joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe9da
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp dword [0x537b60], 0xffffffff
jne 0x4fea05
push 0
push 0x1776
call fcn.00415c87
push eax
call fcn.004fdac4
xor eax, eax
jmp 0x4fec4e
cmp dword [0x528aa8], 0
je 0x4fea14
push esi
call fcn.00408970
mov ebx, dword [0x537b78]
test ebx, ebx
je 0x4fea43
cmp dword [ebx + 0x18], 0xffffffff
jne 0x4fea3c
mov edi, dword [ebx + 0x30]
push ebx
push dword [0x537b78]
call fcn.0049dd87
mov dword [0x537b78], eax
mov ebx, edi
jmp 0x4fea1a
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x4fea1e
cmp dword [0x537b78], 0
je 0x4fea86
test esi, esi
je 0x4fea72
cmp byte [esi], 0
je 0x4fea72
push dword [ebp + 0xc]
push 0
push esi
push dword [0x537b78]
call fcn.0049d9f0
mov edi, eax
test edi, edi
je 0x4fea72
mov dword [0x537b78], edi
mov eax, dword [0x537b78]
mov edx, dword [eax + 0x18]
mov dword [ebp + 0xc], edx
mov dword [eax + 0x18], 0xffffffff
mov esi, dword [eax]
test esi, esi
je 0x4fea8f
cmp byte [esi], 0
jne 0x4fea99
mov eax, 1
jmp 0x4fec4e
cmp dword [0x52e554], 0
je 0x4feab9
push dword [ebp + 0xc]
push esi
call fcn.0046786c
test eax, eax
je 0x4feab9
mov eax, 1
jmp 0x4fec4e
push 1
call fcn.004f1449
push esi
call fcn.005183dc
pop ecx
mov edi, eax
push 0
push edi
push esi
push dword [0x537b60]
call sub.WSOCK32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4feb9b
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
cmp ebx, 0x2733
jne 0x4feb2e
mov eax, dword [0x537b78]
test eax, eax
je 0x4feb07
cmp esi, dword [eax]
jne 0x4feb07
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x18], edx
xor esi, esi
test esi, esi
je 0x4feb27
push 0
push 0
push esi
push dword [0x537b78]
call fcn.0049d9f0
mov edi, eax
test edi, edi
je 0x4feb27
mov dword [0x537b78], edi
xor eax, eax
jmp 0x4fec4e
test ebx, ebx
je 0x4feb7b
push ebx
call fcn.004fda18
push eax
push 0
push 0x1777
call fcn.00415c87
push eax
push 0x5535b5
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor edx, edx
mov dword [0x534c34], edx
mov dword [0x534c44], 1
push dword [0x52a384]
push 0x5535b5
push dword [0x537430]
call fcn.004c8c63
push 0
call fcn.004fde43
push 0
push 0x5e3
call fcn.00415c87
push eax
call fcn.004fdac4
xor eax, eax
jmp 0x4fec4e
test ebx, ebx
jg 0x4feba1
xor ebx, ebx
cmp edi, ebx
jle 0x4febca
push 0
push 0
lea eax, [ebx + esi]
push eax
push dword [0x537b78]
call fcn.0049dbfe
mov edi, eax
test edi, edi
je 0x4febc4
mov dword [0x537b78], edi
mov byte [esi + ebx], 0
mov edi, ebx
mov eax, dword [0x52e56c]
test eax, eax
jle 0x4febe3
add eax, edi
sar eax, 1
jns 0x4febdc
adc eax, 0
mov dword [0x52e56c], eax
jmp 0x4febe9
mov dword [0x52e56c], edi
add dword [0x52e568], edi
mov eax, dword [0x52e558]
cmp eax, dword [0x52e568]
jge 0x4fec01
mov dword [0x52e568], eax
cmp dword [0x529424], 0
je 0x4fec2c
push 0x52feac
push str._sdebug.log
push 0x5535b5
call sub.USER32.dll_wsprintfA
add esp, 0xc
push esi
push 0x5535b5
call fcn.00415b54
cmp dword [0x537b78], 0
je 0x4fec49
push 0
push 0
push 0x44d
push dword [0x537420]
call sub.USER32.dll_PostMessageA
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4ff138
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, 0x565108
cmp dword [0x537b60], 0xffffffff
jne 0x4ff156
xor eax, eax
jmp 0x4ff3a8
push 2
call fcn.004f1449
cmp dword [0x52b4d0], 0
je 0x4ff16b
call fcn.004fefc1
mov eax, esi
shr eax, 0x10
and ax, 0xffff
test ax, ax
je 0x4ff181
movzx ebx, ax
jmp 0x4ff238
cmp dword [0x537b70], 0
jne 0x4ff193
cmp dword [0x537b74], 0
je 0x4ff19a
xor eax, eax
jmp 0x4ff3a8
cmp dword [0x537b6c], 0x14
jl 0x4ff204
mov dword [0x537b6c], 0xa
push 2
push 0
push 0
push 0
push ebx
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4ff1f4
mov eax, dword [ebx + 4]
cmp eax, 0x40e
je 0x4ff1f4
cmp eax, 0x12
je 0x4ff1f4
push 3
push 0
push 0
push 0
push ebx
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4ff1f4
mov ecx, ebx
mov edx, 6
push dword [ecx + edx*4]
dec edx
jns 0x4ff1e7
call fcn.004a9c31
jmp 0x4ff1ad
cmp dword [0x537b60], 0xffffffff
jne 0x4ff204
xor eax, eax
jmp 0x4ff3a8
push 0
push 0x3b5
push 0x565f17
push dword [0x537b60]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ff293
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
cmp ebx, 0x2733
jne 0x4ff238
xor eax, eax
jmp 0x4ff3a8
test ebx, ebx
je 0x4ff348
cmp dword [0x52b4d4], 0
je 0x4ff348
push ebx
call fcn.004fda18
push eax
push str.__s
push 0x5584e6
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor edx, edx
mov dword [0x534c34], edx
mov dword [0x534c44], 1
push dword [0x52a384]
push 0x5584e6
push dword [0x537430]
call fcn.004c8c63
jmp 0x4ff348
test esi, esi
jle 0x4ff348
mov byte [esi + 0x565f17], 0
mov dword [0x537b70], 1
xor edi, edi
mov ebx, 0x565f17
cmp esi, edi
jle 0x4ff33b
mov al, byte [ebx]
cmp al, 0xd
je 0x4ff335
cmp al, 0xa
jne 0x4ff2ef
mov edx, dword [0x537b98]
mov byte [edx + 0x565b30], 0
xor ecx, ecx
mov dword [0x537b98], ecx
cmp byte [0x565b30], 0
je 0x4ff335
push 0x565b30
call fcn.004954e0
jmp 0x4ff335
mov eax, dword [0x537b98]
mov dl, byte [ebx]
mov byte [eax + 0x565b30], dl
inc dword [0x537b98]
cmp dword [0x537b98], 0x383
jl 0x4ff335
mov ecx, dword [0x537b98]
mov byte [ecx + 0x565b30], 0
xor eax, eax
mov dword [0x537b98], eax
cmp byte [0x565b30], 0
je 0x4ff335
push 0x565b30
call fcn.004954e0
inc edi
inc ebx
cmp esi, edi
jg 0x4ff2bb
xor edx, edx
mov dword [0x537b70], edx
jmp 0x4ff204
cmp dword [0x52b4d4], 0
je 0x4ff38a
push dword [0x52a380]
push dword [0x537430]
call fcn.004c7b7f
mov dword [0x534c44], 1
push dword [0x52a380]
push 0
push 0x5e3
call fcn.00415c87
push eax
push dword [0x537430]
call fcn.004c7cd0
push 0
call fcn.004fde43
push 0x537c35
call fcn.004fdac4
xor ecx, ecx
mov dword [0x537b94], ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4ff4ee
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x537c3c
test edx, edx
jne 0x4ff50c
xor eax, eax
jmp 0x4ff5f4
xor eax, 0xffffffff
cmp ebx, 8
jb 0x4ff5d4
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ebx, 8
cmp ebx, 8
jae 0x4ff518
test ebx, ebx
je 0x4ff5f1
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ebx
jne 0x4ff5d8
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x505c1e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0x505db4
xor ebx, ebx
xor esi, esi
mov ecx, dword [edx]
mov dword [ebp - 4], ecx
test byte [edx + 8], 2
je 0x505c77
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 1]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 2]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x505c87
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x505c9d
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x505cbd
cmp dword [eax], 0
jg 0x505cb1
xor edi, edi
mov dword [eax], edi
jmp 0x505cb5
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x505ca6
test si, si
je 0x505db4
mov al, byte [edx + 9]
sub al, 2
je 0x505ce2
sub al, 2
je 0x505d02
sub al, 4
je 0x505d3d
sub al, 8
je 0x505d64
jmp 0x505db4
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x505db4
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x505cf2
jmp 0x505db4
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x20]
mov ecx, esi
mov ebx, 0xf0
sar ebx, cl
and bl, 0xf0
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
or bl, cl
xor esi, esi
cmp edx, esi
jbe 0x505db4
mov ecx, dword [ebp - 0x20]
shr byte [eax], cl
and byte [eax], bl
inc eax
inc esi
cmp edx, esi
ja 0x505d2e
jmp 0x505db4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0x505db4
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x505d4f
jmp 0x505db4
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x505db4
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
add si, ax
mov eax, dword [ebp - 0xc]
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov byte [edi], al
inc edi
mov edx, esi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0x505d7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50cee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x50cf11
push ebx
call fcn.00512575
cmp byte [ebx + 0x40], 0
je 0x50cf0a
mov dword [ebx + 0x14], 0xcf
mov al, 1
jmp 0x50cfa0
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x50cf7d
mov edx, dword [ebx + 0x190]
cmp byte [edx + 0x10], 0
je 0x50cf72
cmp dword [ebx + 8], 0
je 0x50cf32
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
push ebx
mov eax, dword [ebx + 0x190]
call dword [eax]
test eax, eax
jne 0x50cf43
xor eax, eax
jmp 0x50cfa0
cmp eax, 2
je 0x50cf72
cmp dword [ebx + 8], 0
je 0x50cf26
cmp eax, 3
je 0x50cf56
dec eax
jne 0x50cf26
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x50cf26
mov edx, dword [ebx + 0x11c]
add dword [eax + 8], edx
jmp 0x50cf26
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x84], ecx
jmp 0x50cf9a
cmp dword [ebx + 0x14], 0xcc
je 0x50cf9a
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
push ebx
call fcn.0050cfa5
pop ebx
pop ebp
ret 4

Function at 0x51bb24
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x5664c8
call fcn.0051e8f0
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x5664c8
call fcn.0051bd70
add esp, 0x14
push 0x53e0ac
lea ecx, [ebp - 8]
push ecx
call fcn.00518300
add esp, 8
mov byte [0x5664c8], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x5664c8
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x51bb97
mov eax, 0x5664c8
jmp 0x51bb99
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x51bba0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x51bbc5
cmp dword [ebx + 4], 0xfffffffe
jne 0x51bbc5
or eax, 0xffffffff
jmp 0x51bcfd
test byte [ebx + 8], 8
je 0x51bc32
cmp dword [ebx + 4], 0xffffffff
jne 0x51bc32
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.0051bb24
pop ecx
mov edi, eax
test edi, edi
je 0x51bc1a
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x51bcfd
call fcn.0051ee80
test eax, eax
jne 0x51bc2a
xor eax, eax
jmp 0x51bcfd
or eax, 0xffffffff
jmp 0x51bcfd
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x51bc3f
cmp eax, 0xfffffffe
jne 0x51bc66
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x51bc76
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x51bc8c
call fcn.0051ee80
test eax, eax
jne 0x51bc87
xor eax, eax
jmp 0x51bcfd
or eax, 0xffffffff
jmp 0x51bcfd
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x51bca0
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x51bc32
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51e688
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x51e6a4
call fcn.0051eea0
jmp 0x51e713
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x51e6c0
call fcn.0051eea0
jmp 0x51e713
cmp dword [0x566808], 1
je 0x51e711
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00523ab0
pop ecx
cmp al, 0x41
jl 0x51e711
cmp al, 0x5a
jg 0x51e711
cmp byte [ebp - 0x107], 0x3a
jne 0x51e711
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x51e711
call fcn.0051eea0
jmp 0x51e713
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x51e718
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x51e734
call fcn.0051eea0
jmp 0x51e755
test byte [ebp + 0xc], 0x80
jne 0x51e73f
or ebx, 1
jmp 0x51e742
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.dll_SetFileAttributesA
dec eax
je 0x51e753
call fcn.0051eea0
jmp 0x51e755
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x51e75c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x51e78b
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x51e795
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x51e7a0
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x51e806
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x51e806
call fcn.0051eea0
jmp 0x51e841
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x51e816
call fcn.0051eea0
jmp 0x51e841
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x51e83c
push edi
call sub.KERNEL32.dll_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x51e83a
cmp ebx, 1
je 0x51e83a
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x51e827
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51e848
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp esi, dword [0x53dfe0]
jb 0x51e869
push 6
call fcn.0051ee3c
pop ecx
jmp 0x51e8e8
mov ebx, dword [esi*4 + 0x566400]
push 0x22
push 0
push edi
call fcn.0051825c
add esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileType
dec eax
je 0x51e896
dec eax
je 0x51e88e
dec eax
je 0x51e8e0
jmp 0x51e8e6
mov word [edi + 4], 0x2000
jmp 0x51e8e6
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_GetFileTime
dec eax
je 0x51e8b2
call fcn.0051eea0
jmp 0x51e8e8
push 0
push ebx
call sub.KERNEL32.dll_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
xor eax, eax
test byte [esi*4 + 0x53dfe5], 1
jne 0x51e8d4
inc eax
push eax
push edi
call fcn.00526ad4
add esp, 0x18
jmp 0x51e8e6
mov word [edi + 4], 0x1000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51e8f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00524378
pop ecx
mov ebx, eax
test eax, eax
jne 0x51e914
xor eax, eax
jmp 0x51e9bd
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x51e935
cmp esi, 0x104
jb 0x51e940
push ebx
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x51e9bd
cmp byte [ebx + 1], 0x3a
jne 0x51e970
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jae 0x51e970
push ebx
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x51e9bd
inc esi
test edi, edi
je 0x51e9b3
cmp esi, dword [ebp + 0x10]
jbe 0x51e985
push ebx
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x51e9bd
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00524270
pop ecx
mov eax, edi
jmp 0x51e9bd
push esi
push ebx
call fcn.0052480c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x51e9c4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x51ea09
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x51e9f8
cmp eax, dword [ebp + 0x10]
jle 0x51ea92
mov dword [0x53f11c], 8
xor eax, eax
jmp 0x51eafd
cmp dword [0x566808], 1
jne 0x51ea4e
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x51ea92
xor eax, eax
jmp 0x51eafd
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x51ea8e
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
jmp 0x51ea92
xor eax, eax
jmp 0x51eafd
lea edx, [ebp - 0x10c]
push edx
call fcn.005183dc
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x51eab2
mov dword [0x53f11c], 0x22
xor eax, eax
jmp 0x51eafd
test edi, edi
jne 0x51ead4
mov edx, dword [ebp + 0x10]
push edx
call fcn.00524378
pop ecx
mov edi, eax
test eax, eax
jne 0x51ead4
mov dword [0x53f11c], 8
xor eax, eax
jmp 0x51eafd
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51eb04
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test al, al
jne 0x51eb19
xor eax, eax
jmp 0x51eb2d
add al, 0x40
mov byte [ebp - 4], al
lea eax, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push edx
push ecx
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceA
dec eax
je 0x51eb4f
mov dword [ebx + 0xc], 0xffffffff
jmp 0x51eb66
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov edx, dword [ebp - 8]
mov dword [ebx + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret