joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480990
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push 0x400
push 1
call fcn.00485e90
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x480a20
push ebx
call fcn.004806c0
pop ecx
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x480a20
push str.___tmp.tmp
mov eax, dword [ebp - 4]
push eax
push 0x5e0a51
push 0x40
lea eax, [ebp - 0x44]
push eax
call fcn.004a2030
add esp, 0x14
push 0x5e0a44
lea eax, [ebp - 0x44]
push eax
call fcn.004aa030
add esp, 8
mov dword [ebp - 0x48], eax
test eax, eax
je 0x480a20
mov eax, dword [ebp - 0x48]
push eax
call fcn.0052faa0
pop ecx
lea eax, [ebp - 0x44]
push eax
call fcn.00531100
pop ecx
call fcn.00488df0
push 1
push eax
call fcn.00489f40
add esp, 8
jmp 0x480a30
call fcn.00488df0
push 0
push eax
call fcn.00489f40
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4812a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4812bf
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
jmp 0x4812c5
mov ebx, dword [0x6cb938]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4958b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.004951f0
add esp, 8
mov edi, eax
push 0
push edi
call fcn.004a4a30
add esp, 8
mov ebx, eax
push edi
call fcn.00455f20
pop ecx
cmp ebx, 0xffffffff
jne 0x495a11
push str.I18N
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xb0], eax
test eax, eax
je 0x495aed
mov eax, dword [ebp - 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x495aed
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xb8], eax
push 0xac
mov eax, dword [ebp - 0xb8]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.0048ed60
add esp, 0xc
lea ecx, [ebp - 0xac]
mov edx, 0x5e97cb
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x495970
test al, al
je 0x495975
inc edx
inc ecx
jmp 0x495960
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4959a6
lea ecx, [ebp - 0xac]
mov edx, 0x5e97c6
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x495996
test al, al
je 0x49599b
inc edx
inc ecx
jmp 0x495986
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4959a6
xor eax, eax
jmp 0x495aed
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xb8]
add eax, 0xac
push eax
call fcn.00495640
add esp, 8
mov esi, eax
test esi, esi
je 0x495a0a
push 0xf
mov eax, dword [ebp + 8]
push eax
push 0x6cbb9d
call fcn.00490a40
add esp, 0xc
push 0x32
lea eax, [ebp - 0x75]
push eax
push 0x6cbb6a
call fcn.00490a40
add esp, 0xc
mov eax, dword [0x6b5714]
test eax, eax
je 0x4959fa
push eax
call fcn.00489390
pop ecx
mov dword [0x6b5714], esi
mov eax, 1
jmp 0x495aed
xor eax, eax
jmp 0x495aed
push 0xac
lea eax, [ebp - 0xac]
push eax
push ebx
call fcn.004a4fb0
add esp, 0xc
movzx eax, ax
cmp eax, 0xac
je 0x495a3e
push ebx
call fcn.004a4c10
pop ecx
xor eax, eax
jmp 0x495aed
lea ecx, [ebp - 0xac]
mov edx, 0x5e97cb
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x495a5b
test al, al
je 0x495a60
inc edx
inc ecx
jmp 0x495a4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x495a95
lea ecx, [ebp - 0xac]
mov edx, 0x5e97c6
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x495a81
test al, al
je 0x495a86
inc edx
inc ecx
jmp 0x495a71
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x495a95
push ebx
call fcn.004a4c10
pop ecx
xor eax, eax
jmp 0x495aed
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004954a0
add esp, 8
mov esi, eax
test esi, esi
je 0x495aeb
push 0xf
mov eax, dword [ebp + 8]
push eax
push 0x6cbb9d
call fcn.00490a40
add esp, 0xc
push 0x32
lea eax, [ebp - 0x75]
push eax
push 0x6cbb6a
call fcn.00490a40
add esp, 0xc
mov eax, dword [0x6b5714]
test eax, eax
je 0x495ade
push eax
call fcn.00489390
pop ecx
mov dword [0x6b5714], esi
mov eax, 1
jmp 0x495aed
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498900
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [0x6b5b58], eax
push 0x498830
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x498850
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6b5b54], eax
push 1
push 0x4988d0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
pop ebp
ret
Function at 0x4a49e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
sete al
and eax, 1
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4e00
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a2190
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004a3090
add esp, 0x14
push 0x42
mov eax, dword [ebp + 8]
push eax
call fcn.004a4a30
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne al
and eax, 1
mov ebx, eax
test ebx, ebx
je 0x4a4f20
call fcn.0043ecb0
cmp dword [ebp + 0xc], 0
jle 0x4a4e70
cmp dword [ebp + 0x10], 0
jge 0x4a4e7c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x4a4e8e
lea edx, [ebp - 0x2c]
mov ecx, 0x10
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
cmp dword [ebp + 0xc], 0
jle 0x4a4ea9
mov eax, dword [ebp - 4]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 8]
mov word [ebp - 0x2a], ax
mov eax, dword [ebp - 0xc]
mov word [ebp - 0x26], ax
cmp dword [ebp + 0x10], 0
jl 0x4a4ecb
mov eax, dword [ebp - 0x10]
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x14]
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x18]
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x1c]
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push esi
call fcn.004a4300
pop ecx
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp - 0x34]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
push esi
call fcn.004a4c10
pop ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call fcn.0043ecb0
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push 0
lea edx, [ebp - 4]
push edx
movzx edx, word [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push 0
push esi
call fcn.004a6b50
add esp, 8
test esi, esi
je 0x4a4ff7
mov eax, dword [ebp - 4]
movzx edi, ax
jmp 0x4a4ff9
xor edi, edi
mov eax, edi
mov ebx, eax
cmp bx, 0xffff
jne 0x4a5006
xor bx, bx
call fcn.0043eca0
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5020
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call fcn.0043ecb0
mov dword [ebp - 4], 0
cmp word [ebp + 0x10], 0
je 0x4a5060
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push 0
lea edx, [ebp - 4]
push edx
movzx edx, word [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
jmp 0x4a507a
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
push 0
push esi
call fcn.004a6b50
add esp, 8
test esi, esi
je 0x4a5091
mov eax, dword [ebp - 4]
movzx edi, ax
jmp 0x4a5093
xor edi, edi
mov eax, edi
mov ebx, eax
call fcn.0043eca0
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a50b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call fcn.0043ecb0
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x4a50e8
mov edi, dword [ebp - 4]
jmp 0x4a50ea
xor edi, edi
mov ebx, edi
push 0
push esi
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5110
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
call fcn.0043ecb0
cmp dword [ebp + 0x10], 0
je 0x4a5154
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
call fcn.004a6b50
add esp, 8
jmp 0x4a5170
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push eax
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a5180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
call fcn.004aad10
test eax, eax
je 0x4a521c
call fcn.0043ecb0
lea edx, [ebp - 0x18]
mov ecx, 0x14
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push edx
push eax
push 0x20
call fcn.00530a90
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a51fa
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
jmp 0x4a5201
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
jmp 0x4a526a
call fcn.0043ecb0
push 0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a57d0
add esp, 0x10
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
cmp edx, ebx
jne 0x4a525e
cmp eax, ecx
jne 0x4a525e
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a50b0
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4a5265
mov dword [ebp - 4], 0
call fcn.0043eca0
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
call fcn.004aad10
test eax, eax
je 0x4a52f7
call fcn.0043ecb0
lea edx, [ebp - 0x18]
mov ecx, 0x14
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push edx
push eax
push 0x20
call fcn.00530a90
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a4300
pop ecx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
jmp 0x4a5345
call fcn.0043ecb0
push 0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a57d0
add esp, 0x10
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
cmp edx, ebx
jne 0x4a5339
cmp eax, ecx
jne 0x4a5339
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a5110
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4a5340
mov dword [ebp - 4], 0
call fcn.0043eca0
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5920
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
call fcn.0043ecb0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a5969
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5970
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 0xc], eax
call fcn.0043ecb0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a59d0
push eax
call fcn.00455f20
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x4a59de
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a59f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
call fcn.0043ecb0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a5a3b
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5a50
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
call fcn.0043ecb0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a5a99
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5aa0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
call fcn.0043ecb0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a5ae9
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov bx, word [ebp + 8]
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
cmp word [ebp + 8], 0
je 0x4a5b5f
call fcn.004a5ce0
movzx eax, al
inc eax
mov ebx, eax
movzx eax, word [ebp + 8]
movzx edx, bx
cmp eax, edx
je 0x4a5b5f
movzx eax, word [ebp + 8]
dec eax
movzx eax, al
push eax
call fcn.004a5c60
pop ecx
call fcn.0043ecb0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
call fcn.004a6af0
mov esi, eax
movzx eax, word [ebp + 8]
movzx edx, bx
cmp eax, edx
je 0x4a5bb2
movzx eax, bx
dec eax
movzx eax, al
push eax
call fcn.004a5c60
pop ecx
movzx eax, si
push eax
call fcn.004a6b30
pop ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax - 1], 0
test si, si
jne 0x4a5c54
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x4a5c54
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a5bdb
mov dword [ebp + 0x10], eax
cmp byte [edi + 1], 0x3a
jne 0x4a5bf2
add edi, 2
sub dword [ebp + 0x10], 2
movsx eax, byte [edi]
push eax
push 0x5eb162
call fcn.00531050
add esp, 8
test eax, eax
je 0x4a5c0b
inc edi
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a5c2c
movsx eax, byte [edi + eax - 1]
push eax
push 0x5eb162
call fcn.00531050
add esp, 8
test eax, eax
je 0x4a5c2c
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x4a5c4a
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4a5c4a
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp + 0xc]
push eax
call fcn.00530ad0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
movzx eax, si
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5d20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
add eax, 0x41
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
call fcn.0043ecb0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
call fcn.0043eca0
test esi, esi
je 0x4a5d5e
cmp esi, 1
jne 0x4a5d65
mov edi, 0xffff
jmp 0x4a5d67
xor edi, edi
mov eax, edi
mov ebx, eax
push 0
call fcn.004a6b30
pop ecx
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
push 0
test ebx, ebx
setne al
and eax, 1
push eax
call fcn.004a6b50
add esp, 8
call fcn.0043eca0
call fcn.004a6af0
test ax, ax
je 0x4a61dc
call fcn.004a6af0
movzx eax, ax
jmp 0x4a624b
mov ebx, dword [ebp + 0xc]
cmp byte [ebx + 1], 0x3a
jne 0x4a61e8
add ebx, 2
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4a6200
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00530ad0
add esp, 0xc
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a6206
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + eax - 1]
push eax
push 0x5eb162
call fcn.00531050
add esp, 8
test eax, eax
je 0x4a6236
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
jmp 0x4a6249
push 0
push 0x5eb160
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048f9b0
add esp, 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a69dd
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a69c9
mov eax, esi
and eax, 0x50
jne 0x4a69c9
mov edi, 1
jmp 0x4a69cb
xor edi, edi
mov ebx, edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a69db
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a83f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a6250
add esp, 8
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a841b
mov ebx, eax
jmp 0x4a8427
dec ebx
test ebx, ebx
je 0x4a8445
mov eax, dword [ebp + 8]
movsx eax, byte [eax + ebx - 1]
push eax
push 0x5ef7c4
call fcn.00531050
add esp, 8
test eax, eax
jne 0x4a8426
test ebx, ebx
je 0x4a8478
cmp ebx, 0x107
ja 0x4a8478
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a846b
mov dword [ebp - 8], 0
jmp 0x4a8473
mov eax, edi
and eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esi, eax
push 0
call fcn.004a6b30
pop ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a848e
push eax
call fcn.00455f20
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a87f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x4a8864
cmp dword [ebp - 0x90], 5
jb 0x4a8864
push str.winspool.drv
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4a8864
push str.GetDefaultPrinterA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
test eax, eax
je 0x4a885d
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x98]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4a88c7
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x5ef827
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov esi, eax
test esi, esi
je 0x4a88bf
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
jae 0x4a88bf
xor esi, esi
jmp 0x4a8899
inc esi
mov eax, dword [ebp + 8]
movsx eax, byte [eax + esi]
test eax, eax
je 0x4a88a9
cmp eax, 0x2c
jne 0x4a8898
mov eax, dword [ebp + 8]
mov byte [eax + esi], 0
mov edx, dword [ebp + 0xc]
lea eax, [esi + 1]
mov dword [edx], eax
mov ebx, 1
jmp 0x4a88c7
mov edx, dword [ebp + 0xc]
lea eax, [esi + 1]
mov dword [edx], eax
test ebx, ebx
jne 0x4a89b0
cmp dword [ebp - 0x84], 1
jne 0x4a89b0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x4a89b0
cmp dword [ebp - 0x98], 0
je 0x4a89b0
mov eax, dword [ebp - 0x98]
push eax
call fcn.00455e40
pop ecx
mov dword [ebp - 0xa0], eax
test eax, eax
je 0x4a89b0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0xa0]
push eax
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x4a89a3
cmp dword [ebp - 0x9c], 0
je 0x4a89a3
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x4a89a3
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx]
jae 0x4a89a3
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [edx], eax
mov ebx, 1
mov eax, dword [ebp - 0xa0]
push eax
call fcn.00455f20
pop ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret