joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53722c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53747b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x34], eax
test byte [ebx + 0x1c], 0x10
jne 0x53745d
mov eax, ebx
call fcn.005374c4
xor esi, esi
cmp word [ebx + 0x122], 0
je 0x537275
or esi, 0x8000000
cmp word [ebx + 0x12a], 0
je 0x537285
or esi, 0x800
cmp word [ebx + 0x132], 0
je 0x537292
or esi, 2
cmp word [ebx + 0x13a], 0
je 0x53729f
or esi, 4
cmp word [ebx + 0x142], 0
je 0x5372af
or esi, 0x100
cmp word [ebx + 0x14a], 0
je 0x5372bf
or esi, 0x10000
cmp word [ebx + 0x152], 0
je 0x5372cf
or esi, 0x80
cmp word [ebx + 0x15a], 0
je 0x5372dc
or esi, 0x20
cmp word [ebx + 0x162], 0
je 0x5372e9
or esi, 0x40
cmp word [ebx + 0x16a], 0
je 0x5372f6
or esi, 8
cmp word [ebx + 0x172], 0
je 0x537306
or esi, 0x200
cmp word [ebx + 0x17a], 0
je 0x537316
or esi, 0x400
cmp word [ebx + 0x182], 0
je 0x537326
or esi, 0x20000
cmp word [ebx + 0x18a], 0
je 0x537333
or esi, 1
cmp word [ebx + 0x192], 0
je 0x537340
or esi, 0x10
cmp word [ebx + 0x19a], 0
je 0x537350
or esi, 0x4000
cmp word [ebx + 0x1a2], 0
je 0x537360
or esi, 0x1000
cmp word [ebx + 0x1aa], 0
je 0x537370
or esi, 0x8000
cmp word [ebx + 0x1b2], 0
je 0x537380
or esi, 0x2000
test esi, esi
je 0x53745d
cmp byte [ebx + 0x31], 0
je 0x5373fa
mov edi, 0x41
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404b48
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x537494
call fcn.00404c98
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x5373f2
inc dword [ebx + 0x34]
mov eax, dword [ebx + 0x34]
lea eax, [ebx + eax*8 + 0x34]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.shell32.dll_SHILCreateFromPath
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 1
inc edi
cmp edi, 0x5b
jne 0x537393
jmp 0x53740c
mov dword [ebx + 0x34], 1
lea eax, [ebx + 0x3c]
xor edx, edx
mov dword [eax], edx
mov byte [eax + 4], 1
lea edi, [ebx + 0x3c]
push edi
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x11c]
push eax
push esi
push 3
mov eax, dword [ebx + 4]
mov edx, dword [0x4a78b0]
call fcn.00403c28
call fcn.004b2308
push eax
call sub.shell32.dll_SHChangeNotifyRegister
mov dword [ebx + 0x38], eax
cmp dword [ebx + 0x38], 0
jne 0x53745d
mov eax, ebx
call fcn.005374c4
mov ecx, 0x5374a0
mov dl, 1
mov eax, dword [0x40a9b0]
call fcn.00410980
call fcn.00404308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537482
lea eax, [ebp - 0x14]
call fcn.00404968
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x538b00
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x168], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x538be7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x538bc2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x168]
mov eax, esi
call fcn.005389b8
mov eax, dword [ebp - 0x168]
mov edx, ebx
call fcn.0040c8d0
push 0x200
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea edx, [ebp - 0x16c]
mov eax, esi
call fcn.005389b8
mov eax, dword [ebp - 0x16c]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x538ba4
mov eax, ebx
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404be0
mov eax, ebx
call fcn.00538984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538bc9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x538d48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x538d51
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x538f11
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404b48
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x538f28
call fcn.00404c98
lea eax, [ebp - 8]
mov edx, 0x19
call fcn.00404fd0
lea eax, [ebp - 0x18]
mov edx, 0x1f4
call fcn.00404fd0
push 0x1f3
mov eax, dword [ebp - 0x18]
call fcn.00404e44
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x18
mov eax, dword [ebp - 8]
call fcn.00404e44
push eax
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x538e21
mov eax, dword [ebp - 8]
call fcn.00404e44
lea edx, [ebp - 0x20]
call fcn.0040cfe4
push dword [ebp - 0x20]
push 0x538f34
mov eax, ebx
call fcn.00402d70
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00404b48
push dword [ebp - 0x24]
push 0x538f40
mov eax, esi
mov edx, 4
call fcn.00404d0c
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
jmp 0x538e77
mov edx, 0x538f44
lea eax, [ebp - 0x28]
call fcn.0040316c
mov eax, ebx
call fcn.00402d70
mov edx, eax
lea eax, [ebp - 0x2c]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.0040313c
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x34]
call fcn.0040316c
mov edx, 0x538f48
lea eax, [ebp - 0x34]
mov cl, 4
call fcn.0040313c
lea edx, [ebp - 0x34]
mov eax, esi
call fcn.00404bd4
mov dword [edi], 0xffffffff
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00404b48
lea eax, [ebp - 0x38]
mov edx, 0x538f28
call fcn.00404c54
mov eax, dword [ebp - 0x38]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x538ea6
sub eax, 2
jne 0x538edc
lea eax, [ebp - 0x3c]
mov edx, ebx
call fcn.00404b48
lea eax, [ebp - 0x3c]
mov edx, 0x538f54
call fcn.00404c54
mov eax, dword [ebp - 0x3c]
mov edx, esi
call fcn.00538b00
mov eax, dword [esi]
call fcn.00404c4c
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404ee4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538f18
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.0040498c
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040498c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040498c
ret

Function at 0x539054
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x53908c]
push 0x10
call sub.user32.dll_GetKeyState
test al, 0xfe
je 0x539069
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test al, 0xfe
je 0x539077
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test al, 0xfe
je 0x539085
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x5390cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x539118
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e44
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53911f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x539368
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x539567
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b260c
test al, al
je 0x53954c
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 1
jne 0x53954c
mov eax, dword [ebp - 4]
dec dword [eax + 0x454]
mov eax, dword [0x5cc488]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 6], ax
mov eax, dword [0x5cc488]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004ca414
xor eax, eax
push ebp
push 0x539545
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004df10c
mov eax, dword [ebp - 4]
call fcn.00539c38
mov eax, dword [0x5cc204]
mov eax, dword [eax]
call fcn.004cc2ac
mov eax, dword [ebp - 4]
call fcn.0053a4ec
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x464], esi
xor edi, edi
mov eax, edi
cmp eax, 0x1f
ja 0x539421
bt esi, eax
jae 0x5394ed
mov ebx, edi
add bl, 0x41
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404b48
lea eax, [ebp - 0x10]
mov edx, 0x539580
call fcn.00404c54
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0053a128
test al, al
je 0x5394ed
push 0
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404b48
lea eax, [ebp - 0x14]
mov edx, 0x539580
call fcn.00404c54
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00539584
mov eax, dword [ebp - 4]
cmp byte [eax + 0x348], 0
je 0x53949e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004decbc
jmp 0x5394ed
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404b48
lea eax, [ebp - 0x18]
mov edx, 0x539580
call fcn.00404c54
mov eax, dword [ebp - 0x18]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jb 0x5394cd
sub eax, 2
jne 0x5394e2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004decbc
jmp 0x5394ed
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0053b10c
inc edi
cmp edi, 0x1a
jne 0x539417
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53954c
mov eax, dword [ebp - 4]
inc dword [eax + 0x454]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004df158
mov eax, dword [ebp - 4]
call fcn.004e0254
test eax, eax
je 0x539534
mov eax, dword [ebp - 4]
call fcn.004e0254
call fcn.004de750
mov eax, dword [0x5cc488]
mov eax, dword [eax]
mov dx, word [ebp - 6]
call fcn.004ca414
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53956e
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040498c
ret
Function at 0x539584
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404e34
xor eax, eax
push ebp
push 0x5396cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00538984
push 0x4201
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
xor ecx, ecx
xor edx, edx
mov eax, dword [edi + 0x26c]
call fcn.004dece4
mov dword [esi], eax
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404b48
lea eax, [ebp - 0x168]
mov edx, 0x5396e8
call fcn.00404c54
mov eax, dword [ebp - 0x168]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x539665
mov eax, dword [ebp - 4]
mov bl, byte [eax]
mov eax, ebx
call fcn.00402d70
and eax, 0xff
lea edx, [edi + eax*4 + 0x2b4]
lea ecx, [ebp - 0x16c]
mov eax, ebx
call fcn.00538d48
mov edx, dword [ebp - 0x16c]
mov eax, dword [esi]
call fcn.004dd938
jmp 0x539688
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404be0
mov edx, dword [ebp - 0x170]
mov eax, dword [esi]
call fcn.004dd938
push 0
mov eax, dword [ebp + 8]
push eax
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
mov eax, edi
call fcn.00539128
mov edx, dword [esi]
mov ecx, dword [ebp - 0x160]
mov eax, edi
call fcn.00539e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5396d6
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret

Function at 0x539e20
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffea0
mov edi, ecx
mov esi, edx
mov ebx, eax
mov edx, edi
mov eax, esi
call fcn.004ddb6c
cmp edi, dword [ebx + 0x44c]
jne 0x539e4f
mov edx, dword [ebx + 0x448]
mov eax, esi
call fcn.004ddbc4
jmp 0x539e89
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.00403288
push 0x4003
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [esp + 4]
mov eax, esi
call fcn.004ddbc4
cmp word [ebx + 0x43a], 0
je 0x539ea3
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0x43c]
call dword [ebx + 0x438]
add esp, 0x160
pop edi
pop esi
pop ebx
ret
Function at 0x539fdc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e34
xor eax, eax
push ebp
push 0x53a0bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
test ebx, ebx
je 0x53a096
lea eax, [ebp - 4]
call fcn.00538984
push 0x4201
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 4]
call fcn.005390b8
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.0040c8d0
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebx + 4]
mov edx, ebx
call fcn.004decbc
mov ebx, eax
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.00539128
mov ecx, dword [ebp - 0x160]
mov edx, ebx
mov eax, esi
call fcn.00539e20
mov edi, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a0c3
lea eax, [ebp - 0x16c]
mov edx, 2
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret

Function at 0x53a4ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x53a650
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53a633
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x53a536
bt dword [ebp - 4], eax
jae case.0x53a56d.1
lea eax, [ebp - 0xc]
mov edx, ebx
add dl, 0x41
call fcn.00404b48
lea eax, [ebp - 0xc]
mov edx, 0x53a668
call fcn.00404c54
mov eax, dword [ebp - 0xc]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x53a56d.1
jmp dword [eax*4 + 0x53a574]
test byte [esi + 0x468], 1
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
jmp case.0x53a56d.1
test byte [esi + 0x468], 2
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
jmp case.0x53a56d.1
test byte [esi + 0x468], 4
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
jmp case.0x53a56d.1
test byte [esi + 0x468], 8
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
jmp case.0x53a56d.1
test byte [esi + 0x468], 0x10
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
jmp case.0x53a56d.1
test byte [esi + 0x468], 0x20
jne case.0x53a56d.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x53a56d.1
btr dword [ebp - 4], eax
inc ebx
cmp ebx, 0x1a
jne 0x53a52b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a63a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x53b854
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53b9bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
push eax
lea edx, [ebp - 0x16c]
mov eax, ebx
call fcn.00539090
mov eax, dword [ebp - 0x16c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00404c4c
mov edx, eax
inc edx
mov ecx, SHChangeNotifyRegister
pop eax
call fcn.00404ea4
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 4]
call fcn.00404c98
push 0x4201
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404be0
mov edx, dword [ebp - 0x170]
mov eax, ebx
call fcn.004dd938
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004049bc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x160]
mov edx, ebx
call fcn.00539e20
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004e0254
cmp ebx, eax
jne 0x53b950
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, ebx
mov si, 0xffaf
call fcn.00403c74
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0053a294
test al, al
je 0x53b999
mov eax, ebx
call fcn.004ddff0
test al, al
je 0x53b999
mov eax, ebx
call fcn.004de1dc
mov esi, eax
jmp 0x53b98e
mov eax, dword [ebp + 8]
push eax
mov eax, esi
call fcn.0053b854
pop ecx
mov edx, esi
mov eax, ebx
call fcn.004de1cc
mov esi, eax
mov eax, esi
call fcn.00539044
test al, al
jne 0x53b977
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b9c6
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x53bec4
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e34
xor eax, eax
push ebp
push 0x53c07e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00538984
push 0x4201
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404e44
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00402d70
mov edx, eax
lea eax, [ebp - 0x16c]
call fcn.00404b48
lea eax, [ebp - 0x16c]
mov edx, 0x53c094
call fcn.00404c54
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.0053be14
pop ecx
test al, al
je 0x53bf88
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004ded0c
mov dword [esi], eax
jmp 0x53bf9f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
xor edx, edx
call fcn.004dece4
mov dword [esi], eax
lea eax, [ebp - 0x170]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404b48
lea eax, [ebp - 0x170]
mov edx, 0x53c094
call fcn.00404c54
mov eax, dword [ebp - 0x170]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x53c00f
mov eax, dword [ebp - 4]
mov bl, byte [eax]
mov eax, ebx
call fcn.00402d70
and eax, 0xff
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
lea edx, [edx + eax*4 + 0x2b4]
lea ecx, [ebp - 0x174]
mov eax, ebx
call fcn.00538d48
mov edx, dword [ebp - 0x174]
mov eax, dword [esi]
call fcn.004dd938
jmp 0x53c032
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00404be0
mov edx, dword [ebp - 0x178]
mov eax, dword [esi]
call fcn.004dd938
push 0
push edi
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
call fcn.00539128
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x164]
call fcn.00539e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c085
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x53c098
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53c2b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
dec dword [eax + 0x454]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004df10c
xor eax, eax
push ebp
push 0x53c28f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0053a4ec
mov esi, eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov edx, ebx
cmp edx, 0x1f
ja 0x53c102
bt dword [eax + 0x464], edx
jae 0x53c15e
mov eax, ebx
cmp eax, 0x1f
ja 0x53c10e
bt esi, eax
jb 0x53c15e
lea eax, [ebp - 0x10]
mov edx, ebx
add dl, 0x41
call fcn.00404b48
lea eax, [ebp - 0x10]
mov edx, 0x53c2c8
call fcn.00404c54
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0053bcc0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x53c15e
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0053bbc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
mov edx, dword [ebp - 8]
call fcn.004dec30
mov byte [ebp - 9], 1
inc ebx
cmp ebx, 0x1a
jne 0x53c0f1
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x53c170
bt esi, eax
jae 0x53c22d
mov eax, dword [ebp - 4]
mov edx, ebx
cmp edx, 0x1f
ja 0x53c187
bt dword [eax + 0x464], edx
jb 0x53c22d
push ebp
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00404b48
lea eax, [ebp - 0x14]
mov edx, 0x53c2c8
call fcn.00404c54
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
xor ecx, ecx
call fcn.0053bec4
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x348], 0
je 0x53c1d7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004decbc
jmp 0x53c229
lea eax, [ebp - 0x18]
mov edx, ebx
add dl, 0x41
call fcn.00404b48
lea eax, [ebp - 0x18]
mov edx, 0x53c2c8
call fcn.00404c54
mov eax, dword [ebp - 0x18]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jb 0x53c209
sub eax, 2
jne 0x53c21e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004decbc
jmp 0x53c229
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0053b10c
mov byte [ebp - 9], 1
inc ebx
cmp ebx, 0x1a
jne 0x53c166
mov eax, dword [ebp - 4]
mov dword [eax + 0x464], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c296
mov eax, dword [ebp - 4]
inc dword [eax + 0x454]
mov bl, byte [ebp - 9]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004df158
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
cmp byte [ebp - 9], 0
je 0x53c28e
mov eax, dword [ebp - 4]
call fcn.004e0254
mov edx, eax
mov eax, dword [ebp - 4]
mov si, 0xffaf
call fcn.00403c74
ret