joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49edbc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49ee73
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040404c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x49edfe
call fcn.00403720
jmp 0x49ee7a
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.0040404c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x49ee27
call fcn.00403720
jmp 0x49ee7a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49ee84
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x49ee48
call fcn.00403720
jmp 0x49ee7a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ee7a
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f140
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x49f185
push dword fs:[ecx]
mov dword fs:[ecx], esp
or edx, 0x4008
push edx
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f191
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f19c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49f1ec
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f1f8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a05c8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a061b
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0x90
mov eax, ebx
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0627
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0630
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0680
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a068c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a3fd4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a4043
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
je 0x4a402d
cmp dword [ebx + 0x34c], 0xffffffff
je 0x4a402d
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.004a8af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a404a
lea eax, [ebp - 8]
call fcn.00403c0c
ret

Function at 0x4a4050
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a40bf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
je 0x4a40a9
cmp dword [ebx + 0x34c], 0xffffffff
je 0x4a40a9
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.004a8af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a40c6
lea eax, [ebp - 8]
call fcn.00403c0c
ret
Function at 0x4a7248
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a7338
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi + 0x38c], 0
jne 0x4a7277
mov edx, 0x1000
mov eax, edi
call fcn.004a4104
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x34c], esi
inc esi
jne 0x4a729e
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.004a8af0
mov dl, 1
mov eax, edi
call fcn.004a40cc
mov byte [edi + 0x364], 1
mov byte [edi + 0x395], 1
mov byte [edi + 0x120], 0
mov edx, dword [edi + 0xf4]
mov eax, edi
call fcn.004a59ec
test bl, bl
je 0x4a72e9
push 0x28
push 0x466
mov eax, dword [edi + 0x368]
push eax
mov eax, dword [edi + 0x34c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4a7303
push 0x28
push 0x465
mov eax, dword [edi + 0x368]
push eax
mov eax, dword [edi + 0x34c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 5
mov eax, dword [edi + 0x34c]
push eax
call sub.wsock32.dll_listen
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.004a8af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a733f
lea eax, [ebp - 4]
call fcn.00403c0c
ret
Function at 0x4a7a70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
cmp eax, 0xffffffff
jne 0x4a7a98
or ebx, 0xffffffff
jmp 0x4a7bba
mov edx, dword [ebp - 4]
cmp byte [edx + 0x2d8], 0
je 0x4a7ba8
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34c], 0xffffffff
je 0x4a7ac5
mov eax, dword [ebp - 4]
cmp dword [eax + 0x300], 0
jne 0x4a7acd
or ebx, 0xffffffff
jmp 0x4a7bba
xor eax, eax
push ebp
push 0x4a7b05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
push eax
mov eax, dword [0x581d00]
mov eax, dword [eax]
call eax
add esp, 0xc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7b12
test ebx, ebx
jg 0x4a7b9f
cmp dword [ebp - 0x10], 0xc8
jg 0x4a7b9f
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
push eax
mov eax, dword [0x581f88]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x4a7b9f
je 0x4a7b6b
sub eax, 4
je 0x4a7b4b
dec eax
je 0x4a7b5d
jmp 0x4a7b79
test ebx, ebx
je 0x4a7b9f
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a8934
jmp 0x4a7b9f
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a8934
jmp 0x4a7b9f
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a8934
jmp 0x4a7b9f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xcc], 0
je 0x4a7b9f
inc dword [ebp - 0x10]
cmp byte [ebp + 8], 0
jne 0x4a7b9f
mov dx, 2
mov eax, dword [ebp - 4]
call fcn.004a90bc
jmp 0x4a7aad
test ebx, ebx
jne 0x4a7bba
or ebx, 0xffffffff
jmp 0x4a7bba
push 0
