joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a3184
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x7a3275
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
call fcn.00405474
lea eax, [ebp - 0x14]
mov edx, 0x7a328c
call fcn.00405554
mov eax, dword [ebp - 0x14]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 6
ja case.0x7a31de.0
jmp dword [eax*4 + 0x7a31e5]
mov edx, dword [ebp - 0xc]
mov eax, 0x125
call fcn.0062e7cc
jmp 0x7a325f
mov edx, dword [ebp - 0xc]
mov eax, 0x127
call fcn.0062e7cc
jmp 0x7a325f
mov edx, dword [ebp - 0xc]
mov eax, 0x128
call fcn.0062e7cc
mov eax, dword [ebp - 8]
mov byte [eax], 1
jmp 0x7a325f
mov edx, dword [ebp - 0xc]
mov eax, 0x129
call fcn.0062e7cc
jmp 0x7a325f
mov edx, dword [ebp - 0xc]
mov eax, 0x12a
call fcn.0062e7cc
jmp 0x7a325f
mov edx, dword [ebp - 0xc]
mov eax, 0x9d
call fcn.0062e7cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a327c
lea eax, [ebp - 0x14]
call fcn.0040528c
ret

Function at 0x7a3290
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x7a336e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 3], 0
lea eax, [ebp - 0xc]
mov dl, byte [ebp - 1]
call fcn.00405474
lea eax, [ebp - 0xc]
mov edx, 0x7a3384
call fcn.00405554
mov eax, dword [ebp - 0xc]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jne 0x7a32fb
mov eax, dword [0x893464]
mov eax, dword [eax]
mov eax, dword [eax + 0x4f0]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x7a32fb
mov byte [ebp - 3], 1
cmp dword [ebp - 8], 4
jne 0x7a331e
mov eax, dword [0x893464]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x7a331e
mov byte [ebp - 3], 1
lea edx, [ebp - 0x10]
mov eax, dword [0x892934]
mov eax, dword [eax]
call fcn.0040a048
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
call fcn.00405474
mov eax, dword [ebp - 0x14]
pop edx
call fcn.00405890
test eax, eax
jle 0x7a334d
mov byte [ebp - 3], 1
mov al, byte [ebp - 3]
mov byte [ebp - 2], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a3375
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004052b0
ret
Function at 0x7b3d84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x7b3d8c
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7b3f06
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, 0xf1
call fcn.0062e7cc
push dword [ebp - 0x1c]
push 0x7b3f1c
lea edx, [ebp - 0x20]
mov eax, 0xf2
call fcn.0062e7cc
push dword [ebp - 0x20]
push 0x7b3f2c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040560c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x892514]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x7b3f3c
call fcn.004bfaf8
cmp dword [ebp - 0x14], 0
jne 0x7b3e05
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004c3988
push 0x7b3f54
call fcn.0040d398
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x7b3f6c
call fcn.0040e068
push dword [ebp - 0x24]
push 0x7b3f80
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x892f24]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov ecx, 0x7b3f90
xor eax, eax
call fcn.004a0f28
test al, al
je 0x7b3ede
push 1
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.0040b168
mov ecx, dword [ebp - 0x28]
mov eax, dword [0x892514]
mov eax, dword [eax]
mov edx, 0x7b3f3c
call fcn.004bf924
mov dl, 1
mov eax, dword [0x41c3d0]
call fcn.0040442c
mov dword [ebp - 8], eax
push 0
push 0
push 0
lea eax, [ebp - 8]
mov cl, 1
xor edx, edx
call fcn.0083c6ac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.0040445c
mov eax, dword [ebp - 4]
call fcn.007c0dd8
test al, al
je 0x7b3ede
push 8
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040574c
push eax
push 0x7b3f94
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b3f0d
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004052b0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004052b0
ret
Function at 0x7b3f9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7b40c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x183
call fcn.0062e7cc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x892514]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x7b40dc
call fcn.004bfaf8
cmp dword [ebp - 0x10], 0
jne 0x7b3ff0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004c3988
push 0x7b40f4
call fcn.0040d398
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x18]
mov eax, 0x7b410c
call fcn.0040e068
push dword [ebp - 0x18]
push 0x7b4120
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x892f24]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov ecx, 0x7b4130
xor eax, eax
call fcn.004a0f28
test al, al
je 0x7b40a1
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0040b168
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x892514]
mov eax, dword [eax]
mov edx, 0x7b40dc
call fcn.004bf924
mov eax, dword [ebp - 0xc]
call fcn.0084f204
test al, al
je 0x7b40a1
mov eax, dword [ebp - 4]
