joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d2c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.0047bbe4
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047bbfb
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.0047a124
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0047bc96
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x47d45c
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.0047a110
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.0047a124
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x47d416
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.0047bc96
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047bd62
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x47d3d9
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.0047a124
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x47d3a9
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x47d43f
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x47d44d
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x47d429
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x47d345
mov esp, ebp
pop ebp
ret

Function at 0x482c00
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00482e5c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00482e5c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret
Function at 0x482c74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x482ca8
mov edi, ecx
dec edi
test edi, edi
jl 0x482cb9
inc edi
mov eax, esi
call fcn.00482c58
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.00482c00
inc ebx
dec edi
jne 0x482c8f
jmp 0x482cb9
lea eax, [esi + 0x3bc]
push eax
push ecx
push ebx
call fcn.0047a8a4
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x482d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x482dc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00482cc0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00482c58
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00482c00
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x482d90
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482dcd
lea eax, [ebp - 4]
call fcn.00404b60
ret
Function at 0x483b7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483d6b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x483d27
mov eax, dword [ebp - 4]
call fcn.00485408
cmp ebx, eax
jge 0x483d27
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00476a00
mov edx, dword [0x4782c8]
call fcn.00403ee4
mov esi, eax
mov eax, esi
call fcn.004794b4
test al, al
je 0x483d1d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x483bfe
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x483d10
xor eax, eax
push ebp
push 0x483d09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004840e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041b350
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405280
mov eax, dword [ebp - 8]
call fcn.00405050
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00483ef8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483d55
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x483d08
mov eax, dword [ebp - 4]
call fcn.00484164
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00404bb4
jmp 0x483d55
mov eax, dword [ebp - 8]
call fcn.00404b60
jmp 0x483d55
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409534
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4165b4]
call fcn.0040d0d4
call fcn.004045a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483d72
lea eax, [ebp - 0x54]
call fcn.00404b60
ret
Function at 0x48a970
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48aa58
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040de90
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404bf8
lea eax, [ebp - 8]
mov ecx, 0x48aa74
mov edx, dword [ebp - 4]
call fcn.00404e78
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ff0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x48aa3d
mov bl, 1
jmp 0x48aa33
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404dd0
mov eax, dword [ebp - 0xc]
mov edx, 0x48aa84
call fcn.00404f88
je 0x48aa20
mov eax, dword [ebp - 0xc]
mov edx, 0x48aa90
call fcn.00404f88
je 0x48aa20
mov byte [ebp - 0x11], 0
jmp 0x48aa37
lea eax, [ebp - 0x154]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48a9e9
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa5f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b84
ret

Function at 0x48aa94
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48abcb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040de90
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404bf8
lea eax, [ebp - 8]
mov ecx, 0x48abe0
mov edx, dword [ebp - 4]
call fcn.00404e78
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ff0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x48aba8
mov bl, 1
jmp 0x48ab9a
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404dd0
mov eax, dword [ebp - 0xc]
mov edx, 0x48abf0
call fcn.00404f88
je 0x48ab87
mov eax, dword [ebp - 0xc]
mov edx, 0x48abfc
call fcn.00404f88
je 0x48ab87
push dword [ebp - 4]
push 0x48ac08
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ef4
test byte [ebp - 0x154], 0x10
jne 0x48ab75
mov eax, dword [ebp - 0xc]
call fcn.00404ff0
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x48ab87
cmp byte [ebp - 0x11], 0
je 0x48ab87
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0048aa94
lea eax, [ebp - 0x154]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48ab13
push esi
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.00409f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48abd2
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b84
ret
Function at 0x48adac
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
mov eax, dword [ebp - 8]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48af2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040de90
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00404bf8
lea eax, [ebp - 0xc]
mov ecx, 0x48af40
mov edx, dword [ebp - 4]
call fcn.00404e78
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ff0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x48aeff
mov bl, 1
jmp 0x48aef1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00404dd0
mov eax, dword [ebp - 0x10]
mov edx, 0x48af50
call fcn.00404f88
je 0x48aede
mov eax, dword [ebp - 0x10]
mov edx, 0x48af5c
call fcn.00404f88
je 0x48aede
test byte [ebp - 0x158], 0x10
jne 0x48aede
push dword [ebp - 4]
push 0x48af68
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ef4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0048ad00
lea edx, [ebp - 0x15c]
mov eax, dword [ebp - 0x14]
call fcn.00408c14
mov eax, dword [ebp - 0x15c]
push eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.00408c14
mov edx, dword [ebp - 0x160]
pop eax
call fcn.00404f88
jne 0x48aede
mov eax, dword [ebp - 0x10]
call fcn.00404ff0
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x158]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48ae42
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48af31
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.00404b84
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404b84
ret
Function at 0x48af6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor ebx, ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
mov eax, dword [ebp - 8]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48b124
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x498298]
call fcn.004899b0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x48b134
call fcn.0040664c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x48b144
call fcn.0040664c
mov eax, dword [ebp - 4]
call fcn.00404ff0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.00409c10
mov eax, dword [ebp - 0x12c]
call fcn.00404ff0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00405490
push dword [ebp - 0x1c]
push 0x48b158
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 8]
call fcn.004054a8
push dword [ebp - 0x130]
push 0x48b160
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004054d4
cmp byte [ebp + 8], 0
je 0x48b0b4
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 0x1c]
call fcn.00404de8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0xc]
call fcn.00409c10
mov eax, dword [ebp - 0xc]
call fcn.00476130
test al, al
jne 0x48b0b4
mov eax, dword [ebp - 0xc]
call fcn.00476138
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004054b8
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b12b
lea eax, [ebp - 0x134]
call fcn.00404b60
lea eax, [ebp - 0x130]
call fcn.00405340
lea eax, [ebp - 0x12c]
call fcn.00404b60
lea eax, [ebp - 0x1c]
call fcn.00405340
lea eax, [ebp - 0x18]
call fcn.00406608
lea eax, [ebp - 0x14]
call fcn.00406608
lea eax, [ebp - 0x10]
call fcn.00406608
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b84
ret
Function at 0x48b16c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
xor ebx, ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
mov eax, dword [ebp - 8]
call fcn.00404fe0
mov eax, dword [ebp - 0xc]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48b3b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00489974
lea eax, [ebp - 0x1c]
push eax
push 2
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.00405490
push dword [ebp - 0x14]
push 0x48b3c8
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 4]
call fcn.004054a8
push dword [ebp - 0x128]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004054d4
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 0x14]
call fcn.00404de8
mov eax, dword [ebp - 0x12c]
xor edx, edx
call fcn.0048aa94
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.00408f2c
cmp dword [ebp - 0x130], 0
je 0x48b34f
lea eax, [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00489974
lea eax, [ebp - 0x1c]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.00405490
push dword [ebp - 0x14]
push 0x48b3c8
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 8]
call fcn.004054a8
push dword [ebp - 0x134]
push 0x48b3d0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004054d4
lea eax, [ebp - 0x138]
mov edx, dword [ebp - 0x18]
call fcn.00404de8
mov eax, dword [ebp - 0x138]
call fcn.00404ff0
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.00408f2c
cmp dword [ebp - 0x13c], 0
je 0x48b34f
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 0x14]
call fcn.00404de8
mov eax, dword [ebp - 0x140]
mov edx, dword [ebp - 0xc]
call fcn.0048adac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b3bc
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404b84
lea eax, [ebp - 0x134]
call fcn.00405340
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.00404b84
lea eax, [ebp - 0x128]
call fcn.00405340
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405358
lea eax, [ebp - 0x10]
call fcn.00406608
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b84
ret
Function at 0x48b3dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x48b4d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x80
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405280
mov eax, dword [ebp - 4]
call fcn.00404ff0
push eax
push ebx
call sub.kernel32.dll_GetLogicalDriveStringsA
cmp ebx, eax
jge 0x48b435
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405280
mov eax, dword [ebp - 4]
call fcn.00404ff0
push eax
push ebx
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x48b4b7
push 0x1a
mov eax, edi
mov ecx, 1
mov edx, dword [0x48a57c]
call fcn.00405ee4
add esp, 4
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404ff0
mov ebx, eax
jmp 0x48b496
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404d58
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408b8c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040de44
mov edx, dword [ebp - 8]
mov eax, dword [edi]
lea eax, [eax + esi*4]
call fcn.00404bb4
inc esi
mov eax, ebx
call fcn.00409f50
mov ebx, eax
inc ebx
mov eax, ebx
call fcn.00409f20
test eax, eax
ja 0x48b45e
push esi
mov eax, edi
mov ecx, 1
mov edx, dword [0x48a57c]
call fcn.00405ee4
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b4d9
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b84
ret
Function at 0x48b4e0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x438], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48b6ac
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x404], eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x410], eax
xor eax, eax
push ebp
push 0x48b67c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x438]
mov edx, ebx
call fcn.00404d48
mov eax, dword [ebp - 0x438]
lea edx, [ebp - 0x434]
call fcn.00408e90
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x430], eax
mov byte [ebp - 0x42c], 0xb
lea edx, [ebp - 0x430]
xor ecx, ecx
mov eax, 0x48b6c8
call fcn.0040a650
mov eax, dword [ebp - 0x428]
call fcn.00404ff0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0xffffffff
je 0x48b662
xor eax, eax
push ebp
push 0x48b65b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x422]
xor ecx, ecx
mov edx, 0x12
call fcn.00403668
lea eax, [ebp - 0x400]
xor ecx, ecx
mov edx, 0x400
call fcn.00403668
mov dword [ebp - 0x3fc], 0x400
xor eax, eax
mov dword [ebp - 0x422], eax
xor eax, eax
mov dword [ebp - 0x41e], eax
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
push 0x12
lea eax, [ebp - 0x422]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x408]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x48b641
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x404], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b662
mov eax, dword [ebp - 0x408]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b683
mov eax, dword [ebp - 0x410]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x48b6d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
xor eax, eax
push ebp
push 0x48b735
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404ff0
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48b71f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b73c
lea eax, [ebp - 4]
call fcn.00404b60
ret
Function at 0x48d078
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48d202
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x110]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x48d1cc
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x110]
call fcn.0040a160
mov ebx, dword [ebp - 0x114]
lea edx, [ebp - 0xc]
mov dword [ebp - 0x118], ebx
mov eax, dword [ebp - 0x118]
call fcn.0040de44
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404bf8
mov ebx, 1
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebp - 0x120]
mov eax, ebx
call fcn.00409098
mov eax, dword [ebp - 0x120]
mov cl, 0x30
mov edx, 3
call fcn.0048cf88
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 8]
mov edx, 0x48d218
call fcn.00404e78
jmp 0x48d1ac
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e78
mov eax, dword [ebp - 0x124]
xor edx, edx
call fcn.0048aa94
inc ebx
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00409098
mov eax, dword [ebp - 0x12c]
mov cl, 0x30
mov edx, 3
call fcn.0048cf88
mov ecx, dword [ebp - 0x128]
lea eax, [ebp - 8]
mov edx, 0x48d218
call fcn.00404e78
lea eax, [ebp - 0x130]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e78
mov eax, dword [ebp - 0x130]
call fcn.00476130
test al, al
jne 0x48d154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d209
lea eax, [ebp - 0x130]
mov edx, 6
call fcn.00404b84
lea eax, [ebp - 0x114]
call fcn.00404b60
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b84
ret