joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c3d0
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov cl, 1
mov eax, esi
call fcn.0045c314
mov edi, eax
test edi, edi
je 0x45c470
test byte [edi + 0x1c], 0x10
jne 0x45c3f7
mov eax, edi
call fcn.0045b2e4
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
xor edx, edx
mov eax, edi
call fcn.0045b9f8
mov ebx, eax
xor edx, edx
mov eax, edi
call fcn.0045bf84
or bl, al
test bl, bl
je 0x45c41f
mov eax, edi
call fcn.00458020
mov eax, dword [0x56b848]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x45c46c
mov edx, dword [0x56b848]
mov ebx, eax
cmp byte [ebx + 0x287], 2
jne 0x45c46c
cmp edi, dword [ebx + 0x2ac]
jne 0x45c46c
push 0
push 0
push 0x234
mov eax, dword [ebx + 0x36c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x45c46c
mov eax, ebx
call fcn.0046d87c
push eax
call fcn.0040912c
mov bl, 1
jmp 0x45c48f
test byte [esi + 0x1c], 0x10
jne 0x45c48f
mov eax, esi
mov edx, dword [0x456bc4]
call fcn.00404428
test al, al
je 0x45c48f
mov eax, dword [esi + 0x34]
call fcn.0045b2e4
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x45ce18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov word [ebp - 0xa], dx
xor edx, edx
push ebp
push 0x45cf65
push dword fs:[edx]
mov dword fs:[edx], esp
test byte [ebp - 0xa], 0x10
je 0x45ce59
push esi
push eax
call sub.KERNEL32.DLL_GetCommandLineW
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
mov cl, 1
xchg edx, eax
call fcn.0045c314
mov ebx, eax
jmp 0x45ce83
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
mov cl, 1
xchg edx, eax
call fcn.0045c314
mov ebx, eax
test ebx, ebx
je 0x45ce83
mov eax, ebx
call fcn.0045adac
cmp esi, eax
jge 0x45ce83
mov edx, esi
mov eax, ebx
call fcn.0045adbc
mov ebx, eax
test ebx, ebx
je 0x45cf40
cmp dword [ebx + 0x30], 0
je 0x45cf40
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x30]
movzx edx, word [edx]
call fcn.00406170
lea eax, [ebp - 8]
movzx edx, word [ebp + 8]
call fcn.00406170
mov eax, dword [ebp - 4]
test eax, eax
je 0x45cecc
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x45cecc
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405608
mov esi, eax
test esi, esi
je 0x45ced7
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45cef4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x45cef4
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00405608
mov edi, eax
test edi, edi
je 0x45ceff
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.00406080
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00406080
push eax
push 1
push 0x400
call fcn.00408a18
sub eax, 2
test eax, eax
jne 0x45cf3a
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x30]
call fcn.0045de60
cmp dword [ebp - 0x10], 0
sete al
jmp 0x45cf3c
xor eax, eax
mov ebx, eax
jmp 0x45cf42
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cf6c
lea eax, [ebp - 0x10]
call fcn.00405fe4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405fec
ret
Function at 0x461b54
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004091f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x461bfb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, ebx
mov ecx, 2
mov eax, dword [ebp - 8]
call fcn.00438d8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x461bd9
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
mov eax, dword [ebp - 0xc]
push eax
push 0x318
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
mov edx, ebx
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.00438ea8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461be0
or edx, 0xffffffff
mov eax, dword [ebp - 0x10]
call fcn.00438e2c
ret

Function at 0x461e04
Capabilities:
Get system information on windows
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor edi, edi
mov eax, dword [ebx + 8]
test eax, eax
je 0x461e60
dec eax
jne 0x461e23
xor edx, edx
mov eax, ebx
call fcn.00420f3c
mov edi, dword [eax]
jmp 0x461e60
call fcn.00409204
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov esi, eax
jmp 0x461e58
mov ecx, esp
mov edx, esi
mov eax, ebx
call fcn.00461ce8
test al, al
je 0x461e4e
mov eax, dword [ebx + 4]
mov edx, dword [esp]
mov eax, dword [eax + edx*4]
mov edi, dword [eax]
jmp 0x461e58
push 2
push esi
call sub.KERNEL32.DLL_TlsSetValue
mov esi, eax
test edi, edi
jne 0x461e60
test esi, esi
jne 0x461e32
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x462438
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.00462878
mov ebx, eax
mov dword [ebp - 0x14], ebx
push 4
push ebx
call sub.KERNEL32.DLL_TlsSetValue
mov edx, dword [0x56b848]
mov edx, dword [edx]
cmp eax, dword [edx + 0x170]
je 0x462496
mov eax, dword [ebp - 0x14]
call fcn.004616e4
mov ebx, eax
test ebx, ebx
je 0x4625c6
jmp 0x462485
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
jne 0x462483
mov eax, ebx
call fcn.0046d87c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4625c6
mov ebx, esi
jmp 0x4624a6
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
jne 0x4624a4
mov eax, ebx
call fcn.0046d87c
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, dword [ebp - 0x14]
je 0x4625c6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x4624eb
mov edx, dword [ebp + 8]
mov ebx, eax
jmp 0x4624d8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
jne 0x4624d6
mov eax, ebx
call fcn.0046d87c
mov dword [ebp - 0x1c], eax
jmp 0x462515
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [0x46004c]
call fcn.00404428
test al, al
je 0x462510
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0046d87c
mov dword [ebp - 0x1c], eax
jmp 0x462515
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 8]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x1c]
push eax
push 0x4623d8
call fcn.00408b30
push eax
call fcn.00409184
cmp byte [ebp - 8], 0
je 0x4625c6
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CompareStringW
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
mov eax, dword [ebp + 8]
dec eax
push eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, esi
mov si, 0xffbc
call fcn.00404498
mov eax, dword [0x571148]
mov edx, dword [0x45e544]
call fcn.00404428
test al, al
je 0x4625b0
mov eax, dword [0x571148]
mov eax, dword [eax + 0x40]
cmp dword [eax + 0x90], 0
je 0x4625b0
mov eax, dword [0x571148]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x90]
call fcn.0046d87c
cmp eax, dword [ebp - 0x14]
je 0x4625c6
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x2c]
call fcn.00408854
test al, al
je 0x4625c6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4627c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], ecx
xor ecx, ecx
test eax, eax
je 0x46280c
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp byte [0x571164], 2
sete cl
mov byte [ebp - 8], cl
lea ecx, [ebp - 0x18]
push ecx
and edx, 0x7f
push edx
push 0xb02f
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
mov ecx, eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46540c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov byte [ebp - 0x15], cl
mov ebx, edx
mov dword [ebp - 4], eax
test bl, bl
jne 0x46543a
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
je 0x46549a
mov eax, dword [ebp - 4]
test byte [eax + 0x55], 8
jne 0x46549a
mov eax, dword [ebp - 4]
test byte [eax + 0x51], 4
jne 0x46549a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x30], 0
je 0x46549a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0046dc28
test al, al
je 0x46549a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004647f0
cmp byte [ebp - 0x15], 0
jne 0x46547a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
test byte [eax + 0x50], 0x40
jne 0x46547a
push ebp
call fcn.00465384
pop ecx
test al, al
je 0x46547e
xor eax, eax
jmp 0x465480
mov al, 1
neg al
sbb eax, eax
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_DeleteFileW
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46abb4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x24c], 0
je 0x46acac
mov edi, dword [ebx]
cmp edi, 0x7b
jne 0x46abf4
cmp dword [esi + 0x30], 0
je 0x46abf4
mov eax, dword [ebx + 8]
push eax
mov ecx, dword [ebx + 4]
mov edx, edi
mov eax, dword [esi + 0x30]
call fcn.0046628c
mov ebp, eax
mov dword [ebx + 0xc], ebp
test ebp, ebp
jne 0x46acb5
mov edi, dword [ebx]
mov eax, edi
add eax, 0xfffffece
sub eax, 7
jb 0x46ac0e
add eax, 0xffff4407
sub eax, 7
jb 0x46ac28
jmp 0x46ac67
mov ebp, dword [ebx + 8]
push ebp
mov eax, dword [ebx + 4]
push eax
add edi, 0xbc00
push edi
push ebp
call sub.KERNEL32.DLL_GetVolumeInformationW
mov dword [ebx + 0xc], eax
jmp 0x46ac93
mov eax, dword [esi + 0x64]
mov eax, dword [eax + 0x18]
call fcn.0042f380
push eax
mov eax, dword [ebx + 4]
push eax
call sub.gdi32.dll_SetTextColor
mov eax, dword [esi + 0x1b8]
call fcn.00430370
call fcn.0042f380
push eax
mov eax, dword [ebx + 4]
push eax
call sub.gdi32.dll_SetBkColor
mov eax, dword [esi + 0x1b8]
call fcn.004303cc
mov dword [ebx + 0xc], eax
jmp 0x46ac93
cmp edi, dword [0x571140]
jne 0x46ac74
mov dword [ebx + 0xc], esi
jmp 0x46ac93
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
push edi
mov eax, dword [esi + 0x24c]
push eax
mov eax, dword [esi + 0x248]
push eax
call fcn.0040904c
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
cmp eax, 0xc
jne 0x46acb5
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00464af0
jmp 0x46acb5
mov edx, ebx
mov eax, esi
call fcn.0046669c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46d190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp esi, dword [ebx + 0x40]
jne 0x46d1bd
cmp edi, dword [ebx + 0x44]
jne 0x46d1bd
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebx + 0x48]
jne 0x46d1bd
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x4c]
je 0x46d261
mov eax, ebx
call fcn.0046dc28
test al, al
je 0x46d1f4
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_FormatMessageW
test eax, eax
jne 0x46d1f4
push 0x14
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
push 0
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x46d24c
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], edi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x4c], eax
mov eax, ebx
call fcn.0046dc28
test al, al
je 0x46d24c
mov dword [ebp - 0x2c], 0x2c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x3c]
mov eax, ebx
call fcn.004647f0
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_ReadFile
mov eax, ebx
call fcn.004643e0
mov eax, ebx
call fcn.00467df4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x58]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46d780
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov edx, esp
mov eax, ebx
call fcn.004647f0
push 1
push 1
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileW
push 0xffffffffffffffff
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x24c]
push eax
call sub.KERNEL32.DLL_DeleteFileW
add esp, 0x10
pop ebx
ret

Function at 0x472f1c
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, eax
sub edx, 1
jb 0x472f2b
sub edx, 0x67
je 0x472f4a
jmp 0x472f7b
mov eax, ebx
call fcn.00472e58
cmp byte [ebx + 0xd], 0
jne 0x472f41
mov eax, ebx
call fcn.00472ea4
jmp 0x472f7b
mov eax, ebx
call fcn.00472e74
pop ebx
ret
cmp byte [ebx + 0x20], 0
je 0x472f7b
cmp byte [ebx + 0xd], 0
je 0x472f67
push 0
lea eax, [ebx + 0x10]
push eax
push 0
push 0x68
call sub.KERNEL32.DLL_SetLastError
jmp 0x472f7b
push 0
push 0
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
mov dword [ebx + 0x10], eax
pop ebx
ret
Function at 0x473468
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4735f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call fcn.00408b20
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47360c
call fcn.0040dfd0
mov edx, dword [ebp - 4]
mov eax, 0x571138
call fcn.00405ff4
mov eax, dword [0x571138]
call fcn.00406080
push eax
call fcn.00408c64
mov word [0x571134], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x56eb20]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call fcn.00408b30
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x473630
call fcn.0040dfd0
mov edx, dword [ebp - 0x10]
mov eax, 0x57113c
call fcn.00405ff4
mov eax, dword [0x57113c]
call fcn.00406080
push eax
call fcn.00408c64
mov word [0x571136], ax
mov eax, dword [0x57113c]
call fcn.00406080
push eax
call sub.KERNEL32.DLL_GetTempPathW
mov dword [0x571140], eax
mov dl, 1
mov eax, dword [0x41e5f0]
call fcn.0042123c
mov dword [0x571178], eax
call fcn.00472f80
mov dl, 1
mov eax, dword [0x460df8]
call fcn.00472d18
mov dword [0x571120], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47a764]
call fcn.0048324c
mov edx, dword [0x56bb44]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47a880]
call fcn.0048460c
mov edx, dword [0x56b848]
mov dword [edx], eax
mov eax, dword [0x56b848]
mov eax, dword [eax]
mov dl, 1
call fcn.00486ba4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45f750]
call fcn.00463cd0
mov dword [0x57117c], eax
push 0x473658
call fcn.00408b88
mov ebx, eax
mov ecx, 0x461a54
mov edx, 0x461a64
mov eax, dword [0x45e1fc]
call fcn.00420924
test ebx, ebx
je 0x4735d5
push 0x473668
push ebx
call fcn.00408b98
mov dword [0x568ad0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4735fa
lea eax, [ebp - 0x10]
call fcn.00405fe4
lea eax, [ebp - 4]
call fcn.00405fe4
ret
Function at 0x47e374
Capabilities:
Get disk information

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov edi, eax
cmp dl, byte [edi + 0x281]
je 0x47e50b
mov byte [edi + 0x281], dl
cmp byte [edi + 0x268], 0
je 0x47e3a5
movzx eax, byte [edi + 0x281]
sub al, 2
je 0x47e3a9
sub al, 3
je 0x47e3a9
xor edx, edx
jmp 0x47e3ab
mov dl, 1
mov eax, edi
call fcn.0047be98
mov eax, edi
call fcn.0046dc28
test al, al
je 0x47e50b
test byte [edi + 0x1c], 0x10
je 0x47e3db
test byte [edi + 0x1c], 0x10
je 0x47e50b
cmp dword [edi + 0x30], 0
je 0x47e50b
push 0xfffffffffffffff0
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GetACP
mov dword [esp], eax
push 0xffffffffffffffec
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GetACP
mov dword [esp + 4], eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.0046d87c
push eax
call fcn.004091cc
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, edi
mov si, 0xffa9
call fcn.00404498
lea ecx, [esp + 4]
mov edx, esp
mov eax, edi
mov si, 0xffaa
call fcn.00404498
mov eax, dword [esp]
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_RaiseException
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffec
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_RaiseException
mov eax, dword [esp + 8]
push eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GlobalDeleteAtom
mov eax, edi
call fcn.0046dc28
test al, al
je 0x47e4e8
mov eax, dword [0x56b634]
cmp byte [eax], 0
je 0x47e4c9
cmp byte [edi + 0x281], 3
je 0x47e4b3
mov eax, edi
call fcn.0048042c
push eax
push 1
push 0x80
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
jmp 0x47e4c9
push 0
push 1
push 0x80
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
push 0xffffffffffffffff
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_lstrcpynW
push 0
xor ecx, ecx
mov edx, 0x81
mov eax, edi
call fcn.0046628c
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_ResetEvent
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x80]
add esp, 0xc
pop edi
pop esi
ret

Function at 0x47e5b0
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
cmp byte [ebx + 0x287], 2
jne 0x47e5e1
cmp dword [ebx + 0x36c], 0
je 0x47e5e1
push 0
push 0
push 0x229
mov eax, dword [ebx + 0x36c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
call fcn.004616e4
pop ebx
ret
Function at 0x47e908
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
cmp byte [ebp + 0x287], 2
jne 0x47e97c
cmp dword [ebp + 0x36c], 0
je 0x47e97c
xor esi, esi
mov eax, dword [ebp + 0x2a0]
test eax, eax
je 0x47e933
mov edx, dword [eax]
call dword [edx + 0x34]
mov esi, eax
xor edi, edi
mov eax, dword [ebp + 0x2ac]
test eax, eax
je 0x47e946
call fcn.00458154
mov edi, eax
mov eax, ebp
call fcn.0046d87c
push eax
call fcn.00409264
cmp esi, eax
setne bl
push edi
push esi
push 0x230
mov eax, dword [ebp + 0x36c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
test bl, bl
je 0x47e97c
mov eax, ebp
call fcn.0046d87c
push eax
call fcn.0040912c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x482980
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.00439dbc
test al, al
je 0x482a59
mov eax, ebx
call fcn.0046dc28
test al, al
je 0x482a59
mov eax, dword [ebx + 0x364]
cmp byte [eax + 8], 0
je 0x482a07
cmp byte [eax + 0x28], 0
jne 0x4829d1
mov edx, dword [eax + 0xc]
mov dword [esp], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 4], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
jmp 0x4829f0
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
test byte [ebx + 0x1c], 0x10
jne 0x482a26
movzx eax, word [0x482a88]
or ax, word [ebx + 0x54]
mov word [ebx + 0x54], ax
jmp 0x482a26
movzx eax, word [0x482a88]
not eax
and ax, word [ebx + 0x54]
mov word [ebx + 0x54], ax
mov eax, esp
xor ecx, ecx
mov edx, 0x10
call fcn.00403a0c
test byte [ebx + 0x1c], 0x10
je 0x482a3f
push 0xffffffffffffffff
push 0
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_DeleteFileW
jmp 0x482a81
mov eax, ebx
call fcn.0046d87c
mov edx, esp
call fcn.00439c44
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x80]
jmp 0x482a81
movzx eax, word [0x482a88]
not eax
and ax, word [ebx + 0x54]
mov word [ebx + 0x54], ax
test byte [ebx + 0x1c], 0x10
je 0x482a81
push 0xffffffffffffffff
push 0
mov eax, ebx
call fcn.0046d87c
push eax
call sub.KERNEL32.DLL_DeleteFileW
add esp, 0x10
pop ebx
ret

Function at 0x483adc
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp si, word [ebx + 0x44]
je 0x483b65
mov word [ebx + 0x44], si
test si, si
jne 0x483b55
push esp
call fcn.004091ec
push dword [esp + 4]
push dword [esp + 4]
call sub.KERNEL32.DLL_WaitForMultipleObjectsEx
mov edi, eax
test edi, edi
je 0x483b55
push 0
push edi
call sub.KERNEL32.DLL_CreateEventW
mov ebp, eax
call fcn.00408b30
cmp ebp, eax
jne 0x483b55
mov eax, dword [esp]
and eax, 0xffff
mov edx, dword [esp + 4]
shl edx, 0x10
or eax, edx
push eax
push 0
push 0x84
push edi
call sub.KERNEL32.DLL_GetVolumeInformationW
movzx eax, ax
or eax, 0x2000000
push eax
push edi
push 0x20
push edi
call sub.KERNEL32.DLL_GetVolumeInformationW
jmp 0x483b68
movsx edx, si
mov eax, ebx
call fcn.00483ab0
push eax
call sub.KERNEL32.DLL_GlobalFree
inc dword [ebx + 0x48]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48460c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x484623
add esp, 0xfffffff0
call fcn.004046d8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00429020
mov eax, dword [0x56b1f0]
cmp byte [eax], 0
jne 0x484650
push 0
call fcn.00409b18
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x56b6d8]
cmp word [eax + 2], 0
jne 0x48466a
mov eax, dword [0x56b6d8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00486558
mov eax, dword [0x56b890]
cmp word [eax + 2], 0
jne 0x484684
mov eax, dword [0x56b890]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00486768
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x42d994]
call fcn.0042f81c
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x486bfc
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x42e5f4]
call fcn.00437518
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x484860
mov eax, dword [0x56b4e0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov edx, eax
mov eax, esi
call fcn.0043791c
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x486eac
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [ebx + 0x94], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x56b4e0]
mov eax, dword [eax]
push eax
call fcn.00408b80
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040d950
test eax, eax
je 0x484792
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040d678
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040d938
test eax, eax
je 0x4847aa
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.00409064
push eax
call fcn.00409054
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00406204
push ebx
push 0x485f6c
call fcn.0047ae48
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x56b1f0]
cmp byte [eax], 0
jne 0x4847fb
mov eax, ebx
call fcn.004849d4
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.004870d4
mov eax, ebx
call fcn.00487c98
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x484858
call fcn.00404730
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret