joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x545e08
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0xec], 0
lea eax, [ebx + 0xec]
mov dword [esp + 0x10], eax
jne 0x4811ae
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0
mov byte [eax], 1
xor edi, edi
mov dword [esp + 0x58], edi
mov eax, ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call fcn.00433880
mov esi, eax
sub esi, 1
js 0x481109
lea eax, [esp + 0x2c]
push eax
mov eax, esi
mov ecx, ebx
call fcn.00433890
call fcn.004349e0
lea ecx, [esp + 0x3c]
push ecx
mov ecx, eax
lea eax, [esp + 0x18]
call fcn.004ce1b0
sub esi, 1
mov edx, dword [eax + 4]
mov edi, dword [eax]
mov ecx, dword [eax + 8]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
jns 0x4810c6
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
call fcn.004cdc90
lea esi, [esp + 0x2c]
mov ecx, ebx
call fcn.0040ef70
mov ecx, dword [esp + 0x40]
add edi, dword [eax]
add ecx, dword [eax + 4]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ecx
cmp edi, dword [ebx + 0x10]
jne 0x48114e
cmp ecx, dword [ebx + 0x14]
jne 0x48114e
mov eax, dword [esp + 0x44]
cmp eax, dword [ebx + 0x18]
jne 0x48114e
mov ecx, dword [esp + 0x48]
cmp ecx, dword [ebx + 0x1c]
je 0x4811a7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
test eax, eax
jne 0x48115e
test ecx, ecx
je 0x48119c
sub dword [ebx + 0x78], eax
sub dword [ebx + 0x7c], ecx
mov eax, ebx
call fcn.00433880
mov esi, eax
sub esi, 1
js 0x48119c
mov eax, esi
mov ecx, ebx
call fcn.00433890
mov edi, eax
test edi, edi
je 0x481197
lea edx, [edi + 0x10]
push edx
lea edx, [esp + 0x18]
lea eax, [esp + 0x30]
call fcn.004cdda0
call fcn.004330c0
sub esi, 1
jns 0x481172
lea eax, [esp + 0x3c]
mov edi, ebx
call fcn.004330c0
mov eax, dword [esp + 0x10]
mov byte [eax], 0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x490700
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push esi
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x49071f
cmp dword [eax + 8], 1
je 0x49085d
mov ecx, dword [eax + 0x10]
test eax, eax
jne 0x490723
jmp 0x490726
xor ecx, ecx
jmp 0x490719
mov eax, dword [eax + 0xc]
push ebx
push 2
push eax
push 0
push 0
lea eax, [esp + 0x1c]
push eax
mov edx, esi
call fcn.004901e0
mov eax, dword [esi]
test eax, eax
je 0x4907eb
cmp dword [eax + 8], 2
jne 0x4907eb
xor ebx, ebx
cmp dword [esp + 0x20], ebx
jle 0x490853
fld dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
fld qword [0x572f10]
push ebp
push edi
mov esi, dword [esp + 0x1c]
imul esi, ebx
add esi, dword [esp + 0x14]
xor edi, edi
test eax, eax
jle 0x4907cd
fld st(1)
fmul st(1)
call fcn.00537c70
mov ecx, 1
sub ecx, eax
mov eax, dword [esi]
mov edx, eax
mov ebp, eax
and edx, 0xff00ff
imul edx, ecx
shr ebp, 8
and ebp, 0xffff00ff
shr eax, 8
imul ebp, ecx
and eax, 0xff00ff
imul eax, ecx
shr edx, 8
xor edx, ebp
and edx, 0xff00ff
xor edx, eax
mov dword [esi], edx
mov eax, dword [esp + 0x24]
add esi, dword [esp + 0x20]
inc edi
cmp edi, eax
jl 0x49078b
inc ebx
cmp ebx, dword [esp + 0x28]
jl 0x49076a
pop edi
fstp st(1)
pop ebp
fstp st(0)
lea eax, [esp + 0xc]
call fcn.00490330
pop ebx
pop esi
add esp, 0x20
ret 4
xor esi, esi
cmp dword [esp + 0x20], esi
jle 0x490853
fld dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
imul ecx, esi
add ecx, dword [esp + 0xc]
xor edx, edx
test eax, eax
jle 0x49084a
movzx eax, byte [ecx]
mov dword [esp + 0x2c], eax
inc edx
fild dword [esp + 0x2c]
fnstcw word [esp + 0x2c]
movzx eax, word [esp + 0x2c]
fmul st(1)
or eax, 0xc00
mov dword [esp + 8], eax
fldcw word [esp + 8]
fistp dword [esp + 8]
mov al, byte [esp + 8]
mov byte [ecx], al
mov eax, dword [esp + 0x1c]
add ecx, dword [esp + 0x18]
fldcw word [esp + 0x2c]
cmp edx, eax
jl 0x49080c
inc esi
cmp esi, dword [esp + 0x20]
jl 0x4907fb
fstp st(0)
lea eax, [esp + 0xc]
call fcn.00490330
pop ebx
pop esi
add esp, 0x20
ret 4
Function at 0x498110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53d5d9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.juce::InputStream.0
call fcn.004d3de0
mov ecx, 1
lock xadd dword [eax], ecx
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.juce::GZIPDecompressorInputStream.0
mov dword [esi + 8], edi
mov byte [esi + 0xc], 1
mov byte [esp + 0x1c], 1
or eax, 0xffffffff
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov dword [esi + 0x1c], ebx
mov edx, dword [edi]
mov eax, dword [edx + 0x54]
mov ecx, edi
call eax
push 0x8000
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0051ef12
add esp, 4
mov dword [esi + 0x30], eax
call fcn.004d8120
mov ecx, 1
lock xadd dword [eax], ecx
push 0x44
mov byte [esp + 0x20], 2
call fcn.0051e4bd
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 3
cmp eax, ebx
je 0x4981d1
push ebx
mov edi, eax
call fcn.00498010
jmp 0x4981d3
xor eax, eax
mov dword [esi + 0x38], eax
call fcn.004d4600
mov edx, 1
lock xadd dword [eax], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x498220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53d589
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x2c]
mov dword [edi], vtable.juce::InputStream.0
call fcn.004d3de0
mov ecx, 1
lock xadd dword [eax], ecx
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [edi], vtable.juce::GZIPDecompressorInputStream.0
mov dword [edi + 8], esi
mov byte [edi + 0xc], bl
mov byte [esp + 0x24], 1
or eax, 0xffffffff
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [edi + 0x18], bl
mov byte [edi + 0x19], bl
mov dword [edi + 0x1c], ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
mov ecx, esi
call eax
push 0x8000
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
call fcn.0051ef12
add esp, 4
mov dword [edi + 0x30], eax
call fcn.004d8120
mov ecx, 1
lock xadd dword [eax], ecx
push 0x44
mov byte [esp + 0x28], 2
call fcn.0051e4bd
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
mov byte [esp + 0x24], 3
cmp ebp, ebx
je 0x49831b
push 0x38
lea esi, [ebp + 4]
push ebx
push esi
mov byte [ebp], 1
mov byte [ebp + 1], bl
mov byte [ebp + 2], 1
mov byte [ebp + 3], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
call fcn.00522130
add esp, 0xc
lea eax, [ebx + 0xf]
call fcn.004949b0
test eax, eax
sete al
cmp al, bl
mov byte [ebp + 3], al
sete al
mov byte [ebp + 2], al
mov byte [ebp], al
mov ebx, ebp
mov dword [edi + 0x38], ebx
call fcn.004d4600
mov edx, 1
lock xadd dword [eax], edx
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4ae630
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
mov bl, byte [ecx + 8]
push esi
mov esi, dword [esp + 0x20]
cmp bl, 3
je 0x4ae7cf
push ebp
mov ebp, dword [ecx]
push edi
mov dword [esp + 0x10], 0
test bl, 2
je 0x4ae686
movzx eax, byte [ecx + 9]
movzx esi, byte [edx]
mov edi, eax
sub edi, esi
movzx esi, byte [edx + 1]
mov dword [esp + 0x14], edi
mov edi, eax
sub edi, esi
movzx esi, byte [edx + 2]
sub eax, esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov edi, 3
jmp 0x4ae699
movzx eax, byte [edx + 3]
movzx edi, byte [ecx + 9]
sub edi, eax
mov dword [esp + 0x14], edi
mov edi, 1
test bl, 4
je 0x4ae6ad
movzx edx, byte [edx + 4]
movzx eax, byte [ecx + 9]
sub eax, edx
mov dword [esp + edi*4 + 0x14], eax
inc edi
xor edx, edx
xor eax, eax
cmp edi, edx
jle case.0x4ae6fb.3
lea esp, [esp]
cmp dword [esp + eax*4 + 0x14], edx
jg 0x4ae6cc
mov dword [esp + eax*4 + 0x14], edx
jmp 0x4ae6d4
mov dword [esp + 0x10], 1
inc eax
cmp eax, edi
jl 0x4ae6c0
cmp word [esp + 0x10], dx
je case.0x4ae6fb.3
movzx eax, byte [ecx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4ae6fb.3
movzx eax, byte [eax + 0x4ae7ec]
jmp dword [eax*4 + 0x4ae7d8]
mov ecx, dword [ecx + 4]
mov eax, esi
cmp ecx, edx
jbe case.0x4ae6fb.3
nop
mov dl, byte [eax]
shr dl, 1
and dl, 0x55
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4ae710
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
mov edi, dword [ecx + 4]
mov edx, dword [esp + 0x14]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x4ae6fb.3
lea ebx, [ebx]
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x4ae750
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4ae6fb.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x14]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x4ae772
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4ae6fb.3
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, pe_nt_image_headers32
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x14]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x4ae796
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4b9be0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x59f508]
test eax, eax
je 0x40f594
mov edx, dword [eax]
push ecx
mov ecx, eax
mov eax, dword [edx + 4]
call eax
ret
jmp 0x4b9be0
push 0xffffffffffffffff
push 0x53db88
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x5666fc
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
call fcn.0041ae00
lea edi, [esp + 0x10]
call fcn.0041b850
push eax
mov dword [esp + 0x18], 0
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
call fcn.0041add0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret

Function at 0x4b9c50
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x38
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 3
call esi
test eax, eax
mov al, byte [0x59f4fc]
setne cl
xor cl, al
and cl, 1
xor al, cl
push 6
mov byte [0x59f4fc], al
call esi
test eax, eax
mov al, byte [0x59f4fc]
setne dl
add dl, dl
xor dl, al
and dl, 2
xor al, dl
push 0xa
mov byte [0x59f4fc], al
call esi
test eax, eax
mov al, byte [0x59f4fc]
setne cl
add cl, cl
add cl, cl
xor cl, al
and cl, 4
xor al, cl
push 7
mov byte [0x59f4fc], al
call esi
test eax, eax
mov al, byte [0x59f4fc]
setne dl
add dl, dl
add dl, dl
add dl, dl
xor dl, al
and dl, 8
xor al, dl
mov byte [0x59f4fc], al
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
mov dword [0x59f4f8], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 8]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
fdivr qword [0x572d88]
lea esi, [esp + 4]
mov dword [0x59f500], eax
mov dword [0x59f504], ecx
fstp qword [0x59f4f0]
call fcn.0040f780
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call fcn.0041add0
pop esi
add esp, 0x38
ret

Function at 0x4b9fd0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push esi
push 0x4b9f90
push 0
push 0
call fcn.005207f4
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
add esp, 0x1c
ret

Function at 0x4ba020
Capabilities:
Terminate thread

Disassembly:
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4ba033
mov edx, dword [eax + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
Function at 0x4ba100
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x540738
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0x2f
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0
push eax
mov ecx, 0x5c
lea edx, [esp + 0x28]
mov dword [edi], 0
mov dword [edi + 4], 1
call fcn.0041c600
lea esi, [esp + 0x20]
call fcn.0041ae20
lea ecx, [esp + 0xc]
call fcn.0041add0
mov ecx, esi
push ecx
push str.Global_
lea esi, [esp + 0x14]
call fcn.0041b710
push eax
mov byte [esp + 0x1c], 1
call fcn.0041d8e0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
push 1
push 0
call ebp
mov ecx, esi
mov dword [edi], eax
mov byte [esp + 0x18], 0
call fcn.0041add0
cmp dword [edi], 0
jne 0x4ba1ce
lea edx, [esp + 0x20]
push edx
push str.Local_
lea esi, [esp + 0x14]
call fcn.0041b710
push eax
mov byte [esp + 0x1c], 2
call fcn.0041d8e0
push eax
push 1
push 0
call ebp
mov ecx, esi
mov dword [edi], eax
call fcn.0041add0
cmp dword [edi], 0
je 0x4ba222
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ba222
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4ba201
mov eax, dword [edi]
test eax, eax
je 0x4ba222
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
jmp 0x4ba222
jge 0x4ba206
or eax, 0xffffffff
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ba222
cmp eax, 0x80
je 0x4ba222
mov esi, edi
call fcn.004ba250
lea ecx, [esp + 0x20]
call fcn.0041add0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x10
ret 8

Function at 0x4ba560
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x53db88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push ecx
mov eax, esp
mov dword [esp + 0xc], esp
call fcn.0041ae00
lea eax, [esp + 0xc]
push eax
call fcn.004ba480
add esp, 8
push eax
mov dword [esp + 0x18], 0
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [esp + 8]
mov esi, eax
call fcn.0041add0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4ba5d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x541adb
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x598c90]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x41c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x42c]
push 0
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4ba654
lea eax, [esp + 0xc]
lea esi, [esp + 8]
call fcn.0041aed0
push eax
mov ecx, edi
mov dword [esp + 0x428], 0
call fcn.004178a0
mov ecx, esi
call fcn.0041add0
jmp 0x4ba660
mov ecx, 0x59f738
mov esi, edi
call fcn.004178d0
mov eax, edi
mov ecx, dword [esp + 0x41c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0051e437
add esp, 0x420
ret

Function at 0x4ba690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov eax, dword [esi]
mov dword [esp], eax
xor eax, eax
lea ecx, [esp]
call fcn.004031b0
lea eax, [esp]
call fcn.00403100
test eax, eax
je 0x4ba6c5
push esi
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ba6c5
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x4ba6d0
Capabilities:
Get file attributes

Disassembly:
push ecx
mov eax, dword [esi]
mov dword [esp], eax
xor eax, eax
lea ecx, [esp]
call fcn.004031b0
lea eax, [esp]
call fcn.00403100
test eax, eax
je 0x4ba704
push esi
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4ba704
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x4ba710
Capabilities:
Get file attributes

Disassembly:
push eax
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4ba72c
cmp eax, 0xffffffff
je 0x4ba72c
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4ba730
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, eax
call fcn.004ba690
test al, al
je 0x4ba750
push esi
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
not eax
and eax, 1
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x4baa40
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x541a9b
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.00533100
mov eax, dword [0x598c90]
xor eax, esp
mov dword [esp + 0x1020], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x1038]
mov dword fs:[0], eax
lea edx, [esp + 0x34]
mov edi, ecx
push edx
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], cx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea esi, [esp + 0x20]
lea ebx, [esp + 0x34]
call fcn.0041d9f0
mov dword [esp + 0x1040], 0
cmp word [esp + 0x34], 0
je 0x4baaf0
nop
mov eax, ebx
lea esi, [esp + 0x18]
call fcn.0041aed0
push eax
lea eax, [esp + 0x24]
call fcn.0041dba0
mov ecx, esi
call fcn.0041add0
lea esp, [esp]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4baae0
cmp word [ebx], ax
jne 0x4baac0
lea eax, [esp + 0x20]
call fcn.0041dd70
xor ebp, ebp
cmp dword [esp + 0x2c], ebp
jle 0x4babb4
mov eax, ebp
lea ecx, [esp + 0x20]
call fcn.0041db80
push eax
lea ecx, [esp + 0x1c]
call fcn.004178a0
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
inc ecx
cmp ecx, ebx
jle 0x4bab79
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 8]
and esi, 0xfffffff8
cmp ebx, esi
je 0x4bab79
mov eax, dword [edi]
test esi, esi
jle 0x4bab67
test eax, eax
jne 0x4bab52
lea ecx, [esi*8]
push ecx
call fcn.0051ef12
mov dword [edi], eax
jmp 0x4bab73
lea edx, [esi*8]
push edx
push eax
call fcn.0051f11a
add esp, 8
mov dword [edi], eax
jmp 0x4bab76
push eax
call fcn.0051ee35
mov dword [edi], 0
add esp, 4
mov dword [edi + 8], esi
mov eax, dword [edi + 0xc]
mov edx, dword [edi]
lea esi, [edx + eax*8]
lea ecx, [eax + 1]
mov dword [edi + 0xc], ecx
test esi, esi
je 0x4bab94
lea ecx, [esp + 0x18]
call fcn.004178d0
call fcn.0040c720
or ecx, 0xffffffff
lock xadd dword [eax], ecx
lea ecx, [esp + 0x18]
call fcn.0041add0
inc ebp
cmp ebp, dword [esp + 0x2c]
jl 0x4bab05
lea edi, [esp + 0x20]
call fcn.0041daf0
mov ecx, dword [esp + 0x1038]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1020]
xor ecx, esp
call fcn.0051e437
add esp, 0x1030
ret
Function at 0x4babf0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x541a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x598c90]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
push 0x40
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x2c], 0
mov eax, esp
mov esi, edx
mov dword [esp + 0x2c], esp
call fcn.0041ae00
lea ecx, [esp + 0x2c]
push ecx
call fcn.004ba480
add esp, 8
push eax
mov dword [esp + 0xbc], 0
call fcn.0041d8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
lea ecx, [esp + 0xc]
sete bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.0041add0
test bl, bl
je 0x4bac99
xor edx, edx
mov word [esp + 0x10], dx
lea eax, [esp + 0x10]
call fcn.0041aed0
mov eax, esi
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0051e437
add esp, 0x94
ret
Function at 0x4bad80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x542e61
mov eax, dword fs:[0]
push eax
mov eax, 0x1828
call fcn.00533100
mov eax, dword [0x598c90]
xor eax, esp
mov dword [esp + 0x1820], eax
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x1834]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1844]
mov edi, ecx
mov dword [esp + 0x10], 0
cmp eax, 0xc
ja case.default.0x4badd7
jmp dword [eax*4 + 0x4baf88]
mov eax, 0x28
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 5
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
xor eax, eax
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 0x1a
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 0x23
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 0x26
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 0xd
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
mov eax, 0xe
push eax
call fcn.004ba5d0
add esp, 4
jmp 0x4baf5b
lea ecx, [esp + 0x82c]
push ecx
xor eax, eax
push 0x800
mov word [esp + 0x834], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x82c]
lea esi, [esp + 0x18]
call fcn.0041aed0
push eax
mov ecx, edi
mov dword [esp + 0x1840], 0
call fcn.004178a0
mov ecx, esi
call fcn.0041add0
jmp 0x4baf5b
call fcn.004bb4a0
push 0x204
lea ecx, [esp + 0x20]
push ecx
xor edx, edx
push eax
mov word [esp + 0x28], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x1c]
lea esi, [esp + 0x14]
call fcn.0041aed0
push eax
mov ecx, edi
mov dword [esp + 0x1840], 1
call fcn.004178a0
mov ecx, esi
call fcn.0041add0
jmp 0x4baf5b
push 0x204
lea eax, [esp + 0x428]
xor edx, edx
push eax
push edx
mov word [esp + 0x430], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x424]
lea esi, [esp + 0x10]
call fcn.0041aed0
push eax
mov ecx, edi
mov dword [esp + 0x1840], 2
call fcn.004178a0
mov ecx, esi
call fcn.0041add0
jmp 0x4baf5b
mov ecx, 0x59f738
mov esi, edi
call fcn.004178d0
mov eax, edi
mov ecx, dword [esp + 0x1834]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1820]
xor ecx, esp
call fcn.0051e437
add esp, 0x1834
ret 4

Function at 0x4bafc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x53debb
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x598c90]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
push ecx
xor eax, eax
mov dword [esp + 0xc], 0
push 0x204
mov word [esp + 0x14], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0xc]
lea esi, [esp + 8]
call fcn.0041aed0
push eax
mov ecx, edi
mov dword [esp + 0x424], 0
call fcn.004178a0
mov ecx, esi
call fcn.0041add0
mov eax, edi
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0051e437
add esp, 0x41c
ret