joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420500
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004e3100
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x568d14
push eax
mov esi, ecx
call fcn.00424b70
mov edi, eax
add esp, 8
test edi, edi
je 0x4205d6
push edi
push 0x10000
lea eax, [ebp - 0x10004]
mov dword [esi + 0x10], 0
push 1
push eax
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0051104c
add esp, 0x10
test eax, eax
je 0x4205aa
nop
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.00435dc0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.0051104c
add esp, 0x10
test eax, eax
jne 0x420580
mov ecx, esi
call fcn.004242a0
push edi
call fcn.00510dec
movups xmm0, xmmword [esi + 0x58]
add esp, 4
mov al, 1
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2448
mov esp, ebp
pop ebp
ret 8

Function at 0x422780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x42278e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42279e
xor al, al
pop ebp
ret
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x423560
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push esi
mov esi, dword [ebp + 8]
push edi
je 0x423584
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x423578
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0x10
jb 0x42358c
mov esi, dword [esi]
push 0x568d1c
push esi
call fcn.00424b70
mov esi, eax
add esp, 8
test esi, esi
jne 0x4235a6
pop edi
xor al, al
pop esi
pop ebp
ret
mov edi, dword [ebp + 0x10]
push ebx
mov bl, 1
test edi, edi
je 0x4235c4
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0051215b
add esp, 0x10
cmp eax, edi
sete bl
push esi
call fcn.00510dec
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4235e0
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004e3100
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
je 0x423625
push esi
call fcn.0042ba20
add esp, 4
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x423619
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [edi + 0x14], 0x10
jb 0x42362d
mov edi, dword [edi]
push 0x568d14
push edi
call fcn.00424b70
mov edi, eax
add esp, 8
test edi, edi
je 0x423666
cmp dword [esi + 0x14], 0x10
jb 0x423649
mov esi, dword [esi]
push 0x568d18
push esi
call fcn.00424b70
add esp, 8
mov esi, eax
push edi
test esi, esi
jne 0x423679
call fcn.00510dec
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.0051104c
add esp, 0x10
test eax, eax
je 0x4236be
push esi
push eax
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.0051215b
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.0051104c
add esp, 0x20
test eax, eax
jne 0x423693
push edi
call fcn.00510dec
push esi
call fcn.00510dec
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.004e2448
mov esp, ebp
pop ebp
ret
Function at 0x4236e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5446fd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x423729
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x42371d
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0x10
jb 0x423731
mov esi, dword [esi]
test esi, esi
mov dword [ebp - 0x18], 0
mov edx, 0x5656bf
mov dword [ebp - 0x14], 0
cmovne edx, esi
xorps xmm0, xmm0
mov ecx, edx
movups xmmword [ebp - 0x28], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423755
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00401440
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00424d90
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x423787
mov eax, dword [eax]
push eax
call fcn.00510c58
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x4237c8
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4237be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42382c
push ecx
push edx
call fcn.004e243a
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 0x10
jb 0x42380c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x423802
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42382c
push ecx
push edx
call fcn.004e243a
add esp, 8
test esi, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3

Function at 0x423840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x42384e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42385e
xor al, al
pop ebp
ret
shr eax, 4
not al
and al, 1
pop ebp
ret
Function at 0x423ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x423ac2
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x423acd
mov eax, dword [eax]
push 0x568d14
push eax
call fcn.00424b70
mov esi, eax
add esp, 8
mov dword [ebp + 0xc], esi
test esi, esi
jne 0x423aea
pop esi
xor al, al
pop ebx
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.00511566
push esi
call fcn.00511da8
mov esi, dword [ebp + 0x14]
mov edi, eax
cmp edi, esi
push 0
cmovl esi, edi
push esi
push dword [ebp + 0xc]
call fcn.00511566
sub edi, esi
add esp, 0x1c
xor esi, esi
test edi, edi
jle 0x423c2c
movsd xmm0, qword [0x568fc0]
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x423c2c
cmp dword [ebp + 0x10], edi
mov edx, dword [ebx + 8]
cmovl edi, dword [ebp + 0x10]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp + 8], edi
cmp edi, edx
jbe 0x423bd9
cmp edi, 0x7fffffff
ja 0x423c41
mov esi, edx
mov eax, 0x7fffffff
shr esi, 1
sub eax, esi
cmp edx, eax
jbe 0x423b74
mov esi, 0x7fffffff
jmp 0x423b7b
add esi, edx
cmp esi, edi
cmovb esi, edi
test ecx, ecx
je 0x423bbf
cmp edx, 0x1000
jb 0x423ba1
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
mov dword [ebp + 8], eax
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x423c46
mov ecx, dword [ebp + 8]
push edx
push ecx
call fcn.004e243a
mov dword [ebx], 0
add esp, 8
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push esi
mov ecx, ebx
call fcn.00437130
mov esi, dword [ebx]
push edi
push 0
push esi
call fcn.004e53e0
add esp, 0xc
add esi, edi
jmp 0x423c12
mov esi, dword [ebx + 4]
sub esi, ecx
cmp edi, esi
jbe 0x423c03
push esi
push 0
push ecx
call fcn.004e53e0
sub edi, esi
mov esi, dword [ebx + 4]
push edi
push 0
push esi
call fcn.004e53e0
add esp, 0x18
add esi, edi
mov edi, dword [ebp + 8]
jmp 0x423c12
push edi
push 0
push ecx
lea esi, [ecx + edi]
call fcn.004e53e0
add esp, 0xc
mov dword [ebx + 4], esi
mov eax, dword [ebx]
sub esi, eax
je 0x423c4b
push dword [ebp + 0xc]
push edi
push 1
push eax
call fcn.0051104c
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
call fcn.00510dec
add esp, 4
cmp esi, edi
sete al
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00438140
call fcn.004f1758
call fcn.00438180
int3
Function at 0x423ff0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5447bd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00424d90
add esp, 8
mov esi, eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x424045
mov esi, dword [esi]
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00424d90
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x42405a
mov eax, dword [eax]
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
test eax, eax
sete byte [ebp - 0x41]
cmp ecx, 8
jb 0x4240a4
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42409a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424184
push ecx
push edx
call fcn.004e243a
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp ecx, 8
jb 0x4240f9
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4240ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424184
push ecx
push edx
call fcn.004e243a
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp byte [ebp - 0x41], al
je 0x424159
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x424177
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x424129
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42413e
shr eax, 4
not al
test al, 1
jne 0x424177
push 1
push edi
push ebx
call fcn.004235e0
add esp, 0xc
test al, al
je 0x424177
push 1
push ebx
call fcn.004236e0
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x424180
mov dword [eax], esi
xor al, al
jmp 0x42415b
call fcn.004f1758
int3
Function at 0x4241d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push esi
mov esi, dword [ebp + 8]
push edi
je 0x4241fd
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4241e8
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.0042ba20
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x424205
mov esi, dword [esi]
push 0x568d18
push esi
call fcn.00424b70
mov esi, eax
add esp, 8
test esi, esi
jne 0x42421f
pop edi
xor al, al
pop esi
pop ebp
ret
mov edi, dword [ebp + 0x10]
push ebx
mov bl, 1
test edi, edi
je 0x42423d
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0051215b
add esp, 0x10
cmp eax, edi
sete bl
push esi
call fcn.00510dec
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x424a20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x144], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x424a64
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x144]
push eax
push esi
call sub.KERNEL32.dll_Process32First
push ebx
nop dword [eax]
nop word [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x120]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424aa0
sub eax, edx
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401440
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
mov eax, edi
cmovae ecx, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 0x10
jb 0x424ace
mov eax, dword [edi]
push ecx
push eax
call fcn.0050ec46
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
sete bl
cmp ecx, 0x10
jb 0x424b0d
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424b03
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424b5e
push ecx
push edx
call fcn.004e243a
add esp, 8
test bl, bl
jne 0x424b40
lea eax, [ebp - 0x144]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x424a80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x13c]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3
Function at 0x424e70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xa4], ebx
je 0x424eb6
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
push 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push 0x5656bf
jmp 0x424f6e
push esi
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x90], 0
push eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
call fcn.00435dc0
lea ecx, [ebp - 0xa0]
call fcn.004242a0
movups xmm0, xmmword [ebp - 0x48]
xor esi, esi
lea edi, [ebp - 0x28]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x38]
push eax
push str._02X
push edi
call fcn.00439b50
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x424f20
xorps xmm0, xmm0
mov byte [ebp - 8], 0
movups xmmword [ebx], xmm0
lea ecx, [ebp - 0x28]
mov dword [ebx + 0x10], 0
pop edi
mov dword [ebx + 0x14], 0
lea edx, [ecx + 1]
pop esi
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424f60
