joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xc]
call fcn.0044e010
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
mov edx, dword [esi + 0x58]
push edx
mov edx, dword [esi + 0x54]
push edx
mov edx, dword [esi + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov edx, dword [ebp - 4]
test edx, edx
jle 0x451197
lea esp, [esp]
mov eax, dword [esi + 0x4c]
sub eax, 0
je 0x45109f
dec eax
jne 0x451171
mov ecx, dword [esi + 0x5c]
cmp ecx, dword [esi + 0x60]
jle 0x451072
mov ecx, dword [esi + 0x48]
push ecx
push edx
mov edx, dword [esi + 0x40]
push 1
push edx
call fcn.00476af2
add dword [esi + 0x60], eax
mov ecx, dword [esi + 0x5c]
mov eax, ecx
sub eax, dword [esi + 0x60]
add esp, 0x10
cmp eax, 0x8000
jge 0x45106f
mov dword [esi + 0x58], eax
cmp ecx, dword [esi + 0x60]
jne 0x451171
mov eax, dword [esi + 0x48]
test eax, eax
je 0x451088
push eax
call fcn.00470ed8
add esp, 4
mov eax, 0x200
mov dword [esi + 0x4c], 0
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
jmp 0x451171
mov eax, dword [str.rnempty0]
mov edi, dword [esi + 0x40]
push eax
lea ecx, [ebp - 0x14]
mov dword [esi + 0x50], edi
call fcn.0044e280
cmp byte [eax + 7], 0xff
jne 0x4510bb
mov eax, dword [eax]
push edi
push eax
call fcn.00470c2d
add esp, 8
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.0044e260
lea ecx, [ebp - 0xc]
push ecx
test bl, bl
je 0x45110c
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add edx, 0x159
push edx
push eax
call fcn.00450940
add esp, 0xc
test eax, eax
jns 0x451171
lea ecx, [ebp - 0xc]
mov byte [esi + 0x20], 5
call fcn.0044e260
pop edi
pop esi
mov eax, 0x8004008a
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x14]
push eax
add eax, 0x159
push eax
push edx
call fcn.00450b00
xor edi, edi
add esp, 0x10
mov dword [esi + 0x48], eax
cmp eax, edi
je 0x4510f4
mov eax, dword [esi + 0x50]
add eax, 0x7c
push 0xb
push eax
call fcn.00450900
add esp, 8
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], edi
cmp eax, edi
jle 0x451165
mov dword [esi + 0x4c], 1
mov dword [esi + 0x54], edi
cmp eax, 0x8000
jge 0x45115c
mov dword [esi + 0x58], eax
jmp 0x451171
mov dword [esi + 0x58], 0x8000
jmp 0x451171
mov ecx, dword [esi + 0x48]
push ecx
call fcn.00470ed8
add esp, 4
mov eax, dword [esi + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x58]
push ecx
mov ecx, dword [esi + 0x54]
push ecx
mov ecx, dword [esi + 0x40]
push ecx
push eax
call edx
mov edx, dword [ebp - 4]
test edx, edx
jg 0x451030
lea ecx, [ebp - 0xc]
call fcn.0044e260
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4511b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x38]
push ebx
call fcn.00454a10
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x4511db
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.00458800
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.00458a80
test edi, edi
je 0x451207
mov esi, dword [esi + 0x44]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push edi
push esi
call edx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00458cf0
push ebx
lea ecx, [ebp - 0x30]
push ecx
call fcn.00458020
push eax
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.00458000
push eax
call fcn.00476af2
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.00458870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x40]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
call fcn.0044e010
cmp byte [ebx], 0
push edi
je 0x451a89
push 0x5c
push ebx
lea eax, [ebp - 0x30]
push str._s_c_s
push eax
call fcn.0044ee50
add esp, 0x14
jmp 0x451a91
lea ecx, [ebp - 0x30]
call fcn.0044e3b0
cmp byte [ebp - 0x29], 0xff
lea eax, [ebp - 0x30]
jne 0x451a9d
mov eax, dword [ebp - 0x30]
push 0x4a2d28
push eax
call fcn.0047136f
add esp, 8
mov ebx, eax
push edi
test ebx, ebx
jne 0x451acd
push str.Cant_open_file__s_for_reading__skipping_n
call fcn.00477daa
add eax, 0x40
push eax
call fcn.00472a4f
add esp, 0xc
jmp 0x451bbf
push str.Processing_file__s_for_compression_n
call fcn.00477daa
add eax, 0x20
push eax
call fcn.00472a4f
push 0x200
push 0
push esi
call fcn.00470280
add esp, 0x18
cmp byte [ebp - 0x29], 0xff
lea eax, [ebp - 0x30]
jne 0x451afc
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push edi
push ecx
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00451240
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
jns 0x451b4e
push edi
push str.Cant_stat__s__skipping_n
call fcn.00477daa
add eax, 0x40
push eax
call fcn.00472a4f
push ebx
call fcn.00470ed8
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0044e260
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470483
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
push edx
push edi
mov edi, dword [ebp - 0x38]
mov ecx, dword [edi + 0x38]
call fcn.004549c0
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push 0x200
push esi
push eax
mov eax, dword [ecx + 0x14]
call eax
push ebx
call fcn.004766e4
add esp, 4
test eax, eax
jne 0x451bb6
push ebx
push 0x8000
push 1
push esi
call fcn.0047697e
add esp, 0x10
test eax, eax
jle 0x451ba9
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea edi, [ebp - 0x3c]
push edi
push eax
mov eax, dword [edx + 0x14]
push esi
push ecx
call eax
mov edi, dword [ebp - 0x38]
push ebx
call fcn.004766e4
add esp, 4
test eax, eax
je 0x451b80
push ebx
call fcn.00470ed8
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.0044e260
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00470483
mov esp, ebp
pop ebp
ret
Function at 0x452330
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4c557c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
je 0x452360
call ebx
sub eax, dword [0x4c557c]
cmp eax, 0xc8
jae 0x452360
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push edi
xor edi, edi
test eax, eax
je 0x4523c8
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
mov ecx, dword [eax]
push 0x4aaf4c
push eax
mov eax, dword [ecx]
call eax
cmp dword [ebp - 4], edi
je 0x4523c8
call ebx
mov edx, dword [ebp + 8]
mov dword [0x4c557c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4523a9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, 0x80040088
jne 0x4523c8
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4523c8
push eax
call fcn.00470ed8
add esp, 4
mov dword [esi + 0x44], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x453600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x38]
push ebx
call fcn.00454a10
xor edi, edi
cmp dword [esi + 0x40], edi
je 0x45362b
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.00458800
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.00458a80
test edi, edi
je 0x453657
mov esi, dword [esi + 0x40]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push edi
push esi
call edx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00458cf0
push ebx
lea ecx, [ebp - 0x30]
push ecx
call fcn.00458020
push eax
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.00458000
push eax
call fcn.00476af2
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.00458870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x454800
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x18]
push eax
mov edi, 0x400
call fcn.00459bb0
add esp, 4
cmp dword [ebp - 0x10], 8
jne 0x4548cc
push esi
lea ecx, [ebp - 0x20]
call fcn.0044e010
push 0x104
lea ecx, [ebp - 0x20]
call fcn.0044ec10
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.0044eca0
test esi, esi
pop esi
je 0x4548c4
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.0044e090
cmp eax, 0xffffffff
je 0x4548c4
push eax
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0044ea30
push eax
lea ecx, [ebp - 0x20]
call fcn.0044e310
lea ecx, [ebp - 0x34]
call fcn.0044e260
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.0044e760
cmp byte [ebp - 0x19], 0xff
lea eax, [ebp - 0x20]
jne 0x4548a2
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4548c4
mov edi, dword [ebp - 0x28]
imul edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.0044e260
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00470483
mov esp, ebp
pop ebp
ret

Function at 0x454a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x60]
call fcn.00458800
push esi
lea ecx, [ebp - 0x60]
call fcn.00458040
lea eax, [ebp - 0x60]
push eax
call fcn.00458020
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00458800
cmp byte [esi + 0x23], 0xff
lea eax, [esi + 0x1c]
jne 0x454a4a
mov eax, dword [eax]
push 4
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00458cf0
push edi
lea edx, [ebp - 0x30]
push edx
call fcn.00458a80
lea eax, [ebp - 0x30]
push eax
call fcn.00458020
mov ebx, dword [ebp + 8]
push ebx
mov esi, eax
push esi
push 1
lea ecx, [ebp - 0x30]
push ecx
call fcn.00458000
push eax
call fcn.00476af2
add esp, 0x10
cmp eax, esi
je 0x454aa4
lea ecx, [ebp - 0x30]
call fcn.00458870
lea ecx, [ebp - 0x60]
call fcn.00458870
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push edi
push 1
lea edx, [ebp - 0x60]
push edx
call fcn.00458000
push eax
call fcn.00476af2
add esp, 0x10
lea ecx, [ebp - 0x30]
cmp eax, edi
jne 0x454a8b
call fcn.00458870
lea ecx, [ebp - 0x60]
call fcn.00458870
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x457560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
lea eax, [ebp - 8]
push eax
call fcn.004572c0
cmp byte [eax + 7], 0xff
jne 0x45757a
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.0044e260
cmp ebx, 0xffffffff
je 0x4575a0
test bl, 0x10
je 0x4575a0
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4575b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
lea eax, [ebp - 8]
push eax
call fcn.004572c0
cmp byte [eax + 7], 0xff
jne 0x4575ca
mov eax, dword [eax]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.0044e260
neg esi
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459030
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
test eax, eax
je 0x4590ba
push 0x4a09e0
lea ecx, [esi + 4]
call fcn.0044e0f0
cmp eax, 0xffffffff
je 0x4590ba
add eax, 2
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 4]
call fcn.0044ea30
xor esi, esi
cmp byte [ebp - 0x11], 0xff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 0x18]
jne 0x459080
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4590b2
cmp dword [ebp - 4], esi
je 0x4590b2
lea ecx, [ebp - 0x18]
call fcn.0044e260
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
call fcn.0044e260
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4590d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push str.TEMP
mov edi, ecx
call fcn.00479401
add esp, 4
test eax, eax
je 0x45910f
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.0044e3b0
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
mov ecx, edi
call edx
test eax, eax
jne 0x4591c3
mov ecx, esi
call fcn.0044e230
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x459180
push 0x104
lea esi, [edi + 4]
push 0x105
mov ecx, esi
call fcn.0044ec10
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0044eca0
push 0x5c
mov ecx, esi
call fcn.0044e0c0
mov ecx, esi
cmp eax, 0xffffffff
jne 0x459152
call fcn.0044e230
jmp 0x45916c
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044ea30
push eax
mov ecx, esi
call fcn.0044e310
lea ecx, [ebp - 8]
call fcn.0044e260
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
test eax, eax
jne 0x4591c3
mov ecx, esi
call fcn.0044e230
push 0x104
lea esi, [edi + 4]
push 0x105
mov ecx, esi
call fcn.0044ec10
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0044eca0
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
test eax, eax
jne 0x4591c3
mov ecx, esi
call fcn.0044e230
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x459227
cmp byte [eax], 0
je 0x459227
mov al, byte [esi + 7]
mov ebx, esi
cmp al, 0xff
jne 0x459235
mov ebx, dword [esi]
mov edi, ebx
mov ecx, esi
call fcn.0044e020
add eax, ebx
push eax
push edi
call fcn.00457b80
add esp, 8
cmp byte [esi + 7], 0xff
mov edi, eax
mov ebx, esi
jne 0x4591fb
mov ebx, dword [esi]
mov ecx, esi
call fcn.0044e020
add eax, ebx
lea ecx, [edi + 1]
cmp ecx, eax
jne 0x459210
cmp byte [edi], 0x5c
je 0x45921c
push 0x4a0930
mov ecx, esi
call fcn.0044e6e0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, esi
call fcn.0044e6e0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
jmp 0x4591dc
Function at 0x459270
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ecx + 0xb]
push esi
lea esi, [ecx + 4]
cmp al, 0xff
je 0x459315
xor ecx, ecx
cmp al, 7
sete cl
test cl, cl
jne 0x459357
cmp al, 0xff
mov eax, esi
jne 0x4592a9
mov eax, dword [esi]
cmp byte [eax], 0x2e
je 0x459357
mov ecx, esi
call fcn.0044e020
cmp eax, 3
jne 0x45932c
mov cl, byte [esi + 7]
mov eax, esi
cmp cl, 0xff
jne 0x4592ca
mov eax, dword [esi]
cmp byte [eax + 1], 0x3a
jne 0x45932c
mov eax, esi
cmp cl, 0xff
jne 0x4592d9
mov eax, dword [esi]
cmp byte [eax + 2], 0x5c
jne 0x45932c
cmp cl, 0xff
jne 0x4592e6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x459301
cmp eax, 4
je 0x459301
cmp eax, 2
je 0x459301
cmp eax, 6
jne 0x459357
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470483
mov esp, ebp
pop ebp
ret
cmp byte [esi + 4], 0
jne 0x4592a1
cmp byte [esi + 5], 0
jne 0x4592a1
cmp byte [esi + 6], 0
je 0x459357
jmp 0x4592a1
cmp byte [esi + 7], 0xff
jne 0x459334
mov esi, dword [esi]
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x459357
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x144], 0x10
jne 0x459301
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00470483
mov esp, ebp
pop ebp
ret

Function at 0x459370
Capabilities:
Get disk information

Disassembly:
push esi
lea esi, [ecx + 4]
mov ecx, esi
call fcn.0044e020
cmp eax, 2
jb 0x4593b6
mov al, byte [esi + 7]
mov ecx, esi
cmp al, 0xff
jne 0x45938b
mov ecx, dword [esi]
cmp byte [ecx + 1], 0x3a
jne 0x4593b6
cmp al, 0xff
jne 0x459397
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4593aa
mov eax, 1
pop esi
ret
xor ecx, ecx
cmp eax, 2
sete cl
pop esi
mov eax, ecx
ret
xor eax, eax
pop esi
ret

Function at 0x459b50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x459b69
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x459ba3
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x459b63
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x459bb0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x94
lea eax, [ebp - 0x98]
push 0
or edi, 0xffffffff
push eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], 0
call fcn.00470280
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov word [ebp - 0xa8], dx
xor edx, edx
cmp dword [ebp - 0x88], 2
mov word [ebp - 0xac], ax
sete dl
mov word [ebp - 0xaa], cx
mov esi, edx
test esi, esi
je 0x459c4a
mov edi, 8
jmp 0x459c6b
cmp ax, 4
jae 0x459c57
mov edi, 2
jmp 0x459c6b
jne 0x459c6b
cmp cx, 0xa
sbb edi, edi
and edi, 0xfffffc04
add edi, 0x400
test ebx, ebx
je 0x459d3b
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0xd0]
cmp eax, 3
ja case.default.0x459c90
jmp dword [eax*4 + 0x459d50]
test esi, esi
je 0x459cd8
mov ax, word [ebp - 0xac]
cmp ax, 3
ja 0x459cb4
jne 0x459cd8
cmp word [ebp - 0xaa], 0x32
jb 0x459cd8
movzx eax, word [ebp - 0xb0]
sub eax, 4
js 0x459cfd
test eax, eax
je 0x459cf6
cmp eax, 1
je 0x459cef
sub eax, 2
neg eax
sbb eax, eax
and eax, 0xfffffffb
lea esi, [eax + 4]
jmp 0x459d1c
mov eax, dword [ebp - 0xb8]
sub eax, 0x182
je 0x459cfd
sub eax, 0x64
je 0x459cf6
sub eax, 0x64
jne case.default.0x459c90
mov esi, 2
jmp 0x459d1c
mov esi, 1
jmp 0x459d1c
mov esi, 0xfffffffe
jmp 0x459d1c
mov esi, 0x40
jmp 0x459d1c
mov esi, 0x20
jmp 0x459d1c
mov esi, 8
jmp 0x459d1c
or esi, 0xffffffff
call fcn.00459b50
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa8]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470483
mov esp, ebp
pop ebp
ret

Function at 0x45ef90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045e9f0

Function at 0x45fca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [edi + 2]
shr eax, 1
push 2
push eax
call fcn.004721da
mov esi, eax
add esp, 8
test esi, esi
jne 0x45fcc5
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
push ecx
push edi
push 1
push esi
call fcn.0047697e
xor edx, edx
cmp eax, edi
setne dl
push esi
mov edi, edx
call fcn.004721a0
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4605e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x210], edi
call fcn.00470280
mov eax, dword [edi]
add esp, 0xc
test eax, eax
je 0x46075a
push eax
call fcn.00470ed8
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x46075a
mov eax, dword [0x4d6a42]
push ebx
mov ebx, esi
imul ebx, ebx, 0x16
mov ecx, dword [ebx + eax + 6]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebx + eax + 6]
mov eax, dword [0x4d68d6]
mov dword [ebp - 0x214], edx
test eax, eax
je 0x460743
lea edx, [ebp - 0x20c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x460668
cmp byte [ebp - 0x20c], cl
je 0x4606b1
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x460683
sub eax, edx
cmp byte [ebp + eax - 0x20d], 0x5c
je 0x4606b1
lea edi, [ebp - 0x20c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4606a0
mov ax, word [0x4a0930]
mov word [edi], ax
push 1
push esi
call fcn.00465d70
add esp, 8
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4606c0
lea edi, [ebp - 0x20c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4606d2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
lea ecx, [ebp - 0x20c]
push ecx
call esi
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0047a5b1
mov ecx, dword [0x4d6a42]
movsx edx, byte [ebx + ecx]
add esp, 8
push edx
lea eax, [ebp - 0x20c]
push eax
call esi
mov ecx, dword [ebp - 0x210]
pop ebx
pop edi
mov dword [ecx], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470483
mov esp, ebp
pop ebp
ret
pop ebx
mov dword [edi], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470483
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [edi], 0
pop edi
xor ecx, ebp
pop esi
call fcn.00470483
mov esp, ebp
pop ebp
ret