joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443bb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x130]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, edx
call fcn.00408b30
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
xor eax, eax
push fcn.00443b80
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x128]
xor cl, cl
mov edx, 0x100
call fcn.004037d0
lea eax, [ebp - 0x12c]
call fcn.00403c70
push 0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x130]
call fcn.00484360
mov edx, dword [ebp - 0x130]
mov ecx, 0x61e2a4
lea eax, [ebp - 0x12c]
call fcn.00408c60
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
call fcn.0048b710
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 3
lea eax, [ebp - 0x128]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x18], 0x54
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x28]
push eax
call sub.shell32.dll_SHFileOperation
mov ebx, eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00443b80
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454040
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x108], 0
xor eax, eax
push fcn.00454020
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6985f0]
mov eax, dword [eax + 0x4dc]
mov edx, dword [0x6985f0]
mov edx, dword [edx + 0x4dc]
mov edx, dword [edx]
call dword [edx + 0x4f0]
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
mov ebx, 1
xor esi, esi
mov dword [ebp - 0x10c], 0
xor edi, edi
lea esi, [esi]
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408b60
mov eax, dword [ebp - 0x10c]
mov edx, edi
add eax, 1
adc edx, 0
mov dword [ebp - 0x10c], eax
mov edi, edx
jmp 0x45410e
push 0
mov al, byte [ebp + ebx - 0x105]
lea ecx, [ebp - 0x108]
xor dx, dx
call fcn.00409450
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 4]
lea eax, [ebp - 4]
call fcn.00408c60
add ebx, 1
adc esi, 0
test esi, esi
jb 0x45411c
ja 0x454128
cmp ebx, 0xff
ja 0x454128
mov eax, ebx
cmp byte [ebp + eax - 0x105], 0
jne 0x4540e0
add ebx, 1
adc esi, 0
cmp dword [ebp - 4], 0
je 0x454164
mov eax, dword [0x6985f0]
mov eax, dword [eax + 0x4dc]
mov eax, dword [eax + 0x398]
mov edx, dword [ebp - 4]
mov ecx, dword [0x6985f0]
mov ecx, dword [ecx + 0x4dc]
mov ecx, dword [ecx + 0x398]
mov ecx, dword [ecx]
call dword [ecx + 0xa8]
mov esi, esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x45416e
mov eax, dword [eax - 4]
test eax, eax
jne 0x4540b8
mov edx, dword [ebp - 0x10c]
mov eax, edi
sub edx, 1
sbb eax, 0
mov dword [ebp - 0x10c], edx
mov edi, eax
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00454020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x455dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
xor eax, eax
push fcn.00455dc0
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push 0x455e9f
push ebp
push 0x415860
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x1a
mov eax, dword [0x6985f0]
call fcn.00532e40
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
and eax, 0x80000000
jne 0x455e94
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xc]
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x455e89
push 0
push 1
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
xor cx, cx
mov edx, 0x104
call fcn.00409550
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 4]
mov ecx, str.PeaZip_
call fcn.00408c60
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
mov dword [ebp - 8], 0
jmp 0x455e91
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x455ea4
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00455dc0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4579b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
mov dword [ebp - 4], eax
call fcn.00408b30
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00457980
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xffffffff
cmp dword [ebp - 4], 0
je 0x457a0c
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.0040c9b0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040b0e0
lea esi, [esi]
push 1
mov eax, 0x6972f0
push eax
mov eax, 0x6972f0
push eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x457a26
mov eax, 0x6972f0
push eax
mov eax, str.open
push eax
mov eax, dword [0x6985f0]
call fcn.00532e40
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x21
jge 0x457a90
push 1
mov eax, 0x6972f0
push eax
lea eax, [ebp - 0x10]
call fcn.0040a420
mov ecx, dword [ebp - 8]
mov edx, 0x620044
lea eax, [ebp - 0x10]
call fcn.0040a750
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x457a70
mov eax, 0x6972f0
push eax
mov eax, 0x620088
push eax
mov eax, str.open
push eax
mov eax, dword [0x6985f0]
call fcn.00532e40
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00457980
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x457ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, 0x6972f0
push eax
mov eax, 0x6972f0
push eax
mov eax, 0x6972f0
push eax
mov eax, str.find
push eax
mov eax, dword [0x6985f0]
call fcn.00532e40
push eax
call sub.shell32.dll_ShellExecuteW
mov esp, ebp
pop ebp
ret
Function at 0x4603a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1ac]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
xor eax, eax
push fcn.00460370
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x9c]
mov eax, 0x62ac64
call fcn.00490260
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00483880
mov edx, dword [ebp - 0x98]
mov eax, esi
call fcn.00408b60
mov eax, dword [esi]
lea edx, [ebp - 0x98]
call fcn.0040a1a0
mov eax, dword [ebp - 0x98]
mov edx, 0x62ac78
call fcn.00409720
test eax, eax
je 0x460460
mov eax, dword [esi]
lea edx, [ebp - 0x98]
call fcn.0040a1a0
mov eax, dword [ebp - 0x98]
mov edx, 0x62ac90
call fcn.00409720
test eax, eax
je 0x460460
mov eax, esi
mov edx, 0x62ac90
call fcn.00408b60
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4605b0
push 0
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
mov ecx, 0xff
lea edx, [ebp - 0x1a8]
mov eax, 0xffffffff
call fcn.00405050
lea ecx, [ebp - 0x9c]
xor dx, dx
lea eax, [ebp - 0x1a8]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x9c]
call fcn.0040a2a0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa8], eax
mov eax, 0x62a89c
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
mov ecx, 0xff
lea edx, [ebp - 0x1a8]
mov eax, 0xffffffff
call fcn.00405050
lea ecx, [ebp - 0x1ac]
xor dx, dx
lea eax, [ebp - 0x1a8]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x1ac]
call fcn.0040a2a0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xa0], eax
lea edx, [ebp - 0xa8]
mov eax, ebx
mov ecx, 2
call fcn.00408ef0
cmp dword [ebp - 0x90], 4
ja 0x460580
mov eax, dword [esi]
lea edx, [ebp - 0x98]
call fcn.0040a1a0
mov eax, dword [ebp - 0x98]
mov edx, 0x62ac90
call fcn.00409720
test eax, eax
jne 0x460573
mov eax, edi
mov edx, 0x62aca4
call fcn.00408b60
jmp 0x46057f
mov eax, edi
mov edx, 0x62acb4
call fcn.00408b60
nop
cmp dword [ebp - 0x90], 5
jne 0x460598
mov eax, edi
mov edx, 0x62acc4
call fcn.00408b60
lea esi, [esi]
cmp dword [ebp - 0x90], 6
jb 0x4605b0
mov eax, edi
mov edx, 0x62acd4
call fcn.00408b60
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00460370
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462e90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push 0x462f27
push ebp
push 0x415860
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x8b9630]
call fcn.00532e40
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
and eax, 0x80000000
jne 0x462f1c
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xc]
call sub.shell32.dll_SHGetPathFromIDList
test eax, eax
je 0x462f14
push 1
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x114]
xor cx, cx
mov edx, 0x104
call fcn.00409550
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
mov dword [ebp - 8], 0
jmp 0x462f1c
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x462f2c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4653c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x46546a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x465486
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x465486
sub dx, 0x20
je 0x465460
sub dx, 0x80
je 0x465460
sub dx, 0x1f62
jb 0x465486
sub dx, 1
jbe 0x465460
sub dx, 6
je 0x465460
sub dx, 0x26
jne 0x465486
nop
jmp 0x465460
cmp eax, dword [ebp - 0x20]
jg 0x465408
lea esi, [esi]
jmp 0x465486
cmp dword [ebp - 0x1c], 2
jne 0x46547a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x465486
mov al, byte [ebp - 0xc]
call fcn.0040b4a0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x465504
sub ax, 0x21
je 0x465518
sub ax, 0x17
je 0x465524
sub ax, 0x222
je 0x465530
sub ax, 0x392
je 0x465538
sub ax, 1
je 0x465540
sub ax, 0x1996
je 0x465548
sub ax, 1
je 0x465550
sub ax, 6
je 0x465558
sub ax, 0xb
je 0x465568
sub ax, 0x1b
je 0x465560
sub ax, 0x367
je 0x465570
jmp 0x465578
mov ax, word [ebp - 0x24]
call fcn.0040b540
mov byte [ebp - 0x10], al
jmp 0x465580
mov byte [ebp - 0x10], 0x20
jmp 0x465580
mov byte [ebp - 0x10], 0x2e
jmp 0x465580
mov byte [ebp - 0x10], 0x27
jmp 0x465580
mov byte [ebp - 0x10], 0x2c
jmp 0x465580
mov byte [ebp - 0x10], 0x27
jmp 0x465580
mov byte [ebp - 0x10], 0x20
jmp 0x465580
mov byte [ebp - 0x10], 0x20
jmp 0x465580
mov byte [ebp - 0x10], 0x20
jmp 0x465580
mov byte [ebp - 0x10], 0x20
jmp 0x465580
mov byte [ebp - 0x10], 0x2d
jmp 0x465580
mov byte [ebp - 0x10], 0x27
jmp 0x465580
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4727e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.004727d0
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x4728f0
mov al, byte [ebp - 0x110]
test al, al
je 0x4728b9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404f70
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a2a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x631220
call fcn.0048da20
mov edx, 0x47284a
mov ecx, ebp
call fcn.004153a0
jmp 0x4728f0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x631220
call fcn.0048da20
mov edx, 0x4728b9
mov ecx, ebp
call fcn.004153a0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4729b4
mov al, byte [ebp - 0x110]
test al, al
je 0x47297d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404f70
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a2a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x631220
call fcn.0048da20
mov edx, 0x47290e
mov ecx, ebp
call fcn.004153a0
jmp 0x4729b4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x631220
call fcn.0048da20
mov edx, 0x47297d
mov ecx, ebp
call fcn.004153a0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00471ec0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004727d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4763e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x631eac
call fcn.0040d090
test al, al
je 0x4764c6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.004764e0
xor eax, eax
push fcn.004763d0
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408b60
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.004755f0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.004748e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004763d0
jmp 0x4764d1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00478970
mov esp, ebp
pop ebp
ret
Function at 0x482920
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.00482910
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408b60
lea eax, [ebp - 0xc10]
call fcn.00403cb0
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x482980
mov eax, 0x6972f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x482a2a
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040fba0
xor eax, eax
push fcn.00482900
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4829dc
mov eax, 0x6972f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x482a18
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x636a2c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x482a18
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00482900
jmp 0x482a88
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x482a4c
mov eax, 0x6972f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x482a88
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x636a2c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x482a88
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00482910
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x48efe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x6379c0
lea eax, [ebp - 0x268]
call fcn.0040e950
xor eax, eax
push fcn.0048efc0
push ebp
push 0x4154e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x48f023
mov eax, 0x6972f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x48f06b
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x48f03f
clc
jmp 0x48f046
bt dword [0x636f90], eax
jb 0x48f05f
mov eax, ebp
call fcn.0048f110
test al, al
je 0x48f05f
mov byte [ebp - 0x26c], 1
jmp 0x48f0f0
mov byte [ebp - 0x26c], 0
jmp 0x48f0f0
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x5f3ed0]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x48f0f0
and esi, 0x400
je 0x48f0f0
lea ebx, [ebp - 0x268]
mov edx, 0x6379c0
mov eax, ebx
call fcn.0040ea10
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.0048ec80
test eax, eax
je 0x48f0c4
sub eax, 1
je 0x48f0dc
jmp 0x48f0e8
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.0048efe0
mov byte [ebp - 0x26c], al
jmp 0x48f0f0
mov byte [ebp - 0x26c], 1
jmp 0x48f0f0
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0048efc0
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f410
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x48f41c
mov eax, 0x6972f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x48f430
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
test eax, eax
jne 0x48f43e
mov eax, 0x6972f0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x48f44c
xor ebx, ebx
jmp 0x48f453
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f4b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
push esi
push edi
test al, al
jne 0x48f4c8
mov byte [ebp - 4], 0x5c
mov byte [ebp - 3], 0
jmp 0x48f4df
and eax, 0xff
add eax, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
cmp dword [0x8ba030], 0
je 0x48f51b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
call dword [0x8ba030]
test eax, eax
je 0x48f50d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x24]
jmp 0x48f566
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
jmp 0x48f566
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x48f55a
mov eax, dword [ebp - 8]
mul dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
imul ecx, esi
imul edx, eax
add ecx, edx
mul ebx
add edx, ecx
mov dword [ebp - 0x34], eax
mov edi, edx
jmp 0x48f566
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
mov edx, edi
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f580
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
push esi
push edi
test al, al
jne 0x48f598
mov byte [ebp - 4], 0x5c
mov byte [ebp - 3], 0
jmp 0x48f5af
and eax, 0xff
add eax, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
cmp dword [0x8ba030], 0
je 0x48f5eb
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
call dword [0x8ba030]
test eax, eax
je 0x48f5dd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x1c]
jmp 0x48f636
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
jmp 0x48f636
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x48f62a
mov eax, dword [ebp - 8]
mul dword [ebp - 0x14]
mov ebx, eax
mov eax, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
imul ecx, esi
imul edx, eax
add ecx, edx
mul ebx
add edx, ecx
mov dword [ebp - 0x34], eax
mov edi, edx
jmp 0x48f636
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
mov edx, edi
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret