
push ebx
push 0x481fdc
call sub.KERNEL32.dll_SetFileAttributesA
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4417f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
lea edx, [ebp - 4]
add al, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0
push edx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
sete al
and eax, 1
pop ecx
pop ebp
ret 4

Function at 0x4488a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov edx, dword [0x4820e8]
mov ecx, edx
mov eax, dword [ebp + 8]
xor ecx, eax
mov ebx, dword [0x481ec8]
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x4820e8], ecx
and ecx, 0xff
add dword [0x4820ec], ecx
imul edx, dword [0x4820ec], 0x8088405
inc edx
mov dword [0x4820ec], edx
shr edx, 0x18
mov ecx, dword [0x4820f0]
xor edx, ecx
mov ebx, dword [0x481ec8]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x4820f0], edx
pop ebx
pop ebp
ret 4

Function at 0x448b9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044891c
push 0xc
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00452dbc
add esp, 0xc
xor ebx, ebx
lea esi, [ebp - 0xc]
call fcn.00448884
xor byte [esi], al
mov al, byte [esi]
xor edx, edx
mov dl, al
push edx
call fcn.004488a8
inc ebx
inc esi
cmp ebx, 0xc
jl 0x448bc4
mov edx, dword [0x475ec4]
xor eax, eax
mov al, byte [ebp - 1]
test byte [edx + 0x14], 2
je 0x448bfb
movzx ecx, word [0x481f22]
sar ecx, 8
jmp 0x448c07
mov ecx, dword [0x481f28]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x448c13
or eax, 0xffffffff
jmp 0x448c56
mov edx, dword [0x481ed8]
cmp edx, dword [0x4758a0]
jle 0x448c29
mov ebx, dword [0x4758a0]
jmp 0x448c2f
mov ebx, dword [0x481ed8]
mov esi, dword [0x481ed4]
jmp 0x448c4b
call fcn.00448884
xor byte [esi], al
mov al, byte [esi]
xor edx, edx
mov dl, al
push edx
call fcn.004488a8
inc esi
mov ecx, ebx
add ebx, 0xffffffff
test ecx, ecx
jne 0x448c37
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448c68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x448c82
xor eax, eax
jmp 0x448d7a
call fcn.00448c60
xor ebx, 0xffffffff
cmp edi, 8
jb 0x448d57
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x448c93
test edi, edi
je 0x448d75
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x448d5b
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x44964c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov eax, 0x482278
mov ebp, esp
push ebx
push esi
mov esi, dword [0x4cdaa8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov ebx, ecx
xor ebx, edx
and ebx, 0xff
shr ecx, 8
mov ebx, dword [esi + ebx*4]
xor ebx, ecx
mov dword [eax], ebx
and ebx, 0xff
add dword [eax + 4], ebx
imul ecx, dword [eax + 4], 0x8088405
inc ecx
mov dword [eax + 4], ecx
shr ecx, 0x18
mov ebx, dword [eax + 8]
xor ecx, ebx
mov esi, dword [0x4cdaa8]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov dword [eax + 8], ecx
mov eax, edx
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4496f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
inc dword [0x462a00]
mov eax, dword [0x462a00]
cmp eax, 1
push ebx
push esi
push edi
jne 0x449721
push 0
call fcn.0045c434
pop ecx
mov ebx, eax
call fcn.0045a56c
xor ebx, eax
push ebx
call fcn.00458e40
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004496b0
xor esi, esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
call fcn.00458e5c
mov edi, eax
sar edi, 7
and edi, 0xff
call fcn.00449628
mov ebx, eax
push edi
call fcn.0044964c
mov edx, dword [ebp - 0x10]
mov eax, edi
xor bl, al
inc esi
mov byte [edx], bl
inc dword [ebp - 0x10]
cmp esi, 0xa
jl 0x449732
mov ecx, dword [ebp + 8]
push ecx
call fcn.004496b0
xor esi, esi
lea edi, [ebp - 0xc]
call fcn.00449628
mov ebx, eax
xor eax, eax
mov al, byte [edi]
push eax
call fcn.0044964c
xor eax, eax
mov edx, dword [ebp + 0x10]
mov al, byte [edi]
xor eax, ebx
inc dword [edx + 8]
jns 0x449799
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
inc dword [ecx]
mov byte [edx], al
jmp 0x4497a6
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call fcn.00457abc
add esp, 8
inc esi
inc edi
cmp esi, 0xa
jl 0x44976f
call fcn.00449628
mov ebx, eax
mov esi, dword [ebp + 0xc]
shr esi, 0x10
mov eax, esi
and eax, 0xff
push eax
call fcn.0044964c
mov eax, esi
mov edx, dword [ebp + 0x10]
and eax, 0xff
xor eax, ebx
inc dword [edx + 8]
jns 0x4497e3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
inc dword [ecx]
mov byte [edx], al
jmp 0x4497f0
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call fcn.00457abc
add esp, 8
call fcn.00449628
mov ebx, eax
mov esi, dword [ebp + 0xc]
shr esi, 0x18
mov eax, esi
and eax, 0xff
push eax
call fcn.0044964c
mov eax, esi
mov edx, dword [ebp + 0x10]
and eax, 0xff
xor eax, ebx
inc dword [edx + 8]
jns 0x449826
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
inc dword [ecx]
mov byte [edx], al
jmp 0x449833
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call fcn.00457abc
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44983c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x462ac0], 0
je 0x449876
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
test esi, esi
je 0x449876
call fcn.00449628
mov edi, eax
xor eax, eax
mov al, byte [ebx]
push eax
call fcn.0044964c
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x449859
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004562d0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x449898
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x4b2290
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp ebx, 1
jl 0x4498b3
cmp ebx, 9
jle 0x4498bd
push 0x462a54
call fcn.0044d93c
xor eax, eax
mov dword [0x4b228c], eax
cmp dword [0x4b2284], 0
jne 0x4498e1
mov dword [0x4b228c], 1
mov dword [0x4b2284], 0x10000
mov word [0x4b2282], 0
push 0xfffe
push 0
push 0x4a2284
call fcn.00452e2c
movzx edx, word [ebx*8 + 0x462a06]
mov dword [0x4b22ac], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x462a04]
mov dword [0x4b22b0], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x462a08]
mov dword [0x4b22b4], eax
movzx edx, word [ebx*8 + 0x462a0a]
mov dword [0x4b22a8], edx
jg 0x449940
or word [edi], 4
jmp 0x449949
cmp ebx, 8
jl 0x449949
or word [edi], 2
xor ecx, ecx
xor eax, eax
mov ebx, 0x8000
mov dword [0x4b2298], ecx
add ebx, ebx
mov dword [0x4b2288], eax
push ebx
push 0x482284
call dword [0x462e14]
mov dword [0x4b22a4], eax
mov eax, dword [0x4b22a4]
test eax, eax
je 0x44997e
cmp eax, 0xffffffff
jne 0x449992
mov dword [0x4b22a0], 1
xor edx, edx
mov dword [0x4b22a4], edx
jmp 0x4499d0
xor ecx, ecx
mov dword [0x4b22a0], ecx
cmp dword [0x4b22a4], 0x106
jae 0x4499ab
call fcn.00449b24
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov eax, 0x482284
mov edx, dword [esi]
xor ecx, ecx
shl edx, 5
mov cl, byte [eax]
xor edx, ecx
inc eax
and edx, 0x7fff
inc ebx
cmp ebx, 2
mov dword [esi], edx
jb 0x4499b6
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x449c44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4b2298
mov edi, 0x4b2290
xor ebx, ebx
mov dword [0x4b2294], 2
jmp 0x449dbd
mov eax, dword [esi]
mov edx, dword [edi]
shl edx, 5
xor ecx, ecx
mov cl, byte [eax + 0x482286]
and eax, 0x7fff
xor edx, ecx
and edx, 0x7fff
mov dword [edi], edx
mov edx, dword [edi]
movzx ebp, word [edx*2 + 0x4a2284]
mov word [eax*2 + 0x492284], bp
test ebp, ebp
mov dx, word [esi]
mov eax, dword [edi]
mov word [eax*2 + 0x4a2284], dx
je 0x449cc3
mov ecx, dword [esi]
sub ecx, ebp
cmp ecx, 0x7efa
ja 0x449cc3
push ebp
call fcn.004499dc
mov ebx, eax
mov eax, dword [0x4b22a4]
cmp ebx, eax
jbe 0x449cc3
mov ebx, eax
cmp ebx, 3
jb 0x449d5e
mov eax, ebx
sub eax, 3
push eax
mov edx, dword [esi]
sub edx, dword [0x4b229c]
push edx
call fcn.0044bb38
sub dword [0x4b22a4], ebx
cmp ebx, dword [0x4b22ac]
ja 0x449d37
dec ebx
inc dword [esi]
mov edx, dword [esi]
mov ecx, dword [edi]
shl ecx, 5
movzx edx, byte [edx + 0x482286]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [edi]
mov edx, dword [esi]
and edx, 0x7fff
dec ebx
movzx ebp, word [ecx*2 + 0x4a2284]
mov word [edx*2 + 0x492284], bp
mov dx, word [esi]
mov ecx, dword [edi]
mov word [ecx*2 + 0x4a2284], dx
jne 0x449cef
inc dword [esi]
jmp 0x449d78
add dword [esi], ebx
xor ebx, ebx
mov edx, dword [esi]
movzx edx, byte [edx + 0x482284]
mov dword [edi], edx
shl edx, 5
mov ecx, dword [esi]
movzx ecx, byte [ecx + 0x482285]
xor edx, ecx
and edx, 0x7fff
mov dword [edi], edx
jmp 0x449d78
mov eax, dword [esi]
xor edx, edx
mov dl, byte [eax + 0x482284]
push edx
push 0
call fcn.0044bb38
dec dword [0x4b22a4]
inc dword [esi]
test eax, eax
je 0x449dac
push 0
mov eax, dword [esi]
sub eax, dword [0x4b2288]
cmp dword [0x4b2288], 0
push eax
jl 0x449d9d
mov edx, 0x482284
add edx, dword [0x4b2288]
jmp 0x449d9f
xor edx, edx
push edx
call fcn.0044b95c
mov eax, dword [esi]
mov dword [0x4b2288], eax
cmp dword [0x4b22a4], 0x106
jae 0x449dbd
call fcn.00449b24
cmp dword [0x4b22a4], 0
jne 0x449c63
push 1
mov ecx, dword [esi]
sub ecx, dword [0x4b2288]
cmp dword [0x4b2288], 0
push ecx
jl 0x449deb
mov eax, 0x482284
add eax, dword [0x4b2288]
jmp 0x449ded
xor eax, eax
push eax
call fcn.0044b95c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44a9a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov al, byte [esi]
push eax
call fcn.00458c24
pop ecx
mov dword [ebp - 4], eax
xor edx, edx
mov dl, byte [ebx]
push edx
call fcn.00458c24
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x138]
push ecx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
xor eax, eax
mov al, byte [ebp - 0x138]
push eax
call fcn.00458c24
cmp byte [ebp - 0x138], 0x5c
pop ecx
je 0x44aa22
cmp byte [esi], 0x5c
je 0x44aa22
cmp byte [ebx], 0x5c
je 0x44aa22
cmp byte [esi + 1], 0x3a
je 0x44aa0c
mov dword [ebp - 4], eax
cmp byte [ebx + 1], 0x3a
je 0x44aa15
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
je 0x44aa22
mov edi, 1
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.004585e0
add esp, 8
test eax, eax
sete al
and eax, 1
test eax, eax
je 0x44aa5e
cmp word [ebp - 0x2e], 1
jle 0x44aa49
mov edi, 1
jmp 0x44aa5e
push ebx
call fcn.00455944
pop ecx
test eax, eax
je 0x44aa5e
mov eax, 0xf
jmp 0x44ab55
test edi, edi
jne 0x44aa93
push ebx
push esi
call fcn.004585a4
add esp, 8
test eax, eax
je 0x44aa93
mov edi, 1
call fcn.0045a0a8
cmp dword [eax], 0x16
je 0x44aa93
call fcn.0045a0a8
cmp dword [eax], 0x11
je 0x44aa93
mov eax, 0xf
jmp 0x44ab55
test edi, edi
je 0x44ab53
push 0x462a61
push esi
call fcn.00455e68
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x44aad7
push esi
push 0x1f5
call fcn.00408028
push eax
mov edx, dword [0x4b2734]
push edx
call fcn.00408c78
add esp, 0xc
call fcn.00408e44
mov eax, 0xa
jmp 0x44ab55
push 0x462a64
push ebx
call fcn.00455e68
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x44aafd
mov edx, dword [ebp - 0xc]
push edx
call fcn.004559e4
pop ecx
mov eax, 0xf
jmp 0x44ab55
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044ac44
mov edi, eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004559e4
pop ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004559e4
pop ecx
test eax, eax
jne 0x44ab2a
test edi, edi
je 0x44ab4c
push ebx
call fcn.00455944
pop ecx
test edi, edi
je 0x44ab45
cmp edi, 0xa
jne 0x44ab41
mov eax, 0xe
jmp 0x44ab55
mov eax, edi
jmp 0x44ab55
mov eax, 0xe
jmp 0x44ab55
push esi
call fcn.00455944
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44c35c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x80
mov esi, 0x80
push 3
push edi
lea eax, [ebp - 4]
push eax
call fcn.00453048
add esp, 0xc
xor edx, edx
mov dl, byte [ebp - 4]
test byte [edx + 0x464e1d], 0xc
je 0x44c3b5
cmp byte [ebp - 3], 0x3a
jne 0x44c3b5
xor ecx, ecx
mov cl, byte [edi]
and ecx, 0xff
mov al, byte [ecx + 0x4cd874]
mov byte [ebp - 4], al
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
jmp 0x44c3bd
mov byte [ebp - 4], 0x5c
mov byte [ebp - 3], 0
push esi
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
push ebx
lea ecx, [ebp - 0x90]
push ecx
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
jne 0x44c3ea
xor eax, eax
jmp 0x44c3f4
cmp dword [ebp - 0xc], 0xc
setbe al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44c400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x44c418
mov eax, 0x20
jmp 0x44c45c
mov edx, 1
test al, 1
jne 0x44c422
dec edx
mov ecx, 2
test al, 2
jne 0x44c42e
add ecx, 0xfffffffe
or edx, ecx
mov ecx, 4
test al, 4
jne 0x44c43c
add ecx, 0xfffffffc
or edx, ecx
mov ecx, 0x10
test al, 0x10
jne 0x44c44a
add ecx, 0xfffffff0
or edx, ecx
mov ecx, 0x20
test al, 0x20
jne 0x44c458
add ecx, 0xffffffe0
or edx, ecx
mov eax, edx
pop ebp
ret 4

Function at 0x44c610
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x28
push 0
push 0
push 0
push 1
push 1
push 0x7bc
call fcn.0044a8dc
mov edi, eax
mov dword [esi], edi
push edi
call fcn.0044a868
mov edx, dword [ebp + 0x14]
lea edi, [ebp - 4]
mov esi, 0x462cd8
lea ecx, [ebp - 8]
mov dword [edx], eax
mov eax, edi
movsd dword es:[edi], dword [esi]
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0xc]
push 0
push edx
push ecx
push 0
push 0xd
push 0x4cda74
test ebx, ebx
je 0x44c677
lea eax, [ebp - 4]
jmp 0x44c679
xor eax, eax
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x44c68a
mov eax, 0x4cda74
jmp 0x44c68c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x457f40
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x457f5c
call fcn.004584dc
jmp 0x457fcb
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x457f78
call fcn.004584dc
jmp 0x457fcb
cmp dword [0x4ce0e0], 2
je 0x457fc9
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00458c24
pop ecx
cmp al, 0x41
jl 0x457fc9
cmp al, 0x5a
jg 0x457fc9
cmp byte [ebp - 0x107], 0x3a
jne 0x457fc9
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x457fc9
call fcn.004584dc
jmp 0x457fcb
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x457fd0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x457fec
call fcn.004584dc
jmp 0x45800d
test byte [ebp + 0xc], 0x80
jne 0x457ff7
or ebx, 1
jmp 0x457ffa
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.dll_SetFileAttributesA
dec eax
je 0x45800b
call fcn.004584dc
jmp 0x45800d
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4584f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
dec eax
je 0x45851e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x458517
push 5
call fcn.00458470
pop ecx
pop ebp
ret
call fcn.004584dc
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4585e0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x22
push 0
push ebx
call fcn.00452e2c
add esp, 0xc
mov word [ebx + 6], 1
lea eax, [ebp - 0x144]
push eax
push edi
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4586ed
push 0x464e18
push edi
call fcn.004530f8
add esp, 8
test eax, eax
je 0x45868f
push 0
push edi
push 0
call fcn.00458014
add esp, 0xc
mov esi, eax
test eax, eax
je 0x45868f
push esi
call fcn.00452eec
pop ecx
cmp eax, 3
jne 0x45868f
push esi
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jae 0x458666
call fcn.004584dc
jmp 0x45877a
mov word [ebx + 4], 0x4000
movsx edx, byte [esi]
push edx
call fcn.00458c24
add ax, 0xffc0
pop ecx
mov word [ebx + 0x10], ax
mov word [ebx], ax
push esi
call fcn.004596ec
pop ecx
xor eax, eax
jmp 0x45877a
test esi, esi
je 0x45869a
push esi
call fcn.004596ec
pop ecx
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edi
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4586c1
call fcn.004584dc
jmp 0x45877a
mov si, 0x1000
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_GetFileType
cmp eax, 3
je 0x4586d9
add esi, 0x1000
mov word [ebx + 4], si
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x45877a
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_FindClose
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x130]
push ecx
push eax
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x140]
push edx
push ecx
mov eax, dword [ebp - 0x144]
push eax
push ebx
call fcn.0045c3c8
add esp, 0x18
cmp byte [edi + 1], 0x3a
jne 0x45872c
mov al, byte [edi]
jmp 0x45874b
lea edx, [ebp - 0x248]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x458745
mov al, 0x41
jmp 0x45874b
mov al, byte [ebp - 0x248]
cmp al, 0x61
jl 0x45875f
cmp al, 0x7a
jg 0x45875f
movsx edx, al
add dx, 0xff9f
mov word [ebx], dx
jmp 0x458771
cmp al, 0x41
jl 0x458771
cmp al, 0x5a
jg 0x458771
movsx ecx, al
add cx, 0xffbf
mov word [ebx], cx
mov ax, word [ebx]
mov word [ebx + 0x10], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45884c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x458868
call fcn.004584dc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x458884
test bl, 1
je 0x458884
call fcn.0045a0a8
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret