joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417480
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
movzx eax, word [0x260dd88]
mov ecx, dword [0x260de70]
push ebx
push 0
lea eax, [eax + ecx + 0x4b9000]
push 0
push eax
call fcn.00405f50
add esp, 0xc
mov edx, 0x2616118
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4174b0
push 0x2616118
call fcn.00406910
add esp, 4
test al, al
jne 0x41759d
push 0x2616118
call fcn.004071c0
add esp, 4
test al, al
jne 0x41759d
push 0x180
push 0x8302
push 0x2616118
call fcn.004839c6
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x417571
mov edx, dword [0x260dd84]
and edx, 0x36
push edx
push 0x2616118
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movzx eax, word [0x4b8be8]
push 0
push 0
push eax
push 0x2616118
mov word [0x260dd80], bx
call fcn.00407440
add esp, 4
push eax
push 2
push ebx
call fcn.00483c77
add esp, 4
push eax
push ebx
mov ecx, 0x2616118
call fcn.00407900
movzx eax, word [0x4b8be8]
add esp, 0x1c
test eax, eax
je 0x4175b1
cmp ebx, 0x14
jge 0x4175b1
shl eax, 4
mov byte [eax + ebx + 0x4b9018], bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00483f70
mov ecx, dword [eax]
mov eax, ecx
sub eax, 0x50
je 0x417584
sub eax, 0x67
jne 0x417589
mov ecx, 5
mov word [0x260dd80], cx
or word [0x260ddac], 1
pop ebx
mov esp, ebp
pop ebp
ret
or word [0x260ddac], 1
mov edx, 0x50
mov word [0x260dd80], dx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417c50
Capabilities:
Get hostname

Disassembly:
sub esp, 0x108
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x104], eax
cmp byte [0x260dd80], 0
je 0x417c95
or word [0x260ddac], 1
mov eax, 0x49
mov word [0x260dd80], ax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00482caa
add esp, 0x108
ret
push 0xff
lea ecx, [esp + 9]
push 0
push ecx
mov byte [esp + 0x10], 0
call fcn.0048f0e0
add esp, 0xc
lea edx, [esp]
push edx
lea eax, [esp + 8]
push eax
mov dword [esp + 8], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x417d41
movzx ecx, word [0x260dd88]
mov edx, dword [0x260de70]
push ebp
push esi
lea esi, [ecx + edx + 0x4b9000]
lea ebp, [esp + 0xc]
xor ecx, ecx
push edi
sub ebp, esi
jmp 0x417cf0
lea eax, [esp + 0x10]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x417cf7
sub eax, edi
cmp ecx, eax
jae 0x417d0c
lea eax, [ecx + ebp]
mov al, byte [eax + esi]
jmp 0x417d0e
mov al, 0x20
mov byte [ecx + esi], al
inc ecx
cmp ecx, 0xf
jl 0x417cf0
pop edi
mov byte [esi + 0xf], 0
pop esi
mov byte [0x260dd85], 1
mov byte [0x260dd84], 1
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00482caa
add esp, 0x108
ret
mov ecx, 1
or word [0x260ddac], cx
mov word [0x260dd80], cx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00482caa
add esp, 0x108
ret
Function at 0x417d70
Capabilities:
Get disk information

Disassembly:
movzx eax, byte [0x260dd80]
sub esp, 8
push ebx
add eax, 0xfffffffe
push ebp
push esi
cmp eax, 6
ja case.0x417d94.3
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebp, 0x5c3a41
jmp dword [eax*4 + 0x417f64]
xor eax, eax
mov word [0x260dd94], ax
xor ebx, ebx
mov cl, bl
lea edx, [esp + 0xc]
add cl, 0x41
mov dword [esp + 0xc], ebp
push edx
mov byte [esp + 0x10], cl
call esi
cmp eax, 4
jne 0x417dc5
inc word [0x260dd94]
inc ebx
cmp ebx, 0x1a
jl 0x417da5
push edi
xor ebx, ebx
xor edi, edi
mov al, bl
lea ecx, [esp + 0x10]
add al, 0x41
mov dword [esp + 0x10], ebp
push ecx
mov byte [esp + 0x14], al
call esi
cmp eax, 4
jne 0x417df4
movzx edx, word [0x260dd8c]
cmp edi, edx
je 0x417e15
inc edi
inc ebx
cmp ebx, 0x1a
jl 0x417dd0
or word [0x260ddac], 1
pop edi
pop esi
mov eax, 0x12
pop ebp
mov word [0x260dd80], ax
pop ebx
add esp, 8
ret
mov ax, word [0x4a76f8]
mov cl, byte [0x4a76fa]
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
movzx ecx, word [0x260dd98]
lea eax, [esp + 0x10]
mov edx, eax
add bl, 0x41
sub ecx, edx
mov edx, dword [0x260de70]
mov byte [esp + 0x10], bl
mov dword [esp + 0x14], 0x80
lea edx, [ecx + edx + 0x4b9000]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x417e55
movzx ecx, word [0x260dd9c]
mov edx, dword [0x260de28]
lea eax, [esp + 0x14]
push eax
lea eax, [ecx + edx + 0x4b9000]
push eax
lea ecx, [esp + 0x18]
push ecx
call sub.MPR.dll_WNetGetConnectionA
pop edi
pop esi
xor edx, edx
pop ebp
mov byte [0x260dd8d], 0
mov byte [0x260dd8c], 4
mov word [0x260dd84], dx
pop ebx
add esp, 8
ret
movzx esi, byte [0x260dd88]
cmp esi, 0x19
ja 0x417ed8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, 1
mov ecx, esi
shl edx, cl
test edx, eax
je 0x417ed8
movzx eax, byte [0x260dd88]
push eax
call fcn.00405870
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 8
ret
or word [0x260ddac], 1
pop esi
mov ecx, 0xf
pop ebp
mov word [0x260dd80], cx
pop ebx
add esp, 8
ret
movzx esi, byte [0x260dd88]
cmp esi, 0x19
ja 0x417f2c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, 1
mov ecx, esi
shl edx, cl
test edx, eax
je 0x417f2c
movzx eax, byte [0x260dd88]
imul eax, eax, 0x58
pop esi
xor ecx, ecx
pop ebp
mov word [eax + 0x4ba413], cx
pop ebx
add esp, 8
ret
or word [0x260ddac], 1
pop esi
mov edx, 0xf
pop ebp
mov word [0x260dd80], dx
pop ebx
add esp, 8
ret
or word [0x260ddac], 1
pop esi
mov eax, 0x49
pop ebp
mov word [0x260dd80], ax
pop ebx
add esp, 8
ret
Function at 0x4189b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x210], eax
movzx eax, word [0x260dd88]
mov ecx, dword [0x260de70]
push esi
lea esi, [eax + ecx + 0x4b9000]
mov al, byte [0x260dd8c]
mov dword [esp + 4], 0x5c3a41
mov dword [esp + 8], 0
test al, al
jne 0x4189f7
call fcn.004839f3
add al, 0x40
mov byte [esp + 4], al
movzx eax, byte [0x260dd80]
sub eax, 0
je 0x418a59
mov ecx, 1
or word [0x260ddac], cx
sub eax, ecx
je 0x418a38
mov edx, ecx
mov word [0x260dd80], dx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00482caa
add esp, 0x214
ret
mov eax, 3
mov word [0x260dd80], ax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00482caa
add esp, 0x214
ret
push 0x104
lea ecx, [esp + 0x114]
push ecx
push 0
push 0
lea edx, [esp + 0x18]
push edx
push 0x104
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x418b7e
mov eax, dword [esp + 8]
mov dword [esi + 2], eax
mov eax, 0x20202020
lea ecx, [esi + 6]
xor edx, edx
mov word [esi], dx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov word [ecx + 8], ax
mov byte [ecx + 0xa], al
lea eax, [esp + 0xc]
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x418ab4
sub eax, edi
cmp eax, 0xb
jae 0x418adb
lea eax, [esp + 0x10]
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x418ad0
sub eax, edi
jmp 0x418ae0
mov eax, 0xb
push eax
lea edx, [esp + 0x14]
push edx
push ecx
call fcn.004904e0
lea ecx, [esi + 0x11]
mov eax, 0x20202020
mov dword [ecx], eax
mov dword [ecx + 4], eax
add esp, 0xc
lea eax, [esp + 0x114]
lea esi, [eax + 1]
pop edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x418b07
sub eax, esi
cmp eax, 8
jae 0x418b51
lea eax, [esp + 0x110]
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x418b20
sub eax, esi
push eax
lea eax, [esp + 0x114]
push eax
push ecx
call fcn.004904e0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00482caa
add esp, 0x214
ret
mov eax, 8
push eax
lea eax, [esp + 0x114]
push eax
push ecx
call fcn.004904e0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00482caa
add esp, 0x214
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x50
je 0x418b98
sub ecx, 0x67
je 0x418b98
mov word [0x260dd80], ax
jmp 0x418ba4
mov ecx, 5
mov word [0x260dd80], cx
mov ecx, dword [esp + 0x214]
or word [0x260ddac], 1
pop esi
xor ecx, esp
call fcn.00482caa
add esp, 0x214
ret
Function at 0x419010
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x354
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x350], eax
mov ax, word [0x260dd98]
push ebx
push esi
push edi
test ax, ax
jne 0x419057
mov eax, 1
call fcn.004147b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.00482caa
mov esp, ebp
pop ebp
ret
mov ebx, 1
cmp ax, bx
je 0x419073
or word [0x260ddac], bx
mov eax, 5
mov word [0x260dd80], ax
push 0x208
lea ecx, [esp + 0x154]
push 0
push ecx
call fcn.0048f0e0
movzx edx, word [0x260dd88]
mov eax, dword [0x260de70]
lea ecx, [edx + eax + 0x4b9000]
push 0x104
push ecx
lea edx, [esp + 0x164]
push edx
mov byte [esp + 0x26b], 0
mov byte [esp + 0x26c], bl
call fcn.00484e90
add esp, 0x18
cmp byte [esp + 0x253], 0
jne 0x41926f
cmp byte [esp + 0x254], bl
jne 0x41926f
cmp byte [esp + 0x150], 0
lea eax, [esp + 0x150]
je 0x4190ff
jmp 0x4190f0
cmp byte [eax], 0x2f
jne 0x4190f8
mov byte [eax], 0x5c
add eax, ebx
cmp byte [eax], 0
jne 0x4190f0
lea eax, [esp + 0x150]
push 0x5c
push eax
call fcn.00484e6c
mov esi, eax
add esp, 8
test esi, esi
je 0x41911b
add esi, ebx
jmp 0x41913e
lea ecx, [esp + 0x150]
push 0x3a
push ecx
call fcn.00484060
mov esi, eax
add esp, 8
test esi, esi
je 0x419137
add esi, ebx
jmp 0x41913e
lea esi, [esp + 0x150]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
jne 0x41916d
mov ecx, 2
mov word [0x260dd80], cx
jmp 0x419277
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x419180
movzx eax, byte [0x260dd84]
movzx edx, byte [0x260dd85]
mov ecx, dword [esp + 0x10]
test al, 8
je 0x41919b
test cl, 0x10
je 0x419201
test al, 2
jne 0x4191a4
test cl, 2
jne 0x419201
test al, 4
jne 0x4191ad
test cl, 4
jne 0x419201
test al, 0x10
jne 0x4191b6
test cl, 0x10
jne 0x419201
mov eax, edx
and eax, ecx
cmp eax, edx
jne 0x419201
lea edi, [esp + 0x10]
call fcn.00407d50
test eax, eax
je 0x4191fd
lea eax, [esp + 0x3c]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4191d5
push 0
lea edx, [esp + 0x154]
push 1
push edx
call fcn.00405f50
push eax
call fcn.00484af3
add esp, 0x10
test eax, eax
jne 0x419213
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x419180
jmp 0x41922b
or word [0x260ddac], 1
mov edi, dword [esp + 0xc]
mov ecx, 5
mov word [0x260dd80], cx
test byte [0x260ddac], 1
jne 0x419253
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x419253
or word [0x260ddac], 1
mov edx, 2
mov word [0x260dd80], dx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.00482caa
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov word [0x260dd80], ax
or word [0x260ddac], bx
mov ecx, dword [esp + 0x35c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00482caa
mov esp, ebp
pop ebp
ret
Function at 0x4197d0
Capabilities:
Get disk information

Disassembly:
mov cx, word [0x260dd84]
sub esp, 8
test cx, cx
jne 0x4197e3
xor eax, eax
jmp 0x4197f7
movzx eax, word [0x260dd9c]
mov edx, dword [0x260de28]
lea eax, [eax + edx + 0x4b9000]
movzx ecx, cx
push ecx
movzx ecx, word [0x260dd88]
push eax
lea edx, [esp + 8]
push edx
mov edx, dword [0x260de70]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
lea eax, [ecx + edx + 0x4b9000]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x419858
mov ecx, dword [esp]
mov eax, dword [esp + 4]
and ecx, 0xc007
or ecx, 0x4000
mov word [0x260dd84], ax
add eax, 5
mov word [0x260dd8c], cx
mov word [0x260dd88], ax
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x50
je 0x41987c
sub ecx, 0x67
je 0x41987c
mov word [0x260dd80], ax
or word [0x260ddac], 1
add esp, 8
ret
or word [0x260ddac], 1
mov edx, 5
mov word [0x260dd80], dx
add esp, 8
ret

Function at 0x4198f0
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push esi
push edi
call fcn.00405680
movzx edx, word [0x4b8be8]
movzx ecx, word [0x260dd8c]
test edx, edx
je 0x419922
cmp ecx, 0x14
jge 0x419922
shl edx, 4
movzx ecx, byte [edx + ecx + 0x4b9018]
movzx edx, word [0x260dd88]
mov esi, dword [0x260de70]
mov dword [esp + 0xc], 0
cmp ecx, dword [eax + 0x210]
lea esi, [edx + esi + 0x4b9000]
jge 0x419a67
lea edi, [ecx + ecx*8]
shl edi, 5
cmp dword [edi + 0x24b9114], 0
je 0x419a67
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004860d0
add esp, 8
test eax, eax
jne 0x419a25
mov al, 0x3a
cmp byte [edi + 0x24b9011], al
jne 0x4199a5
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0x5c3a41
push edx
mov byte [esp + 0x28], al
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [edi + 0x24b9010]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x40]
mov dword [esi], eax
mov eax, dword [esp + 0x44]
mov edx, eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], ecx
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x34]
mov ecx, eax
sar ecx, 0x1f
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x3c]
sar edx, 0x1f
mov edx, dword [esp + 0x38]
mov ecx, eax
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x2c]
sar ecx, 0x1f
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0xc]
mov ecx, eax
mov dword [esi + 0x20], eax
movsx eax, word [esp + 0x18]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x28]
sar ecx, 0x1f
mov ecx, dword [edi + 0x24b9118]
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00483f70
mov ecx, dword [eax]
mov eax, ecx
sub eax, 0x50
je 0x419a4d
sub eax, 0x67
je 0x419a4d
mov word [0x260dd80], cx
or word [0x260ddac], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or word [0x260ddac], 1
mov edx, 5
mov word [0x260dd80], dx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or word [0x260ddac], 1
mov eax, 6
pop edi
mov word [0x260dd80], ax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419ca0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x108], eax
mov ax, word [0x4a76f8]
mov cl, byte [0x4a76fa]
mov word [esp], ax
mov al, byte [0x260dd8c]
mov byte [esp + 2], cl
test al, al
jne 0x419ce2
call fcn.004839f3
add al, 0x40
mov byte [esp], al
mov al, byte [0x260dd8c]
jmp 0x419cea
mov dl, al
add dl, 0x40
mov byte [esp], dl
movzx ecx, byte [0x260dd8d]
sub ecx, 0
push esi
push edi
je 0x419e0a
mov edi, 1
sub ecx, edi
je 0x419dc2
sub ecx, edi
je 0x419d1d
mov eax, 0x7100
mov word [0x260dd80], ax
jmp 0x419e6b
test al, al
je 0x419d26
movzx eax, al
jmp 0x419d2b
call fcn.004839f3
lea esi, [eax - 1]
cmp esi, 0x19
ja 0x419d43
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, edi
mov ecx, esi
shl edx, cl
test edx, eax
jne 0x419d53
mov eax, 0xf
mov word [0x260dd80], ax
jmp 0x419e6b
push 0x104
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x419d43
push 4
lea ecx, [esp + 0x10]
push 0x4a76fc
push ecx
call fcn.00483689
add esp, 0xc
test eax, eax
jne 0x419e03
movzx ecx, word [0x260dd88]
lea eax, [esp + 0x10]
mov edx, eax
sub ecx, edx
mov edx, dword [0x260de70]
lea edx, [ecx + edx + 0x4b9000]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, edi
test cl, cl
jne 0x419da0
pop edi
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00482caa
add esp, 0x10c
ret
test al, al
je 0x419dcb
movzx eax, al
jmp 0x419dd0
call fcn.004839f3
lea esi, [eax - 1]
cmp esi, 0x19
ja 0x419d43
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, edi
mov ecx, esi
shl edx, cl
test edx, eax
je 0x419d43
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x419e72
mov edx, 0xf
jmp 0x419e64
test al, al
je 0x419e13
movzx eax, al
jmp 0x419e18
call fcn.004839f3
lea esi, [eax - 1]
mov edi, 1
cmp esi, 0x19
ja 0x419e39
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, edi
mov ecx, esi
shl edx, cl
test edx, eax
jne 0x419d43
movzx ecx, word [0x260dd88]
mov edx, dword [0x260de70]
lea eax, [ecx + edx + 0x4b9000]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x419e72
mov edx, 3
mov word [0x260dd80], dx
or word [0x260ddac], di
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.00482caa
add esp, 0x10c
ret
Function at 0x419f30
Capabilities:
Get disk size

Disassembly:
movzx eax, word [0x260dd88]
mov ecx, dword [0x260de70]
movzx edx, word [0x260dd9c]
sub esp, 0x10
push esi
lea eax, [eax + ecx + 0x4b9000]
mov ecx, dword [0x260de28]
lea esi, [edx + ecx + 0x4b9000]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x419fc0
mov ecx, dword [esp + 8]
xor eax, eax
mov word [esi + 2], ax
mov eax, dword [esp + 4]
push edi
mov edx, 0x2c
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x10]
mov edi, eax
mov word [esi], dx
imul edi, ecx
mov edx, dword [esp + 0x14]
mov dword [esi + 4], eax
imul eax, edx
mov dword [esi + 0x14], edi
pop edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
pop esi
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x50
je 0x419fe5
sub ecx, 0x67
je 0x419fe5
or word [0x260ddac], 1
mov word [0x260dd80], ax
pop esi
add esp, 0x10
ret
or word [0x260ddac], 1
mov edx, 5
mov word [0x260dd80], dx
pop esi
add esp, 0x10
ret
Function at 0x41a2d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x50
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x4c], eax
call fcn.00451320
mov al, byte [0x260dd80]
cmp al, 0x1a
jb 0x41a30c
mov eax, 1
or word [0x260ddac], ax
mov byte [0x260dd80], al
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
lea ecx, [esp]
push ecx
movzx eax, al
lea edx, [esp + 8]
push edx
push eax
xor eax, eax
call fcn.0040bdc0
add esp, 0xc
test eax, eax
jne 0x41a345
mov byte [0x260dd80], 2
or word [0x260ddac], 1
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
movzx eax, byte [0x260dd80]
movzx ecx, word [esp + 4]
movzx edx, word [esp]
push ebx
push edi
shl ecx, 4
add eax, 0x41
push eax
lea ebx, [ecx + edx + 0x4b9000]
lea ecx, [esp + 0x18]
push str.._c:
push ecx
call fcn.00483265
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push 0x80000000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41a3bb
or word [0x260ddac], 1
pop edi
mov byte [0x260dd80], 2
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
movzx eax, word [0x260dd88]
push ebp
movzx ebp, word [0x260dd84]
push esi
movzx esi, word [0x260dd8c]
add esi, dword [0x260de70]
mov ecx, 0xffff
cmp bp, cx
jne 0x41a404
movzx edx, word [esi + 0x4b9008]
movzx ecx, word [esi + 0x4b9006]
mov eax, dword [esi + 0x4b9000]
movzx ebp, word [esi + 0x4b9004]
shl edx, 4
add edx, ecx
mov esi, edx
movzx edx, word [ebx + 2]
imul edx, eax
push 0
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41a425
mov byte [0x260dd80], 8
jmp 0x41a450
movzx ecx, word [ebx + 2]
movzx edx, bp
imul ecx, edx
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
lea eax, [esi + 0x4b9000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a458
mov byte [0x260dd80], 0xb
or word [0x260ddac], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x5c]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
Function at 0x41a480
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x50
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x4c], eax
call fcn.00451320
mov al, byte [0x260dd80]
cmp al, 0x1a
jb 0x41a4bc
mov eax, 1
or word [0x260ddac], ax
mov byte [0x260dd80], al
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
lea ecx, [esp]
push ecx
movzx eax, al
lea edx, [esp + 8]
push edx
push eax
xor eax, eax
call fcn.0040bdc0
add esp, 0xc
test eax, eax
jne 0x41a4f5
mov byte [0x260dd80], 2
or word [0x260ddac], 1
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
movzx eax, byte [0x260dd80]
movzx ecx, word [esp + 4]
movzx edx, word [esp]
push esi
shl ecx, 4
add eax, 0x41
push eax
lea esi, [ecx + edx + 0x4b9000]
lea ecx, [esp + 0x14]
push str.._c:
push ecx
mov dword [esp + 0x10], esi
call fcn.00483265
add esp, 0xc
cmp byte [esi + 0x17], 0xf8
jne 0x41a54f
or word [0x260ddac], 1
mov byte [0x260dd80], 2
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
push edi
push 0
push 0x20000080
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41a594
or word [0x260ddac], 1
pop edi
mov byte [0x260dd80], 2
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
movzx esi, word [0x260dd8c]
add esi, dword [0x260de70]
push ebx
movzx ebx, word [0x260dd84]
mov eax, 0xffff
push ebp
movzx ebp, word [0x260dd88]
cmp bx, ax
jne 0x41a5dd
movzx ecx, word [esi + 0x4b9008]
movzx edx, word [esi + 0x4b9006]
mov ebp, dword [esi + 0x4b9000]
movzx ebx, word [esi + 0x4b9004]
shl ecx, 4
add ecx, edx
mov esi, ecx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41a605
mov byte [0x260dd80], 2
jmp 0x41a659
mov ecx, dword [esp + 0x10]
movzx edx, word [ecx + 2]
imul edx, ebp
push 0
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41a62a
mov byte [0x260dd80], 8
jmp 0x41a659
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push eax
movzx eax, word [edx + 2]
movzx ecx, bx
imul ecx, eax
push ecx
lea ecx, [esi + 0x4b9000]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41a661
mov byte [0x260dd80], 0xa
or word [0x260ddac], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x5c]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
Function at 0x41bdf0
Capabilities:
Get disk information

Disassembly:
push ecx
movzx eax, byte [0x260dd80]
cmp eax, 0xd
jg 0x41be8f
je 0x41be46
test eax, eax
je 0x41bec7
cmp eax, 0xb
jne 0x41be96
movzx eax, byte [0x260dd84]
push eax
call fcn.004070c0
movzx ecx, al
add esp, 4
neg ecx
sbb ecx, ecx
and ecx, 0x5ad8
mov edx, 0xadad
mov word [0x260dd8c], dx
mov word [0x260dd80], cx
pop ecx
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ebx, ebx
xor esi, esi
mov al, bl
lea ecx, [esp + 0xc]
add al, 0x41
mov dword [esp + 0xc], 0x5c3a41
push ecx
mov byte [esp + 0x10], al
call edi
cmp eax, 5
jne 0x41be84
movzx edx, word [0x260dd8c]
add edx, dword [0x260de28]
inc esi
mov byte [edx + esi + 0x4b8fff], bl
inc ebx
cmp ebx, 0x1a
jl 0x41be53
pop edi
pop esi
pop ebx
pop ecx
ret
cmp eax, 0xff
je 0x41beaa
mov eax, 1
or word [0x260ddac], ax
mov word [0x260dd80], ax
pop ecx
ret
cmp word [0x260dd8c], 0
je 0x41bec7
mov ecx, 1
or word [0x260ddac], cx
mov word [0x260dd80], cx
pop ecx
ret

Function at 0x4208e0
Capabilities:
Get disk information

Disassembly:
push ecx
mov ax, word [0x2611478]
test ax, ax
jne 0x42095c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push edi
mov eax, 0xc426
xor edi, edi
mov word [0x2611478], ax
xor ebx, ebx
cmp ebx, 0x19
ja 0x420939
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, 1
mov ecx, ebx
shl edx, cl
test edx, eax
je 0x420939
mov al, bl
lea ecx, [esp + 0xc]
add al, 0x41
mov dword [esp + 0xc], 0x5c3a41
push ecx
mov byte [esp + 0x10], al
call esi
cmp eax, 2
jne 0x420939
inc edi
inc ebx
cmp ebx, 2
jl 0x420904
mov ax, word [0x2611478]
test edi, edi
je 0x420959
dec edi
shl edi, 6
or edi, 1
or ax, di
mov word [0x2611478], ax
pop edi
pop esi
pop ebx
pop ecx
ret