mov edx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
push edx
push eax
call sub.wsock32.dll_recv
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7bc8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x34c]
cmp eax, 0xffffffff
jne 0x4a7bec
or esi, 0xffffffff
jmp 0x4a7c8b
cmp byte [ebx + 0x2d8], 0
je 0x4a7c79
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x300]
push eax
mov eax, dword [0x581964]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x4a7c8b
cmp edi, 0x14
jg 0x4a7c8b
push esi
mov eax, dword [ebx + 0x300]
push eax
mov eax, dword [0x581f88]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x4a7c8b
je 0x4a7c60
sub eax, 4
je 0x4a7c46
dec eax
je 0x4a7c53
jmp 0x4a7c6d
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004a8934
jmp 0x4a7c8b
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004a8934
jmp 0x4a7c8b
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004a8934
jmp 0x4a7c8b
cmp byte [ebx + 0xcc], 2
je 0x4a7c8b
inc edi
jmp 0x4a7bfb
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a9f98
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa211
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
push 0x465
mov eax, dword [ebx + 0x368]
push eax
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x2c4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebx + 0xf4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x4aa228
call fcn.00409ffc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x4aa248
call fcn.00403ed4
cmp dword [ebx + 0xd8], 0
je 0x4aa068
push dword [ebp - 8]
push 0x4aa254
push dword [ebx + 0xd8]
push 0x4aa278
push dword [ebx + 0xdc]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f48
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.00456cc8
push dword [ebp - 0xc]
push 0x4aa248
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403f48
push dword [ebp - 8]
push 0x4aa284
push 0x4aa248
push 0x4aa248
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403f48
mov eax, dword [ebp - 8]
call fcn.00403e88
push eax
mov eax, dword [ebp - 8]
call fcn.0040404c
mov edx, eax
mov eax, ebx
pop ecx
call fcn.004a61e0
xor edx, edx
mov eax, ebx
call fcn.004a7540
lea eax, [ebp - 4]
mov edx, 0x2000
call fcn.004041b8
mov eax, dword [ebp - 4]
call fcn.0040404c
xor ecx, ecx
mov edx, 0x2000
call fcn.004078bc
push 2
push 0x2000
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_recv
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040408c
mov eax, dword [ebp - 0xc]
mov edx, 0x4aa2a4
call fcn.00403f98
jne 0x4aa164
mov edx, dword [ebp - 4]
mov eax, 0x4aa2b4
call fcn.00404170
mov esi, eax
test esi, esi
jle 0x4aa16f
lea edi, [esi + 4]
mov edx, edi
lea eax, [ebp - 4]
call fcn.004041b8
mov eax, dword [ebp - 4]
call fcn.0040404c
mov edx, edi
xor ecx, ecx
call fcn.004078bc
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_recv
mov esi, eax
lea eax, [ebp - 4]
mov edx, esi
call fcn.004041b8
jmp 0x4aa18e
mov dx, 3
mov eax, ebx
call fcn.004a90bc
cmp byte [ebx + 0x394], 0
je 0x4aa18e
cmp byte [ebx + 0x336], 0
jne 0x4aa18e
cmp byte [ebx + 0x335], 0
je 0x4aa0cc
mov eax, ebx
call fcn.004a7590
cmp byte [ebx + 0x2e0], 0
jne 0x4aa1cc
push 0x23
push 0x465
mov eax, dword [ebx + 0x368]
push eax
mov eax, dword [ebx + 0x34c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push ebx
push 0
push 0x468
mov eax, dword [ebx + 0x368]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebx + 0x321], 5
mov dword [ebx + 0x378], 0xffffffff
mov dword [ebx + 0x37c], 0xffffffff
mov byte [ebx + 0xf0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa218
lea eax, [ebp - 0x20]
call fcn.00403c0c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c30
ret
Function at 0x4aa2ec
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa36e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov edi, dword [ebx + 0x34c]
cmp edi, 0xffffffff
je 0x4aa358
cmp byte [ebx + 0x2d8], 0
je 0x4aa327
mov esi, 0x8000
jmp 0x4aa358
lea eax, [ebp - 4]
push eax
push 0x4004667f
push edi
call sub.wsock32.dll_ioctlsocket
test eax, eax
je 0x4aa346
mov dword [ebx + 0x34c], 0xffffffff
jmp 0x4aa349
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.004a8af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa375
lea eax, [ebp - 8]
call fcn.00403c0c
ret

Function at 0x4aa380
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa406
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
push edi
call sub.wsock32.dll_htons
mov word [ebx + 0x352], ax
push 0x10
lea eax, [ebx + 0x350]
push eax
push esi
call sub.wsock32.dll_bind
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete al
xor al, 1
mov byte [ebp - 1], al
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.004a8af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa40d
lea eax, [ebp - 8]
call fcn.00403c0c
ret

Function at 0x4aa8cc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402c18
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x4ab458
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00402c18
pop ebp
ret
Function at 0x4c86c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4c872c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov ebx, 0x585ea8
lea eax, [ebp - 4]
mov edx, esi
add dl, 0x40
call fcn.00403db0
lea eax, [ebp - 4]
mov edx, 0x4c8740
call fcn.00403e90
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x1b
jne 0x4c86e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8733
lea eax, [ebp - 4]
call fcn.00403c0c
ret

Function at 0x4ca17c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov ebx, ecx
test ebx, ebx
js 0x4ca1a3
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4ca19c
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040403c
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010c4]
call fcn.004046b4
xor eax, eax
push ebp
push 0x4ca331
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4ca2f9
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x4ca358
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403f48
mov eax, dword [ebp - 0x158]
call fcn.0040404c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ca2ed
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x4ca2d2
test al, 2
jne 0x4ca2d2
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x4ca358
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403e38
push dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403f48
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x10]
call fcn.0049ef3c
call fcn.0046808c
test al, al
je 0x4ca290
or edi, 0xffffffff
jmp 0x4ca29f
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0049f140
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0049ee9c
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403e38
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x38]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4ca225
push ebx
call sub.kernel32.dll_FindClose
add esi, 4
dec dword [ebp - 0x14]
jne 0x4ca1e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca338
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00403c30
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010c4]
call fcn.0040459c
lea eax, [ebp - 4]
call fcn.00403c0c
ret
Function at 0x4cb444
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb544
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x14]
mov edx, dword [0x581dd8]
mov edx, dword [edx]
call fcn.00403f98
je 0x4cb48a
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403ca4
jmp 0x4cb52b
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.004cb554
mov edx, dword [ebp - 0x164]
lea eax, [ebx + 0x14]
call fcn.00403c60
cmp dword [ebx + 0x14], 0
jne 0x4cb4fc
lea eax, [ebp - 0x160]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0x208
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.004cb3e0
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4cb4fc
lea eax, [ebp - 0x154]
call fcn.00409878
mov ecx, eax
lea edx, [ebp - 0x154]
lea eax, [ebx + 0x14]
call fcn.00403cf0
mov eax, ebx
call fcn.004cb364
test al, al
je 0x4cb521
mov eax, dword [ebx + 0x14]
call fcn.00403e88
mov edx, eax
sub edx, 3
lea eax, [ebx + 0x14]
mov ecx, 4
call fcn.004040cc
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb54b
lea eax, [ebp - 0x164]
call fcn.00403c0c
ret
Function at 0x4cf74c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040403c
xor eax, eax
push ebp
push 0x4cf7d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
je 0x4cf7a9
dec eax
je 0x4cf787
sub eax, 2
je 0x4cf7a9
jmp 0x4cf7bb
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004a04ac
test al, al
je 0x4cf7bb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov bx, 0xffa3
call fcn.00403184
jmp 0x4cf7bb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov bx, 0xffa3
call fcn.00403184
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf7d8
lea eax, [ebp - 4]
call fcn.00403c0c
ret

Function at 0x4cf7dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf88b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x35c], 0
jne 0x4cf82a
push 0x465
mov eax, dword [ebp - 4]
call fcn.00447120
mov ecx, eax
mov dl, 1
mov eax, dword [0x4cbed4]
call fcn.004cbf40
mov edx, dword [ebp - 4]
mov dword [edx + 0x35c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.004cc40c
lea eax, [ebp - 8]
mov edx, 0x4cf8a0
call fcn.00403ca4
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4cf875
test bl, 1
je 0x4cf86e
lea eax, [ebp - 8]
call fcn.00404058
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.004cf74c
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x4cf852
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf892
lea eax, [ebp - 8]
call fcn.00403c0c
ret
Function at 0x4d0408
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040403c
xor eax, eax
push ebp
push 0x4d051a
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d04ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4d04ca
test byte [ebp - 0x14c], 0x10
jne 0x4d04ad
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403e38
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408a68
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4d0470
push ebx
call sub.kernel32.dll_FindClose
mov byte [ebp - 5], 1
jmp 0x4d04d6
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d04f4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret