joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b2a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrolActiveX
lea ecx, [ebp - 0x24]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
cmp byte [ebp - 0x24], 0x50
je 0x49b444
test eax, eax
jle 0x49b2f0
push str.SoftwareBillP_StudiosWinPatrolActiveX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [0x4c6448]
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolActiveX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x49b32e
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4c0040
lea ecx, [ebp - 0x130]
push 0x104
push ecx
call fcn.00402830
add esp, 0xc
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrolActiveX
lea ecx, [ebp - 0x130]
mov edx, 0x80000001
call fcn.0048e390
add esp, 8
cmp dword [0x4cd38c], 0
je 0x49b372
call fcn.0048fcc0
call fcn.00402120
xor esi, esi
cmp dword [0x4cd38c], esi
jle 0x49b444
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esi*4 + 0x4cd390]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x49b3e2
lea edi, [eax + 0x184]
push edi
call ebx
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x130]
mov eax, 0x104
jne 0x49b3cb
push str.No_path_available
call fcn.00401000
push str.No_path_available
jmp 0x49b3d2
push edi
call fcn.00401000
push edi
call ebx
mov eax, dword [esi*4 + 0x4cd390]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esi*4 + 0x4cd390]
push ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x49b40a
mov edx, dword [esi*4 + 0x4cd390]
mov edi, dword [eax + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0x4b7c94
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00402830
lea ecx, [ebp - 0x130]
push ecx
push str.SoftwareBillP_StudiosWinPatrolActiveX
lea ecx, [ebp - 0x24]
mov edx, 0x80000001
call fcn.0048e390
inc esi
add esp, 0x18
cmp esi, dword [0x4cd38c]
jl 0x49b38b
cmp dword [0x4cd38c], 0
je 0x49b452
call fcn.0048fcc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x4a01d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c32cc]
jne 0x4a01e0
repz ret
jmp fcn.004a337d

Function at 0x4a0962
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4a0989
call fcn.004a4429
mov dword [eax], esi
call fcn.004a4416
push 0x16
pop esi
mov dword [eax], esi
call fcn.004a43c4
mov eax, esi
jmp 0x4a09de
test dword [ebp + 0xc], 0xfffffff9
jne 0x4a096f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4a09b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a443c
pop ecx
call fcn.004a4416
mov eax, dword [eax]
jmp 0x4a09de
test al, 0x10
jne 0x4a09dc
test al, 1
je 0x4a09dc
test byte [ebp + 0xc], 2
je 0x4a09dc
call fcn.004a4429
mov dword [eax], 5
call fcn.004a4416
mov dword [eax], 0xd
jmp 0x4a09ad
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4aa932
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a51e6
and dword [ebp - 0x14], 0
cmp dword [0x4c71dc], 0
mov dword [ebp - 0x18], eax
jne 0x4aa9e5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4aaa8d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4aaa8d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c71dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c71e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c71e4], eax
call edi
push eax
call esi
mov dword [0x4c71ec], eax
test eax, eax
je 0x4aa9e5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c71e8], eax
mov eax, dword [0x4c71e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4aaa3e
cmp dword [0x4c71ec], ecx
je 0x4aaa3e
push eax
call esi
push dword [0x4c71ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4aaa3e
test ebx, ebx
je 0x4aaa3e
call edi
test eax, eax
je 0x4aaa35
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4aaa35
test byte [ebp - 8], 1
jne 0x4aaa3e
or dword [ebp + 0x10], 0x200000
jmp 0x4aaa71
mov eax, dword [0x4c71e0]
cmp eax, dword [ebp - 0x18]
je 0x4aaa71
push eax
call esi
test eax, eax
je 0x4aaa71
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4aaa71
mov eax, dword [0x4c71e4]
cmp eax, dword [ebp - 0x18]
je 0x4aaa71
push eax
call esi
test eax, eax
je 0x4aaa71
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c71dc]
call esi
test eax, eax
je 0x4aaa8d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4aaa8f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
leave
ret
Function at 0x302068
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push 1
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebp, eax
add esp, 8
mov ecx, ebp
xor eax, eax
test esi, esi
jle 0x302132
cmp esi, 6
jl 0x30211d
mov dword [esp], ebp
lea edx, [eax + edi]
mov ebx, dword [esp + 0x18]
movsx ebx, byte [eax + ebx]
cmp ebx, 0x20
je 0x3021f1
mov byte [ecx], bl
movsx ebx, byte [edx + 1]
add ecx, 1
cmp ebx, 0x20
je 0x302221
mov byte [ecx], bl
movsx ebx, byte [edx + 2]
cmp ebx, 0x20
je 0x302215
mov byte [ecx + 1], bl
movsx ebx, byte [edx + 3]
cmp ebx, 0x20
je 0x302209
mov byte [ecx + 2], bl
movsx ebx, byte [edx + 4]
cmp ebx, 0x20
je 0x3021fd
mov byte [ecx + 3], bl
mov ebx, dword [esp + 0x20]
add edx, 5
add eax, 5
add ecx, 4
lea ebp, [ebx - 6]
cmp eax, ebp
jle 0x3020a5
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
movsx edx, byte [eax + edi]
cmp edx, 0x20
je 0x302132
mov byte [ecx], dl
add eax, 1
add ecx, 1
cmp eax, esi
jl 0x30211d
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
mov edi, eax
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
test edi, edi
je 0x3021dc
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x302163
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x302157
mov ecx, eax
cmp ecx, ebx
jle 0x302182
lea eax, [ebx - 1]
push eax
push 0x20
mov edx, dword [esp + 0x24]
push edx
call fcn.00311ff4
add esp, 0xc
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [esp + 0x1c]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x302186
cmp ecx, ebx
jge 0x3021d6
mov edx, ebx
sub edx, ecx
cmp edx, 6
jl 0x3021c7
mov esi, dword [esp + 0x1c]
lea ebp, [ebx - 6]
mov edx, 0x20
mov byte [ecx + esi], dl
mov byte [ecx + esi + 1], dl
mov byte [ecx + esi + 2], dl
mov byte [ecx + esi + 3], dl
mov byte [ecx + esi + 4], dl
add ecx, 5
cmp ecx, ebp
jle 0x3021a8
mov edx, dword [esp + 0x1c]
mov byte [ecx + edx], 0x20
add ecx, 1
cmp ecx, ebx
jl 0x3021cb
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
push ebx
push 0x20
mov eax, dword [esp + 0x24]
push eax
call fcn.00311ff4
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
jmp 0x302132
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
jmp 0x302132
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
jmp 0x302132
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
jmp 0x302132
mov ebp, dword [esp]
mov ebx, dword [esp + 0x24]
jmp 0x302132
Function at 0x30229c
Capabilities:
Get session user name