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
mov ecx, ebx
call fcn.00401440
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004e2448
mov esp, ebp
pop ebp
ret

Function at 0x425040
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8078
call fcn.004e3100
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0
push dword [ebp + 0x18]
mov dword [ebp - 0x8070], edi
push ebx
mov dword [ebp - 0x8074], edi
mov dword [ebp - 0x8070], ebx
call fcn.00511566
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4250b9
xorps xmm0, xmm0
mov ecx, edi
push 0
movups xmmword [edi], xmm0
push 0x5656bf
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00401440
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x14]
mov eax, 0x8000
cmp esi, eax
mov dword [ebp - 0x805c], 0
push ebx
cmovb eax, esi
mov dword [ebp - 0x8058], 0
push eax
lea eax, [ebp - 0x8004]
mov dword [ebp - 0x806c], 0x67452301
push 1
push eax
mov dword [ebp - 0x8068], 0xefcdab89
mov dword [ebp - 0x8064], 0x98badcfe
mov dword [ebp - 0x8060], 0x10325476
call fcn.0051104c
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x425160
mov edi, dword [ebp - 0x8070]
push ebx
lea eax, [ebp - 0x8004]
push eax
lea ecx, [ebp - 0x806c]
call fcn.00435dc0
sub esi, ebx
mov eax, 0x8000
cmp esi, eax
push edi
cmovb eax, esi
push eax
lea eax, [ebp - 0x8004]
push 1
push eax
call fcn.0051104c
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x425122
mov edi, dword [ebp - 0x8074]
lea ecx, [ebp - 0x806c]
call fcn.004242a0
push 0x10
lea eax, [ebp - 0x8014]
push eax
push edi
call fcn.004217c0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.004e2448
mov esp, ebp
pop ebp
ret
Function at 0x427470
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544e8d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00427320
add esp, 8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x4274fc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00424d90
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4274ce
mov eax, dword [eax]
push 0
push 0
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.004072b0
test esi, esi
je 0x4274fc
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
shrd esi, eax, 0x14
shr eax, 0x14
test eax, eax
je 0x4274ff
or esi, 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x42752f
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x427525
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42754b
push ecx
push edx
call fcn.004e243a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3
Function at 0x4287f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5450b6
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x24c], esi
call fcn.004e53e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.004e571b
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428870
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x428969
call fcn.004031c0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00434600
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00429370
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0x10
jb 0x42891a
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x428910
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4289ae
push ecx
push edx
call fcn.004e243a
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x428991
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x428987
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4289ae
jmp 0x428987
call fcn.004031c0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00434600
add esp, 8
jmp 0x428935
push ecx
push edx
call fcn.004e243a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3
Function at 0x429a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545376
mov eax, dword fs:[0]
push eax
mov eax, 0x1fb8
call fcn.004e3100
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1f8c]
push 0x1f7c
push 0
push eax
mov dword [ebp - 0x1fc0], esi
call fcn.004e53e0
add esp, 0xc
lea eax, [ebp - 0x1f8c]
push eax
push 0xfa0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x1f8c]
push 0x7e
push eax
call fcn.004e571b
lea ecx, [ebp - 0x1f8c]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429a90
sub ecx, edi
mov dword [ebp - 0x1f94], 0
sar ecx, 1
lea eax, [ebp - 0x1f8c]
mov dword [ebp - 0x1f90], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x1fa4]
movups xmmword [ebp - 0x1fa4], xmm0
push eax
test edx, edx
je 0x429b89
call fcn.004031c0
lea eax, [ebp - 0x1fa4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1fbc]
push eax
call fcn.00434600
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00429370
mov ecx, dword [ebp - 0x1fa8]
add esp, 0x10
cmp ecx, 0x10
jb 0x429b3a
mov edx, dword [ebp - 0x1fbc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x429b30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x429bce
push ecx
push edx
call fcn.004e243a
add esp, 8
mov dword [ebp - 0x1fac], 0
mov dword [ebp - 0x1fa8], 0xf
mov byte [ebp - 0x1fbc], 0
mov ecx, dword [ebp - 0x1f90]
cmp ecx, 8
jb 0x429bb1
mov edx, dword [ebp - 0x1fa4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429ba7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x429bce
jmp 0x429ba7
call fcn.004031c0
lea eax, [ebp - 0x1fa4]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00434600
add esp, 8
jmp 0x429b55
push ecx
push edx
call fcn.004e243a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3