joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100052c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl

Function at 0x10005320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aad 0xc6
inc ebp
salc
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004eb8
push eax
push esi
push dword [ebp + 8]
call fcn.10004e6d
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10004ea8
inc eax
jns 0x100052cd
adc ecx, dword [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid

Function at 0x10005542
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1000555c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10005557
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10005541
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10005549
cmp edx, ebx
jne 0x10005697
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10005518
add eax, dword [eax + 4]
jmp 0x10005505
mov dword [ebp + 0xc], ebx
jmp 0x10005567
Function at 0x100055b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000557f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000559d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100055fb
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100055e2
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100055eb
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100055f5
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100055d7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10005561
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10005648
dec eax
je 0x1000563f
sub eax, 3
je 0x10005636
mov dword [ebp - 4], 0x40
jmp 0x10005665
mov dword [ebp - 4], 4
jmp 0x1000564b
mov dword [ebp - 4], 0x20
jmp 0x1000564b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10005697
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10005617
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10004ea8
cld
lcall 0x6a14, 0x75ff16d3
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x100056a3

Function at 0x10005738
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10004eb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004e6d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
invalid
invalid
inc ebp

Function at 0x10005957
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edx
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
Function at 0x100059ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.10004eb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004e6d
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.10004eb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004e6d
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10004ea8
or dword [edi - 0x5a7f2305], 0xfffffaec
add byte [eax - 0x5125b], al
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.10004eb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004e6d
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10004ea8
int3

Function at 0x10007a71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000de58]
jne 0x10007a7b
repz ret
jmp fcn.10008c52
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403203
pop dword [ebp - 0x18]
mov eax, 0x403203
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x464e079
add dword [ebp - 0x28], 0x49ed64d2
mov dword [ebp - 0x24], 0xc000f45a
sub dword [ebp - 0x24], 0x8dcda815
mov dword [ebp - 0x20], 0x9a2707c5
sub dword [ebp - 0x20], 0x4ddac397
mov dword [ebp - 0x1c], 0x91d1f6fa
add dword [ebp - 0x1c], 0x6e2e0906
lea eax, [ebp - 0x28]
push eax
mov eax, 0xc5f3a631
sub eax, 0xc5b325a5
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x74009606
add dword [ebp - 0x28], 0x71d350
mov dword [ebp - 0x24], 0xb4cc9a8d
add dword [ebp - 0x24], 0x8c9fc6e8
mov dword [ebp - 0x20], 0xc43d802a
add dword [ebp - 0x20], 0x9f31ec42
mov dword [ebp - 0x1c], 0xb98f0c88
add dword [ebp - 0x1c], 0x4670f378
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xe55fa621
add eax, 0x1ae0dab3
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37321
push 0
call eax
mov ecx, 0xaede217d
add ecx, 0x512228eb
xor esi, esi
add esi, eax
mov edx, 0x6f8dd12
sub edx, 0x6b7cd12
add edx, dword [ebp - 0x18]
mov edi, 0x809cb8a6
sub edi, 0xf1d08e17
xor dword [ebp - 0xc], 0x3657f6de
mov ebx, dword [edx]
add dword [ebp - 0xc], ebx
sub ebx, edi
sub dword [ebp - 0x14], 0x65e2b88
mov dword [esi], ebx
mov dword [ebp - 0x14], 0xa168c999
add esi, 0xf3c56162
add esi, 0xc3a9ea2
add edx, 0x96b7c748
sub edx, 0x96b7c744
loop 0x403322
add eax, 0xeae8a5a
sub eax, 0xead6de7
mov ebx, eax
add eax, 0xb6fba736
add eax, 0x490458cf
mov ecx, 0x7d149b63
add ecx, 0x832b649d
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1001a093
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001a0a2
pop dword [ebp - 0x4c]
mov eax, 0x6fc45e41
add eax, 0xa03d4261
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x40143
push 0
mov eax, 0x8a31821e
add eax, 0x85d1debe
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4663
mov ebx, eax
mov edi, 0x280b3297
add edi, 0xe7f88b69
add edi, dword [ebp - 0x4c]
mov edx, 0x79197bab
add dword [ebp - 0x44], 0xedee592a
mov esi, dword [edi]
sub dword [ebp - 0x14], 0x4ab2c40c
add esi, edx
xor dword [ebp - 4], edx
mov dword [ebx], esi
sub dword [ebp - 0x10], eax
add ebx, 4
add edi, 0x55158fc8
add edi, 0xaaea703c
loop 0x1001a0f5
add eax, 0x10c5f
mov ebx, eax
add eax, 0x9e78ffd2
sub eax, 0x9e78ffcd
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a093
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a093
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4066b4
Capabilities:
Create process on windows

Disassembly:
mov cl, byte [0x41cb14]
mov eax, dword [0x4197b0]
test cl, cl
jne 0x4066e9
mov edx, dword fs:[0x2c]
mov eax, dword [edx + eax*4]
ret
call fcn.00406670
mov eax, dword [0x4197b0]
push eax
call sub.KERNEL32.DLL_WinExec
test eax, eax
je 0x4066e3
ret
mov eax, dword [0x41cb1c]
ret
push eax
call sub.KERNEL32.DLL_WinExec
test eax, eax
je 0x4066ce
ret

Function at 0x408288
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408331
test eax, edx
je 0x408334
push 0
push 0
cmp word [eax - 0xa], 2
je 0x4082b1
push edx
mov edx, eax
mov eax, esp
call fcn.00404ff8
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x4082c7
push eax
lea eax, [esp + 8]
call fcn.00404ff8
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4082d6
movzx eax, word [eax]
sub eax, ecx
jmp 0x4082fd
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408317
add ecx, 4
js 0x4082ee
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x408314
push eax
mov eax, ecx
mov edx, 2
call fcn.00404784
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4082fb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4082fd
xor eax, eax
ret
test eax, eax
je 0x408344
test edx, edx
jne 0x408298
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x40a76c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a8d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00404e24
mov eax, dword [ebp + 8]
movzx eax, word [eax - 2]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 6]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40a8f0
call fcn.00404e78
push 0x100
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
call fcn.00404eb0
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
push eax
call sub.KERNEL32.DLL_FindClose
test eax, eax
je 0x40a8b3
mov eax, ebx
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404fdc
dec esi
jne 0x40a8b3
mov eax, dword [0x41cbf8]
sub eax, 4
je 0x40a842
sub eax, 0xd
jne 0x40a8b3
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040d84c
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.00405424
jmp 0x40a8b3
cmp dword [0x41cbfc], 1
jne 0x40a8b3
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x40a862
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
mov edx, esi
call fcn.0040d444
cmp eax, 4
jne 0x40a8b3
mov eax, dword [ebx]
mov edx, 3
call fcn.0040d734
mov esi, eax
add esi, esi
lea eax, [ebp - 0x214]
add esi, eax
sub esi, 2
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00404fa0
mov eax, dword [ebp - 0x21c]
mov edx, 2
call fcn.0040d84c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.00404f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a8db
lea eax, [ebp - 0x21c]
call fcn.00404e14
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x40a8f8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a9e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00404e24
mov eax, dword [ebp + 8]
movzx eax, word [eax - 2]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 6]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40a958
lea eax, [ebp - 4]
mov edx, 0x40aa04
call fcn.00404e78
jmp 0x40a965
lea eax, [ebp - 4]
mov edx, 0x40aa18
call fcn.00404e78
push 0x100
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
call fcn.00404eb0
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
push eax
call sub.KERNEL32.DLL_FindClose
test eax, eax
je 0x40a9d3
mov eax, ebx
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404fdc
dec esi
jne 0x40a9d3
mov eax, dword [ebx]
cmp word [eax], 0x30
jne 0x40a9d3
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x40a9c3
sub esi, 4
mov esi, dword [esi]
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.00405424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a9f0
lea eax, [ebp - 4]
call fcn.00404e14
ret

Function at 0x40bff8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40c10b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov dword [ebp - 4], eax
mov ebx, 1
mov esi, 0x41cb5c
mov edi, 0x41cb8c
push ebp
push 0xb
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4198a0
mov edx, ebx
dec edx
lea eax, [ebx + 0x44]
dec eax
call fcn.0040bfbc
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404e24
push ebp
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4198d0
mov edx, ebx
dec edx
lea eax, [ebx + 0x38]
dec eax
call fcn.0040bfbc
pop ecx
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404e24
inc ebx
add edi, 4
add esi, 4
cmp ebx, 0xd
jne 0x40c02b
mov ebx, 1
mov esi, 0x41cbbc
mov edi, 0x41cbd8
lea eax, [ebx + 5]
mov ecx, 7
cdq
idiv ecx
mov dword [ebp - 8], edx
push ebp
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x419900
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x31
call fcn.0040bfbc
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404e24
push ebp
push 6
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41991c
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x2a
call fcn.0040bfbc
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404e24
inc ebx
add edi, 4
add esi, 4
cmp ebx, 8
jne 0x40c08c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c112
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404e1c
ret
Function at 0x40c1d0
Capabilities:
Get disk size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x40c267
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov ecx, 0x40c280
mov edx, 0x100b
call fcn.0040bf44
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.00408938
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x40c251
push 4
push esi
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
push eax
push 0x40c11c
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, 7
mov eax, 0x41cc20
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x40c232
push 3
push esi
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
push eax
push 0x40c158
call sub.KERNEL32.DLL_GetSystemInfo
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c26e
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x40c284
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e0c
xor eax, eax
push ebp
push 0x40c4b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
xor edx, edx
call fcn.00404e24
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov ecx, 0x40c4d4
mov edx, 0x1009
call fcn.0040bf44
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.00408938
add eax, 0xfffffffd
sub eax, 3
jb 0x40c47f
mov eax, dword [0x41cbf8]
sub eax, 4
je 0x40c302
add eax, 0xfffffff3
sub eax, 2
jb 0x40c302
xor eax, eax
jmp 0x40c304
mov al, 1
test al, al
je 0x40c34b
jmp 0x40c335
mov eax, dword [ebp - 4]
movzx esi, word [eax + ebx*2 - 2]
mov eax, esi
sub ax, 0x47
je 0x40c334
sub ax, 0x20
je 0x40c334
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404f90
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405124
inc ebx
lea eax, [ebp - 4]
call fcn.004048bc
call fcn.00405080
cmp ebx, eax
jle 0x40c30a
jmp 0x40c494
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404e24
jmp 0x40c494
mov esi, dword [ebp - 4]
test esi, esi
je 0x40c379
mov eax, esi
sub eax, 0xa
cmp word [eax], 2
je 0x40c379
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004048ac
mov esi, eax
cmp word [esi + ebx*2 - 2], 0xd800
jb 0x40c3c2
cmp word [esi + ebx*2 - 2], 0xdfff
ja 0x40c3c2
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040d8b4
sar eax, 1
jns 0x40c39c
adc eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405424
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00405124
add ebx, dword [ebp - 8]
jmp 0x40c47f
mov edx, 0x40c4d8
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*2 - 2]
mov ecx, 2
call fcn.0040908c
test eax, eax
jne 0x40c3ee
mov eax, edi
mov edx, 0x40c4ec
call fcn.00405124
inc ebx
jmp 0x40c47e
mov edx, 0x40c4f4
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*2 - 2]
mov ecx, 4
call fcn.0040908c
test eax, eax
jne 0x40c419
mov eax, edi
mov edx, 0x40c50c
call fcn.00405124
add ebx, 3
jmp 0x40c47e
mov edx, 0x40c518
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*2 - 2]
mov ecx, 2
call fcn.0040908c
test eax, eax
jne 0x40c442
mov eax, edi
mov edx, 0x40c52c
call fcn.00405124
inc ebx
jmp 0x40c47e
mov eax, dword [ebp - 4]
movzx eax, word [eax + ebx*2 - 2]
sub ax, 0x59
je 0x40c456
sub ax, 0x20
jne 0x40c464
mov eax, edi
mov edx, 0x40c540
call fcn.00405124
jmp 0x40c47e
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
movzx edx, word [edx + ebx*2 - 2]
call fcn.00404f90
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00405124
inc ebx
lea eax, [ebp - 4]
call fcn.004048bc
call fcn.00405080
cmp ebx, eax
jle 0x40c35a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4be
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404e1c
lea eax, [ebp - 4]
call fcn.00404e14
ret