joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407eb8
Capabilities:
Get number of processors

Disassembly:
or byte [0x6f725054], cl
arpl word [ebp + 0x73], sp
jae 0x407ed0
jbe 0x407ef2
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x407e90
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407ea1
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 8], si
add byte [eax], cl
push eax
outsd dx, dword [esi]
jae 0x407f10
je 0x407f12
outsd dx, dword [esi]
outsb dx, byte [esi]
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f15
jb sym.DnPatch.exe__Cpatches_Finalization_qqrv
mov eax, 0x800407e
andps xmm2, xmmword [eax + 0x72]
outsd dx, dword [esi]
arpl word [ebx + 0x74], dx
popal
jb 0x407f38
inc ebp
jbe 0x407f2c
outsb dx, byte [esi]
je 0x407eca
add ecx, dword [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407edb
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 6], si
add byte [esi], al
dec ebp
imul ebp, dword [esi + 0x56], 0x49076c61
outsb dx, byte [esi]
je 0x407f4d
jb 0x407eec
push es
dec ebp
popal
js 0x407f47
popal
insb byte es:[edi], dx
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f5d
jb 0x407e8c
add byte [edi + 0x40], bh
add byte [eax], cl
or byte [eax], dl
push esp
push eax
jb 0x407f75
arpl word [ebp + 0x73], sp
jae 0x407f74
outsb dx, byte [esi]
inc ebp
jbe 0x407f75
outsb dx, byte [esi]
je 0x407f13
add byte [ebx], al
or byte [esi], al
add ecx, dword [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407f24
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 8], si
add byte [eax], cl
push eax
outsd dx, dword [esi]
jae 0x407f93
je 0x407f95
outsd dx, dword [esi]
outsb dx, byte [esi]
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f98
jb 0x407f37
add edx, dword [ebx + 0x74]
jb 0x407f42
push ebx
je 0x407fad
push es
push ebx
je 0x407fb1
imul ebp, dword [esi + 0x67], 0x8b559090
in al, dx
nop
nop
popfd
xchg esp, eax
invalid
push es
add byte [ebx - 0x751707bb], cl
into
push es
add byte [ebp - 0x1677b], cl
dec dword [ebx + 0x4611a015]
add al, ch
add esp, edx
push es
add byte [ebx], dh
rcl byte [ebp + 0x68], 0xc0
add byte [eax], 0x64
rol byte [eax - 0x9bffc0], 0x30
inc eax
add byte [edi + edi*8 + 0x30], ah
push dword [eax]
int3
test dword [esi + edi*8 - 0x72720001], edx
cwde
invalid
Function at 0x407f00
Capabilities:
Get number of processors

Disassembly:
or byte [0x6f725054], cl
arpl word [ebp + 0x73], sp
jae 0x407ed0
jbe 0x407ef2
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x407e90
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407ea1
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 8], si
add byte [eax], cl
push eax
outsd dx, dword [esi]
jae 0x407f10
je 0x407f12
outsd dx, dword [esi]
outsb dx, byte [esi]
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f15
jb sym.DnPatch.exe__Cpatches_Finalization_qqrv
mov eax, 0x800407e
andps xmm2, xmmword [eax + 0x72]
outsd dx, dword [esi]
arpl word [ebx + 0x74], dx
popal
jb 0x407f38
inc ebp
jbe 0x407f2c
outsb dx, byte [esi]
je 0x407eca
add ecx, dword [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407edb
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 6], si
add byte [esi], al
dec ebp
imul ebp, dword [esi + 0x56], 0x49076c61
outsb dx, byte [esi]
je 0x407f4d
jb 0x407eec
push es
dec ebp
popal
js 0x407f47
popal
insb byte es:[edi], dx
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f5d
jb 0x407e8c
add byte [edi + 0x40], bh
add byte [eax], cl
or byte [eax], dl
push esp
push eax
jb 0x407f75
arpl word [ebp + 0x73], sp
jae 0x407f74
outsb dx, byte [esi]
inc ebp
jbe 0x407f75
outsb dx, byte [esi]
je 0x407f13
add byte [ebx], al
or byte [esi], al
add ecx, dword [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x407f24
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 8], si
add byte [eax], cl
push eax
outsd dx, dword [esi]
jae 0x407f93
je 0x407f95
outsd dx, dword [esi]
outsb dx, byte [esi]
pop es
dec ecx
outsb dx, byte [esi]
je 0x407f98
jb 0x407f37
add edx, dword [ebx + 0x74]
jb 0x407f42
push ebx
je 0x407fad
push es
push ebx
je 0x407fb1
imul ebp, dword [esi + 0x67], 0x8b559090
in al, dx
nop
nop
popfd
xchg esp, eax
invalid
push es
add byte [ebx - 0x751707bb], cl
into
push es
add byte [ebp - 0x1677b], cl
dec dword [ebx + 0x4611a015]
add al, ch
add esp, edx
push es
add byte [ebx], dh
rcl byte [ebp + 0x68], 0xc0
add byte [eax], 0x64
rol byte [eax - 0x9bffc0], 0x30
inc eax
add byte [edi + edi*8 + 0x30], ah
push dword [eax]
int3
test dword [esi + edi*8 - 0x72720001], edx
cwde
invalid
Function at 0x40822c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00474e08
mov eax, dword [ebp - 8]
call fcn.00474e08
xor eax, eax
push ebp
push 0x408327
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00462c58
mov eax, dword [ebp - 0x14]
call fcn.0044e1b8
mov eax, dword [ebp - 4]
call fcn.00462818
test al, al
je 0x40828b
mov eax, dword [ebp - 8]
call fcn.00462b08
mov eax, dword [ebp - 8]
call fcn.00474e18
push eax
mov eax, dword [ebp - 4]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00462c58
lea eax, [ebp - 0x18]
mov ecx, 0x408340
mov edx, dword [ebp - 0x14]
call fcn.00474c6c
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00461fd0
test eax, eax
jne 0x4082ff
xor eax, eax
push ebp
push 0x4082f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00462f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4082ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40832e
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0047498c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0047498c
ret
Function at 0x409494
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4095ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x4094cc
mov ecx, 4
mov edx, 0x409604
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov byte [eax + 4], 1
push 0
push 0xa7
push 3
push 0
push 0
push SysReAllocStringLen
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0xffffffff
jne 0x409528
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
mov edx, 0x40961c
call fcn.00474c6c
mov edx, dword [ebp - 8]
mov ecx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x409573
mov ecx, 2
mov edx, 0x409634
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x4095a8
mov ecx, 3
mov edx, 0x40964c
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
sub eax, 0x20
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0x20
setl al
mov edx, dword [ebp - 4]
mov byte [edx + 0x1c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095f6
lea eax, [ebp - 8]
call fcn.00474968
ret
Function at 0x413524
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x413616
push str.AppGetTimeAdjusted
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x12c], eax
push str.AppSetTimeAdjusted
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x130], eax
push str.AppGetBaseTime
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x134], eax
push str.AppSetBaseTime
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x138], eax
push str.AppGetTimeDiff
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x13c], eax
push str.AppSetTimeDiff
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x140], eax
push str.AppGetBaseTicks
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x144], eax
push str.AppSetBaseTicks
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x148], eax
push str.AppGetCommTicks
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x14c], eax
push str.AppSetCommTicks
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x150], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x12c], 0
setne al
and eax, 1
pop ecx
pop ecx
pop ebp
ret
Function at 0x420acc
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x420b02
xor eax, eax
jmp 0x420be2
lea edx, [ebp - 8]
push 0
push edx
lea ecx, [ebp - 0xc]
push 4
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x420b21
cmp dword [ebp - 8], 4
je 0x420b31
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x420be2
cmp dword [ebp + 0x10], 0
jne 0x420b3f
mov eax, dword [ebp - 0xc]
jmp 0x420be2
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x5ec]
push eax
call fcn.004d29b4
pop ecx
mov dword [ebp - 0x10], eax
push 0
lea edx, [ebp - 8]
push edx
mov ecx, dword [esi + 0x5ec]
push ecx
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x420bca
mov ecx, dword [esi + 0x5ec]
cmp ecx, dword [ebp - 8]
jne 0x420bca
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
push edx
push esi
call fcn.00420f60
add esp, 0xc
mov ecx, dword [esi + 0x5ec]
cmp ecx, dword [ebp - 0xc]
jae 0x420b9f
mov eax, dword [esi + 0x5ec]
jmp 0x420ba2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, ecx
cmp edx, dword [ebp - 8]
jae 0x420bc2
mov cl, byte [eax]
xor cl, byte [ebp + 0x14]
not cl
mov byte [ebx], cl
inc ebx
inc edx
inc eax
cmp edx, dword [ebp - 8]
jb 0x420bb1
mov edx, dword [ebp - 8]
sub dword [ebp - 0xc], edx
jmp 0x420b52
mov eax, dword [ebp - 0x10]
push eax
call fcn.004d27ec
pop ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4271ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00474e08
mov eax, dword [ebp - 0xc]
call fcn.00474e08
xor eax, eax
push ebp
push 0x427387
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x42723d
lea eax, [ebp - 8]
mov edx, 0x4273a0
call fcn.00474a00
cmp dword [ebp - 0xc], 0
jne 0x427250
lea eax, [ebp - 0xc]
mov edx, 0x4273ac
call fcn.00474a00
xor eax, eax
push ebp
push 0x427358
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
call fcn.00474c20
test eax, eax
jne 0x42729b
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.KERNEL32.DLL_GetTempPathA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
call fcn.00472af8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetTempPathA
jmp 0x4272fa
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1e4]
mov eax, dword [ebp - 4]
call sym.DnPatch.exe__Zipmstr_TZipMaster_AppendSlash_qqr17System_AnsiString
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x1e4
call fcn.004749bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
call fcn.00474c20
add eax, 0xd
call fcn.00472af8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
call fcn.00474c20
mov ecx, eax
inc ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1e4]
mov eax, dword [ebp - 0x10]
call fcn.00463044
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00474e18
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x427342
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.00474b58
mov eax, dword [ebp - 0x1c]
call fcn.00462b08
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00474b58
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00462bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42735f
mov eax, dword [ebp - 0x10]
call fcn.00472b18
ret
Function at 0x4292d4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
push 0x4293c0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42934f
push 0x4293cc
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x429346
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
call fcn.00474e18
push eax
call dword [ebp - 0xc]
test eax, eax
je 0x429346
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [ebp - 0x20], 0xffffffff
jne 0x429395
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x429395
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
imul dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
imul dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
test byte [ebp - 8], 1
je 0x4293a7
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x184], eax
test byte [ebp - 8], 2
je 0x4293b9
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov dword [edx + 0x17c], eax
mov esp, ebp
pop ebp
ret
Function at 0x4293e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x429590
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0xff
mov dword [ebp - 0x18], 0xff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x17c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x180], edx
mov eax, dword [ebp - 4]
add eax, 0x178
call fcn.00474968
mov byte [ebp - 5], 0
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
call fcn.00461f08
mov eax, dword [ebp - 0x128]
mov al, byte [eax]
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0x5c
je 0x4294c9
cmp byte [ebp - 0x21], 0x41
jb 0x429468
cmp byte [ebp - 0x21], 0x5a
jbe 0x429488
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
push eax
mov ecx, 0x2afb
mov dl, 1
mov eax, dword [sym.DnPatch.exe__Zipmstr_EZipMaster_]
call sym.DnPatch.exe__Zipmstr_EZipMaster__bctr_qqrxix17System_AnsiString
call fcn.004743e4
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 0x20], eax
xor eax, eax
mov al, byte [ebp - 0x21]
sub eax, 0x41
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x1f
ja 0x4294a7
bt dword [ebp - 0x20], eax
jb 0x4294c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
push eax
mov ecx, 0x2afc
mov dl, 1
mov eax, dword [sym.DnPatch.exe__Zipmstr_EZipMaster_]
call sym.DnPatch.exe__Zipmstr_EZipMaster__bctr_qqrxix17System_AnsiString
call fcn.004743e4
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x10], eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
add eax, 0x188
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18c]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
jne 0x42952d
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x1f
jne 0x429522
mov eax, dword [ebp - 4]
test byte [eax + 0x50], 0x40
je 0x429522
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x429577
mov eax, dword [ebp - 4]
add eax, 0x178
lea edx, [ebp - 0x121]
mov ecx, 0x100
call fcn.00474bd0
mov edx, 3
mov eax, dword [ebp - 4]
call sym.DnPatch.exe__Zipmstr_TZipMaster_DiskFreeAndSize_qqri
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_SetErrorMode
cmp byte [ebp - 0x21], 0x5c
je 0x429573
cmp byte [ebp - 0x21], 0x5c
je 0x429577
mov eax, dword [ebp - 4]
cmp dword [eax + 0x17c], 0xffffffff
je 0x429577
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429597
lea eax, [ebp - 0x128]
call fcn.00474968
ret
Function at 0x4369fc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00474e18
push eax
mov eax, dword [ebp - 4]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x436a34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x436aa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00474fa4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00474e18
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00474c20
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00474fa4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call sym.DnPatch.exe__Idglobal_IncludeTrailingSlash_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436ab0
lea eax, [ebp - 0xc]
call fcn.00474968
ret

Function at 0x436ab4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x436b5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x105
call fcn.00474fa4
cmp dword [ebp - 4], 0
jbe 0x436b13
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00474e18
push eax
push 0
push 0x436b6c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call sym.DnPatch.exe__Idglobal_IncludeTrailingSlash_qqrx17System_AnsiString
mov eax, dword [ebp - 0xc]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
jmp 0x436b35
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00474e18
push eax
push 0
push 0x436b6c
mov eax, dword [0x5031cc]
call fcn.00474e18
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00474e18
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00474b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436b66
lea eax, [ebp - 0xc]
call fcn.00474968
ret
Function at 0x43a1ac
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x10
call fcn.00474fa4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00474c20
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00474e70
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x43a1f0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00474fa4
pop ecx
pop ecx
pop ebp
ret
Function at 0x44b048
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
test dl, dl
je 0x44b066
add esp, 0xfffffff0
call fcn.00473f7c
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b126
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00454c60
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0x20
mov eax, dword [ebp - 4]
mov byte [eax + 0x19], 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004623fc
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00473b68
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x14]
call fcn.00474bc4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x1c
pop ecx
call fcn.00474c6c
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0x20
mov eax, dword [ebp - 4]
mov byte [eax + 0x29], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [sym.DnPatch.exe__Idrfcreply_TIdRFCReply_]
call sym.DnPatch.exe__Idrfcreply_TIdRFCReply__bctr_qqrp19Classes_TCollection
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov dl, 1
mov eax, dword [0x452014]
call fcn.00473be8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b12d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0047498c
ret