Disassembly:
push esi
push ebx
sub esp, 0x48
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x58]
mov dword [esp], 0x41
lea edx, [esp + 4]
lea eax, [esp]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x30230d
mov eax, dword [esp]
cmp eax, ebx
jae 0x3022f8
lea edx, [esp + 4]
add eax, 0xffffffff
push eax
push edx
push esi
call fcn.00312070
mov eax, dword [esp + 0xc]
lea edx, [eax + esi - 1]
sub ebx, eax
add ebx, 1
push ebx
push 0x20
push edx
call fcn.00311ff4
add esp, 0x18
add esp, 0x48
pop ebx
pop esi
ret
lea eax, [esp + 4]
push ebx
push eax
push esi
call fcn.00312070
add esp, 0xc
add esp, 0x48
pop ebx
pop esi
ret
push ebx
push 0x20
push esi
call fcn.00311ff4
add esp, 0x54
pop ebx
pop esi
ret

Function at 0x302500
Capabilities:
Get hostname

Disassembly:
push edi
push ebx
sub esp, 0x14
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], 0xf
lea edx, [esp + 4]
lea eax, [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x30256b
mov eax, dword [esp]
cmp eax, ebx
ja 0x302554
lea edx, [esp + 4]
push eax
push edx
push edi
call fcn.00312070
mov eax, dword [esp + 0xc]
lea edx, [edi + eax]
sub ebx, eax
push ebx
push 0x20
push edx
call fcn.00311ff4
xor eax, eax
add esp, 0x2c
pop ebx
pop edi
ret
lea eax, [esp + 4]
push ebx
push eax
push edi
call fcn.00312070
mov eax, 0xffffffff
add esp, 0x20
pop ebx
pop edi
ret
push ebx
push 0x20
push edi
call fcn.00311ff4
mov eax, 1
add esp, 0x20
pop ebx
pop edi
ret

Function at 0x303a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jl 0x303aca
cmp eax, 0xf
jg 0x303aca
mov ebp, dword [eax*4 + 0x318060]
test ebp, ebp
je 0x303aca
cmp ebp, 9
je 0x303aee
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 8]
cmp eax, dword [edx]
jne 0x303aca
push ebp
call dword [sym.imp.MSVCRT.dll_raise]
pop ecx
test eax, eax
je 0x303b0f
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
mov eax, 0x16
add esp, 0x14
pop ebp
ret
mov eax, dword [esp + 8]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x303b22
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x303b13
xor eax, eax
pop ebp
ret
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
pop ebp
ret
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
pop ebp
ret
Function at 0x303e70
Capabilities:
Move file

Disassembly:
push edi
push ebp
push ebx
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.00305630
mov edi, eax
add esp, 8
test edi, edi
je 0x303f13
push dword [esp + 0x1c]
push dword [esp + 0x18]
call fcn.00305630
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x303ee9
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_rename]
mov ebp, eax
push edi
call fcn.00305718
push ebx
call fcn.00305718
add esp, 0x10
test ebp, ebp
je 0x303ee3
call dword [sym.imp.MSVCRT.dll__errno]
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call dword [0x31c7b4]
add esp, 0x14
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
pop ebx
pop ebp
pop edi
ret
xor eax, eax
pop ebx
pop ebp
pop edi
ret
push edi
call fcn.00305718
pop ecx
call dword [sym.imp.MSVCRT.dll__errno]
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call dword [0x31c7b4]
add esp, 0x14
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
pop ebx
pop ebp
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call dword [0x31c7b4]
add esp, 0x14
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
pop ebx
pop ebp
pop edi
ret
Function at 0x3052e0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x58
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0x112]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
add esp, 8
lea edx, [ebp + 0x112]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x305325
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, ebx
mov edx, 0x31d214
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x305338
mov edi, ebx
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x30535e
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x305352
mov esi, eax
lea edx, [ebp + 1]
push edx
push dword [esp + 0x70]
push ebx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea edx, [ebp + ebx]
lea edx, [edx + esi - 1]
movsx ecx, byte [edx]
cmp ecx, 0x20
jne 0x30538e
movsx ecx, byte [edx - 1]
add edx, 0xffffffff
cmp ecx, 0x20
je 0x305382
xor ecx, ecx
mov byte [edx + 1], cl
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp], 0x44
lea ecx, [esp]
xor ebp, ebp
lea edx, [esp + 0x44]
push edx
push ecx
push ebp
push ebp
push ebp
push 1
push ebp
push ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x30545a
push 0xffffffffffffffff
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x305420
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop ebp
pop esi
pop edi
ret
lea edx, [esp + 0x54]
push edx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x305446
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x58]
add esp, 0x5c
pop ebx
pop ebp
pop esi
pop edi
ret
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop ebp
pop esi
pop edi
ret
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x305a2c
Capabilities:
Set current directory

Disassembly:
push esi
mov eax, dword [esp + 8]
mov byte [esp], 0x41
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
movsx edx, byte [eax]
push edx
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
movsx eax, al
mov byte [esp], al
cmp eax, 0x41
jl 0x305a74
cmp eax, 0x5a
jg 0x305a74
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x305a95
mov eax, 1
pop ecx
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
add esp, 0x14
xor eax, eax
pop ecx
ret
call fcn.003057f4
xor eax, eax
pop ecx
ret

Function at 0x305aa0
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00305630
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x305ad6
push ebx
call dword [sym.imp.MSVCRT.dll__rmdir]
mov ebp, eax
push ebx
call fcn.00305718
add esp, 8
test ebp, ebp
jne 0x305ad6
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x305adc
Capabilities:
Get common file path
Get disk information

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov eax, dword [esp + 0x20]
lea esi, [eax + 1]
mov edx, 0x104
mov byte [esp], 0x20
cmp esi, 0x104
jl 0x305afd
mov esi, edx
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0x2e
mov byte [esp + 4], 0
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x305be8
mov edx, dword [esp + 0x1c]
movsx ecx, byte [edx]
push ecx
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_isalpha]
pop ecx
test eax, eax
je 0x305ba8
mov edx, dword [esp + 0x1c]
movsx ecx, byte [edx]
push ecx
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
mov byte [esp + 2], 0x5c
mov byte [esp], al
lea edx, [esp]
mov byte [esp + 3], 0x2e
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
jne 0x305b83
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0xd
mov dword [eax], edx
xor ecx, ecx
push ecx
push ecx
push ecx
push edx
push ecx
call dword [0x31c7b4]
add esp, 0x14
jmp 0x305bb6
cmp eax, 1
je 0x305b64
mov byte [esp + 2], 0x2e
lea ecx, [esp]
xor edx, edx
mov byte [esp + 3], dl
push edx
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ebx, eax
test ebx, ebx
je 0x305bda
jmp 0x305bb6
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x305be1
push ebx
mov edx, dword [esp + 0x24]
push edx
push ebp
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0030572c
mov ebx, eax
push ebp
call dword [sym.imp.MSVCRT.dll_free]
mov eax, ebx
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
call fcn.003057f4
jmp 0x305bb6
call fcn.003057f4
jmp 0x305bb6
mov eax, dword [esp + 0x20]
push eax
push 0x20
mov edx, dword [esp + 0x24]
push edx
call fcn.00311ff4
add esp, 0xc
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0xc
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
xor eax, eax
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x305c20
Capabilities:
Get disk size

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov byte [esp], 0x20
mov eax, 0xffffffff
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
mov dword [edi], eax
mov dword [esi], eax
movsx eax, byte [ebx]
cmp eax, 0x20
jne 0x305c5b
xor ebp, ebp
jmp 0x305cac
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
movsx eax, al
cmp eax, 0x41
jl 0x305c70
cmp eax, 0x5a
jle 0x305ca6
cmp eax, 0x2f
je 0x305dab
cmp eax, 0x5c
je 0x305dab
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
xor eax, eax
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
mov byte [esp], al
lea ebp, [esp]
lea eax, [esp + 0x10]
lea ebx, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push edx
push ecx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, eax
test ebp, ebp
je 0x305cdc
lea edx, [esp]
cmp ebp, edx
je 0x305cdc
push ebp
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
test ebx, ebx
je 0x305d87
mov eax, dword [esp + 0x10]
mul dword [esp + 0xc]
mov ebp, eax
mov ebx, edx
push ebx
push ebp
push 0
push dword [esp + 0x10]
call fcn.00311e20
mov ecx, eax
sub ecx, 0x7fffffff
sbb edx, 0
jl 0x305d0e
or ecx, edx
jne 0x305d12
mov dword [edi], eax
jmp 0x305d35
mov dword [edi], 0xffffffff
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, 0x22
mov dword [eax], ecx
xor edi, edi
push edi
push edi
push edi
push ecx
push edi
call dword [0x31c7b4]
add esp, 0x14
push ebx
push ebp
push 0
push dword [esp + 0x14]
call fcn.00311e20
mov ecx, eax
sub ecx, 0x7fffffff
sbb edx, 0
jl 0x305d53
or ecx, edx
jne 0x305d57
mov dword [esi], eax
jmp 0x305d7a
mov dword [esi], 0xffffffff
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x22
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
add esp, 0x14
mov eax, 1
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 2
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
xor eax, eax
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
cmp al, byte [ebx + 1]
jne 0x305c82
push dword [esp + 0x34]
push ebx
call fcn.00305630
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x305cac
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x305dd8
Capabilities:
Get disk size

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov byte [esp], 0x20
mov eax, 0xffffffff
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
movsx eax, byte [esi]
cmp eax, 0x20
jne 0x305e1a
xor edi, edi
jmp 0x305e6b
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
movsx eax, al
cmp eax, 0x41
jl 0x305e2f
cmp eax, 0x5a
jle 0x305e65
cmp eax, 0x2f
je 0x305f10
cmp eax, 0x5c
je 0x305f10
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
xor eax, eax
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
mov byte [esp], al
lea edi, [esp]
lea eax, [esp + 0x10]
lea esi, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push edx
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, eax
test edi, edi
je 0x305e9b
lea edx, [esp]
cmp edi, edx
je 0x305e9b
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
test esi, esi
je 0x305eec
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
xor esi, esi
mov dword [ebp + 4], esi
mov dword [ebp], eax
mov dword [ebx], eax
mov dword [ebx + 4], esi
push dword [ebp + 4]
push dword [ebp]
push esi
push dword [esp + 0x10]
call fcn.00311e20
mov dword [ebp], eax
mov dword [ebp + 4], edx
push dword [ebx + 4]
push dword [ebx]
push esi
push dword [esp + 0x14]
call fcn.00311e20
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 1
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 2
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call dword [0x31c7b4]
xor eax, eax
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
cmp al, byte [esi + 1]
jne 0x305e41
push dword [esp + 0x34]
push esi
call fcn.00305630
mov edi, eax
add esp, 8
test edi, edi
jne 0x305e6b
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x305f3c
Capabilities:
Get disk information

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edx, edx
test ebx, ebx
jle 0x305fb0
mov edi, dword [esp + 0x10]
lea esi, [edi + edx]
test al, 1
je 0x305f61
lea ecx, [edx + 0x41]
mov byte [esi], cl
jmp 0x305f64
mov byte [esi], 0x20
sar eax, 1
add edx, 1
cmp edx, ebx
jge 0x305fb0
cmp edx, 0x20
jl 0x305f53
mov eax, ebx
sub eax, edx
cmp eax, 6
jl 0x305fa1
mov esi, dword [esp + 0x10]
lea eax, [ebx - 6]
mov ecx, 0x20
mov byte [edx + esi], cl
mov byte [edx + esi + 1], cl
mov byte [edx + esi + 2], cl
mov byte [edx + esi + 3], cl
mov byte [edx + esi + 4], cl
add edx, 5
cmp edx, eax
jle 0x305f82
mov eax, dword [esp + 0x10]
mov byte [edx + eax], 0x20
add edx, 1
cmp edx, ebx
jl 0x305fa5
pop ebx
pop esi
pop edi
ret