call fcn.007c0dd8
test al, al
je 0x7b40a1
push 8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040574c
push eax
push 0x7b4138
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b40d0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004052b0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004052b0
ret

Function at 0x7b4ec4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7b4f7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x892a38]
cmp byte [eax], 0
je 0x7b4efa
mov eax, dword [0x89249c]
cmp byte [eax], 0
jne 0x7b4f5c
lea eax, [ebp - 8]
mov edx, 0x7b4f90
call fcn.00405324
mov eax, dword [0x892e00]
mov eax, dword [eax]
mov edx, 0x7b4fa0
call fcn.00405698
jne 0x7b4f27
lea eax, [ebp - 8]
mov edx, 0x7b4fac
call fcn.00405324
push 8
push 0
push 0
push 0x7b4fb8
push dword [ebp - 8]
push 0x7b4fd8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 0x10]
call fcn.0040574c
push eax
push 0x7b4fe4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b4f81
lea eax, [ebp - 0x10]
call fcn.0040528c
lea eax, [ebp - 8]
call fcn.0040528c
ret

Function at 0x7b863c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0063ba3c
test al, al
je 0x7b866a
push 8
push 0
push 0
push 0x7b8674
push 0x7b86a4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x7b866f
call fcn.0082a90c
pop ecx
pop ecx
pop ebp
ret
Function at 0x7c7148
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x7c71da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x7c71f0
call fcn.00405324
mov eax, dword [0x892e00]
mov eax, dword [eax]
mov edx, 0x7c7200
call fcn.00405698
jne 0x7c718a
lea eax, [ebp - 4]
mov edx, 0x7c720c
call fcn.00405324
push 8
push 0
push 0
push 0x7c7218
push dword [ebp - 4]
push 0x7c7238
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 8]
call fcn.0040574c
push eax
push 0x7c7244
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c71e1
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052b0
ret
Function at 0x800354
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x80049b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x89257c]
cmp byte [eax], 0
jne 0x800480
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x8003ab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
jne 0x8003f1
mov byte [ebp - 5], 0x41
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 5]
call fcn.00405474
lea eax, [ebp - 0x14]
mov edx, 0x8004b0
call fcn.00405554
mov eax, dword [ebp - 0x14]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jne 0x8003e8
xor edx, edx
mov al, byte [ebp - 5]
call fcn.00639824
inc byte [ebp - 5]
cmp byte [ebp - 5], 0x5b
jne 0x8003af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x504]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x800418
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x504]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
jne 0x80045e
mov byte [ebp - 5], 0x41
lea eax, [ebp - 0x18]
mov dl, byte [ebp - 5]
call fcn.00405474
lea eax, [ebp - 0x18]
mov edx, 0x8004b0
call fcn.00405554
mov eax, dword [ebp - 0x18]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x800455
xor edx, edx
mov al, byte [ebp - 5]
call fcn.00639824
inc byte [ebp - 5]
cmp byte [ebp - 5], 0x5b
jne 0x80041c
cmp byte [0x1439b5c], 0
jne 0x800480
mov eax, dword [0x892d2c]
mov byte [eax], 0
mov eax, dword [0x893398]
mov eax, dword [eax]
or ecx, 0xffffffff
xor edx, edx
call fcn.00855a18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8004a2
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004052b0
ret
Function at 0x80f7f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x80f977
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80f984
mov eax, 0x80f99c
call fcn.006eecd4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jne 0x80f954
mov eax, dword [0x893398]
mov eax, dword [eax]
call fcn.008771ec
mov eax, dword [0x893398]
mov eax, dword [eax]
xor edx, edx
call fcn.0086a378
push 0
mov ecx, 0x12
xor edx, edx
xor eax, eax
call fcn.006676e8
lea edx, [ebp - 0x68]
xor eax, eax
call fcn.00402c0c
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x10]
mov ecx, 0x80f9a8
call fcn.00405598
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403464
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x81
mov word [ebp - 0x24], 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040574c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x80f91a
cmp byte [ebp - 5], 0
jne 0x80f954
push 0x10
lea edx, [ebp - 0x6c]
mov eax, 1
call fcn.0062e7cc
mov eax, dword [ebp - 0x6c]
call fcn.0040574c
push eax
lea edx, [ebp - 0x70]
mov eax, 0x1e8
call fcn.0062e7cc
mov eax, dword [ebp - 0x70]
call fcn.0040574c
push eax
mov eax, dword [ebp - 4]
call fcn.0047a720
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x80f954
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x893398]
mov eax, dword [eax]
mov eax, dword [eax + 0x37c]
mov dword [eax + 0xc], 0x7530
mov eax, dword [0x893398]
mov eax, dword [eax]
mov eax, dword [eax + 0x37c]
mov dl, 1
call fcn.0043db50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80f97e
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.004052b0
lea eax, [ebp - 0x10]
call fcn.0040528c
ret
Function at 0x81b210
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
xor ebx, ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x81b41b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x244]
mov dl, byte [ebp - 1]
call fcn.00405474
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 0x240]
mov ecx, 0xff
call fcn.00405528
lea eax, [ebp - 0x240]
mov edx, dword [0x892708]
call fcn.00402c6c
test eax, eax
jle 0x81b2b1
mov eax, dword [ebp - 8]
call fcn.0040528c
mov eax, dword [ebp - 0xc]
mov edx, 0x81b434
call fcn.004052e0
mov edx, dword [ebp + 8]
mov eax, 0x9d
call fcn.0062e7cc
jmp 0x81b3fd
push 0x20
lea eax, [ebp - 0x13e]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
lea eax, [ebp - 0x248]
mov dl, byte [ebp - 1]
call fcn.00405474
lea eax, [ebp - 0x248]
mov edx, 0x81b440
call fcn.00405554
mov eax, dword [ebp - 0x248]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x81b381
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.004054fc
mov eax, dword [ebp - 0x18]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24c]
mov eax, 4
call fcn.0040a8c8
push dword [ebp - 0x24c]
push 0x81b44c
mov eax, dword [ebp - 0x18]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x250]
mov eax, 4
call fcn.0040a8c8
push dword [ebp - 0x250]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x13e]
mov ecx, 0x21
call fcn.004054fc
jmp 0x81b3fd
lea eax, [ebp - 0x254]
mov dl, byte [ebp - 1]
call fcn.00405474
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x240]
mov ecx, 0xff
call fcn.00405528
lea eax, [ebp - 0x240]
mov edx, dword [0x892708]
call fcn.00402c6c
test eax, eax
jne 0x81b3db
lea eax, [ebp - 0x258]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x258]
mov eax, dword [0x892708]
mov cl, 0x32
call fcn.00403294
mov eax, dword [ebp - 8]
call fcn.0040528c
mov eax, dword [ebp - 0xc]
mov edx, 0x81b434
call fcn.004052e0
mov edx, dword [ebp + 8]
mov eax, 0x9d
call fcn.0062e7cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81b422
lea eax, [ebp - 0x254]
mov edx, 5
call fcn.004052b0
ret
Function at 0x82760c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov dword [ebp - 4], eax
mov eax, dword [0x893580]
cmp dword [eax], 2
jne 0x827693
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x827693
lea eax, [ebp - 0x24]
push eax
push 0x8276b0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x10], 0x10
xor eax, eax
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x15], 0
je 0x827693
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x82a648
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x82a650
xor eax, eax
push ebp
push 0x82a88c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x82a8a0
call fcn.0082a59c
test al, al
je 0x82a864
lea ecx, [ebp - 0x10]
mov edx, 0x82a8a0
mov eax, dword [0x891dd4]
call fcn.004c48dc
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040a048
mov edx, dword [ebp - 0x20]
mov eax, 0x82a8b0
call fcn.00405890
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x82a6bf
mov eax, dword [ebp - 0x10]
call fcn.0040554c
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004057ec
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.0040a298
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00405324
cmp dword [ebp - 0x10], 0
jne 0x82a7c6
mov edx, dword [0x891dd4]
mov eax, 0x82a8c8
call fcn.00405890
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x82a7c6
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x891dd4]
call fcn.0040554c
mov ecx, eax
mov edx, dword [ebp - 0x14]
add edx, 5
mov eax, dword [0x891dd4]
call fcn.004057ac
lea eax, [ebp - 0x28]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004057ac
mov eax, dword [ebp - 0x28]
mov edx, 0x82a8d8
call fcn.00405698
jne 0x82a79d
mov eax, dword [ebp - 0xc]
call fcn.0040554c
sub eax, 2
jl 0x82a79d
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 2
lea eax, [ebp - 0x2c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004057ac
mov eax, dword [ebp - 0x2c]
mov edx, 0x82a8d8
call fcn.00405698
jne 0x82a795
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.004057ac
jmp 0x82a79d
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x82a759
lea eax, [ebp - 0x30]
push eax
mov cl, 0x2c
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.004bccbc
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0xc]
call fcn.00405324
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040b168
lea ecx, [ebp - 4]
mov edx, 0x82a8e4
mov eax, dword [ebp - 0x10]
call fcn.004bdd94
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.004c3988
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 8]
mov edx, 0x82a8e4
call fcn.004bdd94
mov eax, dword [ebp - 4]
call fcn.0040ad3c
test al, al
je 0x82a815
push 0
mov eax, dword [ebp - 8]
call fcn.0040574c
push eax
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
call sub.kernel32.dll_CopyFileA
lea ecx, [ebp - 4]
mov edx, 0x82a8fc
mov eax, dword [ebp - 0x10]
call fcn.004bdd94
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.004c3988
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 8]
mov edx, 0x82a8fc
call fcn.004bdd94
mov eax, dword [ebp - 4]
call fcn.0040ad3c
test al, al
je 0x82a864
push 0
mov eax, dword [ebp - 8]
call fcn.0040574c
push eax
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x82a893
lea eax, [ebp - 0x38]
mov edx, 7
call fcn.004052b0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004052b0
ret
Function at 0x82a90c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x82aa27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8922a4]
mov eax, dword [eax]
call fcn.0040554c
cmp eax, 2
jle 0x82a979
mov eax, dword [0x8922a4]
mov eax, dword [eax]
call fcn.004c0bb8
test al, al
je 0x82a979
push 8
push 0
push 0
mov ecx, dword [0x8922a4]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x82aa3c
call fcn.00405598
mov eax, dword [ebp - 0xc]
call fcn.0040574c
push eax
push 0x82aa68
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x82aa0c
lea eax, [ebp - 4]
mov edx, 0x82aa78
call fcn.00405324
mov eax, dword [0x892e00]
mov eax, dword [eax]
mov edx, 0x82aa88
call fcn.00405698
jne 0x82a9a6
lea eax, [ebp - 4]
mov edx, 0x82aa94
call fcn.00405324
lea eax, [ebp - 8]
call fcn.0040528c
mov edx, dword [0x892f04]
mov eax, 0x82aa98
call fcn.00402c6c
test eax, eax
jle 0x82a9cf
lea eax, [ebp - 8]
mov edx, 0x82aaa4
call fcn.00405324
push 8
push 0
push 0
push 0x82aab4
push dword [ebp - 4]
push 0x82aad4
push dword [ebp - 8]
push 0x82aafc
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.0040560c
mov eax, dword [ebp - 0x10]
call fcn.0040574c
push eax
push 0x82aa68
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x82aa2e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004052b0
ret

Function at 0x82cfac
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
xor edx, edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040573c
lea eax, [ebp - 0x16c]
mov edx, dword [0x409210]
call fcn.00405dfc
xor eax, eax
push ebp
push 0x82d107
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov al, 1
call fcn.004c3988
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x170]
mov edx, 0x82d120
mov eax, dword [ebp - 4]
call fcn.004bdd94
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x16c]
mov edx, 0x27
call fcn.0040af88
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x82d0b5
push 0xffffffffffffffff
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x160]
mov edx, 0x82d12c
call fcn.00405598
mov edx, dword [ebp - 0x178]
lea ecx, [ebp - 0x174]
mov eax, dword [ebp - 0x14]
call fcn.004bdd94
mov eax, dword [ebp - 0x174]
call fcn.0040574c
push eax
lea ecx, [ebp - 0x17c]
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 4]
call fcn.004bdd94
mov eax, dword [ebp - 0x17c]
call fcn.0040574c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x82d0a1
inc dword [ebp - 0xc]
lea eax, [ebp - 0x16c]
call fcn.0040afd8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x82d03d
lea eax, [ebp - 0x16c]
call fcn.0040affc
cmp dword [ebp - 0xc], 2
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x82d10e
lea eax, [ebp - 0x17c]
mov edx, 4
call fcn.004052b0
lea eax, [ebp - 0x16c]
mov edx, dword [0x409210]
call fcn.00405ecc
lea eax, [ebp - 0x14]
call fcn.0040528c
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x83704c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x158]
mov edx, dword [0x637d7c]
call fcn.00405dfc
xor eax, eax
push ebp
push 0x83714f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
call fcn.0040528c
xor eax, eax
mov dword [ebp - 0x15c], eax
mov byte [ebp - 0x15d], 0x43
lea eax, [ebp - 0x168]
mov dl, byte [ebp - 0x15d]
call fcn.00405474
lea eax, [ebp - 0x168]
mov edx, 0x837164
call fcn.00405554
mov eax, dword [ebp - 0x168]
call fcn.0040574c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x8370ef
lea edx, [ebp - 0x158]
mov al, byte [ebp - 0x15d]
call fcn.00638118
test al, al
je 0x8370ef
push ebp
call fcn.00836c20
pop ecx
inc byte [ebp - 0x15d]
cmp byte [ebp - 0x15d], 0x5b
jne 0x83709c
mov eax, dword [ebp - 0x164]
mov edx, 0x837170
call fcn.00405698
je 0x837120
push ebp
or edx, 0xffffffff
mov eax, dword [ebp - 0x164]
call fcn.00836b3c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x837156
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004052b0
lea eax, [ebp - 0x158]
mov edx, dword [0x637d7c]
call fcn.00405ecc
ret