joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be862
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
movzx edx, word [ebp - 0x12]
call fcn.0040edc0
mov edi, eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xc4]
movzx edx, word [ebp - 0x14]
call fcn.0040edc0
mov esi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac]
movzx edx, word [ebp - 0x34]
call fcn.0040edc0
push 0x65812c
push eax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 4
push eax
call fcn.00410a90
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.00410ad0
push 0x65812c
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 6
push eax
call fcn.00410a90
push edi
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c]
call fcn.00410ad0
add esp, 0x20
mov esi, eax
cmp ebx, esi
je 0x40f057
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x40f030
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.00409510
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x40f048
mov eax, dword [ebx]
jmp 0x40f04a
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push esi
call fcn.0040c680
mov eax, dword [ebp - 0x38]
cmp eax, 8
jb 0x40f06c
inc eax
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
cmp eax, 8
jb 0x40f095
inc eax
lea ecx, [ebp - 0x64]
push eax
push dword [ebp - 0x64]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x54], 0
cmp eax, 8
jb 0x40f0be
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], 0
cmp eax, 8
jb 0x40f0ed
inc eax
lea ecx, [ebp - 0x94]
push eax
push dword [ebp - 0x94]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x80], 7
mov word [ebp - 0x94], ax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x84], 0
cmp eax, 8
jb 0x40f125
inc eax
lea ecx, [ebp - 0xac]
push eax
push dword [ebp - 0xac]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c], 0
cmp eax, 8
jb 0x40f160
inc eax
lea ecx, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xb4], 0
cmp eax, 8
jb 0x40f19b
inc eax
lea ecx, [ebp - 0xdc]
push eax
push dword [ebp - 0xdc]
call fcn.00409510
cmp dword [ebx + 0x10], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x40f1c0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be898
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f2a9
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0
push eax
push 8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x2d1400
movq qword [ebp - 0x2c], xmm0
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40f2a2
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0057653d
push esi
mov ebx, eax
push 0
push ebx
call fcn.0058fee0
add esp, 0x10
lea eax, [ebp - 0x18]
push 0
push eax
push esi
push ebx
push 0xc
lea eax, [ebp - 0x2c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40f2b0
push ebx
call fcn.00576339
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40f374
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x40f358
cmp eax, dword [ebx + 4]
jae 0x40f358
add eax, ebx
lea ecx, [ebp - 0x60]
push eax
call fcn.004088b0
push eax
lea ecx, [ebp - 0x44]
call fcn.00409bb0
lea ecx, [ebp - 0x60]
call fcn.00408870
push 1
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x20
push eax
lea ecx, [ebp - 0x44]
call fcn.00410330
push eax
push 0
lea ecx, [ebp - 0x44]
call fcn.004090b0
sub esp, 8
mov byte [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x44]
push eax
call fcn.004102c0
inc eax
lea ecx, [ebp - 0x44]
push eax
call fcn.00409150
cmp dword [ebp - 0x30], 0x10
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x44]
call fcn.0040d020
push ebx
call fcn.00576339
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x40f36a
push ebx
call fcn.00576339
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x44]
call fcn.00408870
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x410650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be786
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x64a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057609b
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00572e9c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f940
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41f94f
mov eax, dword [esi]
jmp 0x41f951
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
test bl, bl
jne 0x41f982
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41f982
cmp dword [esi + 0x14], 8
jb 0x41f975
mov esi, dword [esi]
mov ecx, esi
call fcn.0041f1d0
mov al, 1
pop esi
pop ebx
pop ecx
ret
pop esi
mov al, bl
pop ebx
pop ecx
ret

Function at 0x41f990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfe36
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
xor bl, bl
push 0
push eax
call fcn.0058fee0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41fa8c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00408810
lea edx, [ebp - 0x248]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.0041f370
mov byte [ebp - 4], 1
cmp esi, eax
je 0x41fa2f
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00408f10
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x41fa4d
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00409510
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x41fa88
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00409510
mov al, 1
jmp 0x41fa8e
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x41fab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfe78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
push 0
push 0
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], cx
mov dword [ebp - 4], ecx
test eax, eax
je 0x41fb8e
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movq qword [ebp - 0x1c], xmm0
lea esi, [eax + 1]
push 0x5f19f4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
push esi
call fcn.0041fe20
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x1c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp word [ebx], 0
jne 0x41fb54
xor ecx, ecx
jmp 0x41fb6f
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fb60
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x34]
call fcn.00408a10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub eax, ebx
sar eax, 1
push eax
push ebx
call fcn.00409510
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x41fbb4
mov eax, dword [edi]
jmp 0x41fbb6
mov eax, edi
xor ecx, ecx
push 0xffffffffffffffff
mov word [eax], cx
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, edi
call fcn.00408f10
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0041f280
mov ecx, dword [ebp - 0x20]
cmp ecx, 8
jb 0x41fbe9
inc ecx
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.00409510
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x4211c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push eax
push 0
push 0
mov edi, ecx
mov dword [ebp - 0x210], 0
push edi
push 0
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
js 0x42125e
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x421250
cmp word [ebp - 0x20c], 0
jne 0x421224
xor ecx, ecx
jmp 0x42123f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421230
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00408a10
mov bl, 1
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4212a6
push 1
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4212a6
cmp word [ebp - 0x20c], 0
jne 0x42127d
xor ecx, ecx
jmp 0x421295
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421286
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00408a10
mov bl, 1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4212f8
cmp dword [esi + 0x14], 8
jb 0x4212b7
mov eax, dword [esi]
jmp 0x4212b9
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x4212f8
lea eax, [ecx - 1]
cmp eax, ecx
ja 0x4212ec
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x4212d3
mov esi, dword [esi]
xor ecx, ecx
pop edi
mov word [esi + eax*2], cx
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040d3f0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x42aec0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c1220
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x64a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x42af10
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x42af12
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x42af3b
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x42af3d
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x433a70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be786
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x64a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0057609b
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00572e9c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435a00
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x435aae
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x20c]
push 0x5f8f64
push eax
call fcn.005a6063
add esp, 0xc
test eax, eax
je 0x435aae
cmp word [ebp - 0x20c], 0
jne 0x435a68
xor ecx, ecx
jmp 0x435a80
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435a71
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00408a10
push 1
push 0x5f8f64
mov ecx, esi
call fcn.0040c5a0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x435c70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c21d0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x64a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
sete al
test al, al
je 0x435cc9
mov bl, 1
jmp 0x435e6f
cmp ecx, 0x3c
jbe 0x435ce3
push 1
push 0x5fa59c
mov ecx, esi
call fcn.00408a10
xor bl, bl
jmp 0x435e6f
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00435830
test al, al
jne 0x435d04
push 0x5fcdf4
mov ecx, esi
call fcn.004089c0
xor bl, bl
jmp 0x435e6f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
cmp eax, 3
je 0x435d6c
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x435d2e
mov eax, dword [esi]
jmp 0x435d30
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp dword [edi + 0x14], 8
jb 0x435d3d
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
mov ecx, esi
test eax, eax
je 0x435d5b
push 0x5fa5a4
call fcn.004089c0
xor bl, bl
jmp 0x435e6f
push 0x5fa5a0
call fcn.004089c0
xor bl, bl
jmp 0x435e6f
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x435d9c
mov edx, dword [edi]
jmp 0x435d9e
mov edx, edi
lea eax, [ebp - 0x58]
push eax
call fcn.00435930
add esp, 4
test eax, eax
js 0x435df7
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00435830
test al, al
je 0x435df7
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
cmp eax, 3
je 0x435df7
mov ecx, esi
call fcn.0040b690
push 0x5fa5a4
mov ecx, esi
call fcn.004089c0
lea ecx, [ebp - 0x40]
call fcn.004087d0
lea ecx, [ebp - 0x58]
call fcn.004087d0
xor bl, bl
jmp 0x435e6f
lea ecx, [ebp - 0x40]
call fcn.004087d0
lea ecx, [ebp - 0x58]
call fcn.004087d0
xor eax, eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.00435a00
test al, al
jne 0x435e32
push 0x5fcdf4
jmp 0x435e5e
mov edx, edi
lea ecx, [ebp - 0x70]
call fcn.0040e380
test al, al
jne 0x435e52
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0040e380
test al, al
jne 0x435e52
mov bl, 1
jmp 0x435e67
mov ecx, esi
call fcn.0040b690
push 0x5f84d4
mov ecx, esi
call fcn.004089c0
xor bl, bl
lea ecx, [ebp - 0x70]
call fcn.004087d0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x435e84
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00409510
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x435eb0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x64a070]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x30]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x5f8398
push 0x104
push eax
mov dword [esp + 0x1c], edx
mov edi, ecx
mov dword [esp + 0x20], ebx
call fcn.005a5850
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
add esp, 0xc
movq qword [esp + 0x2c], xmm0
cmp dword [edi + 0x14], 8
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], 0x43
jb 0x435f20
mov eax, dword [edi]
jmp 0x435f22
mov eax, edi
push eax
lea eax, [esp + 0x3c]
push 0x104
push eax
call fcn.005a5850
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x435f7f
cmp dword [edi + 0x14], 8
jb 0x435f45
mov eax, dword [edi]
jmp 0x435f47
mov eax, edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x435f7f
lea eax, [esp + 0x38]
push eax
call esi
test eax, eax
jne 0x435f7f
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x38]
push eax
call ebx
test eax, eax
je 0x435f7b
lea eax, [esp + 0x38]
push eax
call esi
test eax, eax
je 0x435f65
mov ebx, dword [esp + 0x14]
cmp dword [ebx + 0x14], 8
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 0x435ac0
jb 0x435f97
mov ebx, dword [ebx]
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], ebx
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x435fd5
mov ecx, dword [esp + 0x10]
push 1
push 0x5fcdf4
call fcn.00408a10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x436087
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x436022
mov eax, dword [esp + 0x14]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp word [esp + 0x38], 0
jne 0x43602e
xor ecx, ecx
jmp 0x436044
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436035
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call fcn.00408a10
mov esi, dword [esp + 0x10]
mov ecx, esi
push 1
push str.0234
call fcn.00408a10
cmp dword [edi + 0x10], 0
je 0x436087
mov edx, esi
mov ecx, edi
call fcn.00435c70
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x244]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
Function at 0x436240
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x64a070]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov esi, ecx
lea eax, [ebp + 8]
lea ecx, [esp + 0x10]
xor bl, bl
cmp dword [ebp + 0x1c], 8
xorps xmm0, xmm0
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x10]
movlpd qword [esp + 0x18], xmm0
push ecx
push eax
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4362af
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
cmp eax, dword [ebp + 0x24]
jb 0x4362af
ja 0x4362ad
cmp ecx, dword [ebp + 0x20]
jb 0x4362af
mov bl, 1
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x4362c4
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00409510
mov ecx, dword [esp + 0x24]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret