joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae9a0
Capabilities:
Get disk size

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.005ad800
cmp eax, dword [0x006931b4]
jle 0x5ae9c1
mov dword [0x006931b4], 0x1c
call fcn.005ab920
mov eax, dword [0x00693278]
add eax, 1
cmp dword [0x00693278], eax
jne 0x5ae9f6
mov ecx, dword [0x006940b8]
mov edx, dword [0x006942c8]
mov r8d, dword [0x006932e0]
mov r9d, dword [0x006933fc]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005ad800
cmp eax, dword [0x006931b4]
jle 0x5aea0d
mov dword [0x006931b4], 0x1c
mov eax, dword [0x00693204]
add eax, 1
cmp dword [0x00693204], eax
jne 0x5aea36
mov ecx, dword [0x00693284]
mov edx, dword [0x006933c0]
mov r8d, dword [0x006935f0]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov dword [0x006931d8], 0x2f8
mov eax, dword [0x006931d8]
sub eax, 0x18f
mov dword [0x006932a0], eax
mov eax, dword [0x00693294]
add eax, 1
cmp dword [0x00693294], eax
jne 0x5aea8c
mov ecx, dword [0x006933f4]
mov edx, dword [0x006934f8]
mov r8d, dword [0x00693800]
mov r9d, dword [0x00693984]
mov eax, dword [0x006940f8]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006931b4]
mov dword [0x006942a8], eax
mov eax, dword [0x006931b4]
mov dword [0x006942a8], eax
mov eax, dword [0x0069394c]
cmp eax, dword [0x006940c0]
je 0x5aeabe
mov eax, dword [0x0069394c]
mov dword [0x006940c0], eax
mov rdi, rbx
lea rsi, [0x005aeb74]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
movsb byte [rdi], byte [rsi]
call fcn.005ae920
test al, al
je 0x5aeb69
mov ecx, 0x10
call fcn.00416930
mov rsi, rax
xor ecx, ecx
mov rdx, rsi
call fcn.005ae750
lea rax, [rsi + 4]
mov rcx, rax
mov rdx, rbx
mov r8d, 0xc
call fcn.004093d0
mov rcx, rsi
call fcn.00416940
mov eax, dword [0x00693568]
mov dword [0x00693520], eax
mov dword [0x006931e4], 0x302
mov eax, dword [0x006931e4]
sub eax, 0x1a3
mov dword [0x006932ac], eax
mov eax, dword [0x006942d0]
mov dword [0x00694124], eax
mov eax, dword [0x006942d0]
mov dword [0x00694124], eax
mov eax, dword [0x00693988]
cmp eax, dword [0x006940fc]
je 0x5aeb69
mov eax, dword [0x00693988]
mov dword [0x006940fc], eax
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x5af240
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x0069412c]
mov dword [0x006940c4], eax
movzx rbx, cl
shr ebx, 6
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5af281
mov ecx, dword [0x006942c0]
mov edx, dword [0x006933d0]
mov r8d, dword [0x006934d4]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069352c]
add eax, dword [0x0069390c]
mov ecx, dword [0x00693950]
add ecx, dword [0x006940c4]
cmp eax, ecx
jle 0x5af2a9
mov eax, dword [0x006940c4]
mov dword [0x0069352c], eax
mov eax, dword [0x00693444]
mov dword [0x006933dc], eax
call fcn.005ad800
cmp eax, dword [0x006942f0]
jle 0x5af2cc
mov dword [0x006942f0], 0xc
mov eax, dword [0x00693550]
add eax, dword [0x0069390c]
mov ecx, dword [0x00693974]
add ecx, dword [0x006940e8]
cmp eax, ecx
jle 0x5af2f4
mov eax, dword [0x006940e8]
mov dword [0x00693550], eax
mov eax, dword [0x00693400]
mov dword [0x00693308], eax
mov eax, dword [0x00694288]
mov dword [0x006940dc], eax
mov eax, dword [0x006934dc]
add eax, dword [0x00693544]
mov ecx, dword [0x00693900]
add ecx, dword [0x00693948]
cmp eax, ecx
jle 0x5af334
mov eax, dword [0x00693948]
mov dword [0x006934dc], eax
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x5af510
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov eax, dword [0x006931e0]
add eax, 1
cmp dword [0x006931e0], eax
jne 0x5af547
mov ecx, dword [0x00693428]
mov edx, dword [0x00693950]
mov r8d, dword [0x00694108]
mov r9d, dword [0x006942b4]
call sub.advapi32.dll_CryptDuplicateKey
mov dword [0x006931cc], 0x30d
mov eax, dword [0x006931cc]
sub eax, 0x1a8
mov dword [0x00693294], eax
mov eax, dword [0x0069409c]
cmp eax, dword [0x006940e0]
je 0x5af57d
mov eax, dword [0x0069409c]
mov dword [0x006940e0], eax
and bl, 7
mov eax, dword [0x00693280]
add eax, 1
cmp dword [0x00693280], eax
jne 0x5af5a9
mov ecx, dword [0x00693924]
mov edx, dword [0x006932c4]
mov r8d, dword [0x006933dc]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x5af8a0
Capabilities:
Get disk size

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov eax, dword [0x006940f8]
mov dword [0x00693984], eax
mov eax, dword [0x006934f8]
add eax, dword [0x0069353c]
mov ecx, dword [0x00693800]
add ecx, dword [0x00693940]
cmp eax, ecx
jle 0x5af8dd
mov eax, dword [0x00693940]
mov dword [0x006934f8], eax
mov eax, dword [0x006942c8]
mov dword [0x0069411c], eax
mov eax, dword [0x0069353c]
add eax, dword [0x00693800]
mov ecx, dword [0x00693940]
add ecx, dword [0x00693984]
cmp eax, ecx
jle 0x5af911
mov eax, dword [0x00693984]
mov dword [0x0069353c], eax
mov eax, dword [0x006935f4]
mov dword [0x00693530], eax
mov eax, dword [0x0069328c]
add eax, 1
cmp dword [0x0069328c], eax
jne 0x5af939
mov ecx, dword [0x006942fc]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006931d8]
add eax, 1
cmp dword [0x006931d8], eax
jne 0x5af955
mov ecx, dword [0x00693900]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov sil, 1
movzx rax, byte [rbx + 0x31]
test al, 1
je 0x5af976
cmp byte [rbx + 0x28], 0
jne 0x5af973
cmp byte [rbx + 0x2f], 5
jne 0x5af973
xor esi, esi
jmp 0x5af976
mov sil, 1
mov eax, dword [0x0069339c]
add eax, 1
cmp dword [0x0069339c], eax
jne 0x5af9b0
mov ecx, dword [0x00693550]
mov edx, dword [0x0069410c]
mov r8d, dword [0x006942b8]
mov r9d, dword [0x006931c4]
mov eax, dword [0x0069328c]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
call fcn.005ad620
mov eax, dword [0x00693200]
add eax, 1
cmp dword [0x00693200], eax
jne 0x5af9de
mov ecx, dword [0x006933b4]
mov edx, dword [0x006934b8]
mov r8d, dword [0x00693544]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069351c]
add eax, dword [0x00693800]
mov ecx, dword [0x00693940]
add ecx, dword [0x006940b4]
cmp eax, ecx
jle 0x5afa06
mov eax, dword [0x006940b4]
mov dword [0x0069351c], eax
mov eax, dword [0x006932b0]
add eax, 1
cmp dword [0x006932b0], eax
jne 0x5afa22
mov ecx, dword [0x00693964]
call sub.kernel32.dll_SetConsoleKeyShortcuts
call fcn.005ad800
mov eax, dword [0x006942dc]
mov dword [0x00694130], eax
mov eax, dword [0x006934c0]
mov dword [0x00693420], eax
mov eax, dword [0x00693284]
add eax, 1
cmp dword [0x00693284], eax
jne 0x5afa79
mov ecx, dword [0x0069320c]
mov edx, dword [0x006932f4]
mov r8d, dword [0x006933ec]
mov r9d, dword [0x00693454]
mov eax, dword [0x00693534]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x5c49f0
Capabilities:
Get disk size

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
mov eax, dword [0x006931e0]
add eax, dword [0x006932a8]
mov ecx, dword [0x006933a0]
add ecx, dword [0x00693428]
cmp eax, ecx
jle 0x5c4a26
mov dword [0x006931e0], 0x139
mov eax, dword [0x00693204]
add eax, 1
cmp dword [0x00693204], eax
jne 0x5c4a4f
mov ecx, dword [0x00693510]
mov edx, dword [0x00693934]
mov r8d, dword [0x006940a8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006931f8]
add eax, 1
cmp dword [0x006931f8], eax
jne 0x5c4a6b
mov ecx, dword [0x00694294]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00694294]
mov dword [0x006940e8], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.005aefc0
mov rax, qword [rsp + 0x28]
movzx rcx, byte [rax]
cmp cl, 7
ja 0x5c4aa4
mov al, 1
shl eax, cl
movzx rcx, byte [0x005c4c2c]
test al, cl
setne al
jmp 0x5c4aa6
xor eax, eax
test al, al
jne 0x5c4ab6
mov rcx, qword [rsp + 0x28]
mov dl, 1
call fcn.005aefc0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0
jne 0x5c4ace
mov rcx, qword [rsp + 0x28]
mov dl, 2
call fcn.005aefc0
mov rax, qword [rsp + 0x28]
movzx rbx, byte [rax]
mov rax, qword [rsp + 0x28]
mov rsi, qword [rax + 8]
mov rax, qword [rsp + 0x28]
mov r13, qword [rax + 0x10]
mov rax, qword [rsp + 0x28]
movzx rdi, byte [rax + 0xae]
mov rax, qword [rsp + 0x28]
movzx r14, byte [rax + 0xb0]
mov rcx, qword [rsp + 0x28]
mov edx, 0xc0
xor r8, r8
call fcn.0040a9a0
mov rax, qword [rsp + 0x28]
mov byte [rax], bl
mov qword [rax + 8], rsi
mov byte [rax + 0xae], dil
mov qword [rax + 0x10], r13
mov byte [rax + 0xb0], r14b
mov rbx, qword [rax + 8]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x18], rbx
mov byte [rax + 0xac], 4
mov byte [rax + 0xad], 4
lea rax, [0x00694a98]
mov rcx, qword [rsp + 0x28]
movzx rcx, byte [rcx]
movzx rax, byte [rax + rcx]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 1], al
mov byte [rcx + 0x23], 1
lea rsi, [0x00694b18]
lea rax, [0x00694410]
movzx rdx, byte [rbx]
movzx rdi, byte [rax + rdx]
call qword [rsi + rdi*8]
mov rax, qword [rsp + 0x28]
movzx rax, byte [rax + 0x18]
sub al, bl
mov ebx, eax
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xaf], bl
lea rax, [0x00694ae0]
mov rcx, qword [rsp + 0x28]
movzx rcx, byte [rcx]
cmp bl, byte [rax + rcx]
jle 0x5c4bc3
mov rcx, qword [rsp + 0x28]
mov dl, 4
call fcn.005aefc0
call fcn.005b5fe0
mov eax, dword [0x0069327c]
add eax, 1
cmp dword [0x0069327c], eax
jne 0x5c4bf1
mov ecx, dword [0x006932b0]
mov edx, dword [0x00693430]
mov r8d, dword [0x00693514]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00694294]
mov dword [0x006940e8], eax
mov eax, dword [0x00693978]
cmp eax, dword [0x006940ec]
je 0x5c4c17
mov eax, dword [0x00693978]
mov dword [0x006940ec], eax
call fcn.005b7fb0
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x5c5de0
Capabilities:
Get disk size

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov eax, dword [0x006942c4]
mov dword [0x00694118], eax
mov eax, dword [0x00693284]
add eax, 1
cmp dword [0x00693284], eax
jne 0x5c5e2f
mov ecx, dword [0x006931c0]
mov edx, dword [0x006933c4]
mov r8d, dword [0x0069344c]
mov r9d, dword [0x00693550]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006942c4]
mov dword [0x00694118], eax
mov eax, dword [0x0069397c]
cmp eax, dword [0x006940f0]
je 0x5c5e55
mov eax, dword [0x0069397c]
mov dword [0x006940f0], eax
mov dword [0x006931d0], 0x30d
mov eax, dword [0x006931d0]
sub eax, 0x1a8
mov dword [0x00693294], eax
mov eax, dword [0x00694120]
mov dword [0x006940b8], eax
mov eax, dword [0x00693918]
add eax, dword [0x00693980]
mov ecx, dword [0x006940d0]
add ecx, dword [0x00694138]
cmp eax, ecx
jle 0x5c5ea5
mov eax, dword [0x00694138]
mov dword [0x00693918], eax
mov eax, dword [0x00693408]
mov dword [0x006933a4], eax
mov eax, dword [0x006935f4]
add eax, dword [0x00693954]
mov ecx, dword [0x006940c8]
add ecx, dword [0x0069410c]
cmp eax, ecx
jle 0x5c5ed9
mov eax, dword [0x0069410c]
mov dword [0x006935f4], eax
mov eax, dword [0x00693504]
add eax, dword [0x006935ec]
mov ecx, dword [0x0069394c]
add ecx, dword [0x0069409c]
cmp eax, ecx
jle 0x5c5efa
call fcn.004096f0
xor r14, r14
mov rcx, rbx
mov edx, esi
mov r8d, edi
call fcn.005c5690
mov r13, rax
test r13, r13
jne 0x5c5f42
movabs rax, 0xffffffff00000000
test rax, rbx
je 0x5c5f28
mov r14d, 0x100000
xor ecx, ecx
mov edx, esi
mov r8d, r14d
or r8d, 0x3000
mov r9d, edi
call qword [0x006a9420]
mov r13, rax
mov eax, dword [0x00694134]
mov dword [0x006940cc], eax
mov eax, dword [0x00693908]
add eax, dword [0x00693970]
mov ecx, dword [0x006940c0]
add ecx, dword [0x00694104]
cmp eax, ecx
jle 0x5c5f76
mov eax, dword [0x00694104]
mov dword [0x00693908], eax
call fcn.005baa60
cmp eax, dword [0x006942dc]
jle 0x5c5f8d
mov dword [0x006942dc], 0xf
mov eax, dword [0x006932c8]
add eax, 1
cmp dword [0x006932c8], eax
jne 0x5c5fb6
mov ecx, dword [0x006940f4]
mov edx, dword [0x006942e8]
mov r8d, dword [0x00693274]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693908]
add eax, dword [0x00693970]
mov ecx, dword [0x006940c0]
add ecx, dword [0x00694104]
cmp eax, ecx
jle 0x5c5fde
mov eax, dword [0x00694104]
mov dword [0x00693908], eax
mov eax, dword [0x00693954]
cmp eax, dword [0x006940c8]
je 0x5c5ff8
mov eax, dword [0x00693954]
mov dword [0x006940c8], eax
call fcn.005c0210
cmp eax, dword [0x006931c4]
jle 0x5c600f
mov dword [0x006931c4], 0x18
call fcn.005ba940
mov eax, dword [0x0069354c]
add eax, dword [0x0069392c]
mov ecx, dword [0x00693970]
add ecx, dword [0x006940e4]
cmp eax, ecx
jle 0x5c603c
mov eax, dword [0x006940e4]
mov dword [0x0069354c], eax
mov eax, dword [0x006933d8]
sub eax, dword [0x006932e0]
mov dword [0x006932e0], eax
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x5c8eb0
Capabilities:
Get disk size

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0xf0
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov eax, dword [0x006934c0]
mov dword [0x00693400], eax
call fcn.005c6f10
cmp eax, dword [0x00694300]
jle 0x5c8ee9
mov dword [0x00694300], 0x18
mov eax, dword [0x006931d8]
add eax, 1
cmp dword [0x006931d8], eax
jne 0x5c8f12
mov ecx, dword [0x006942b8]
mov edx, dword [0x006932b0]
mov r8d, dword [0x006933c8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693544]
add eax, dword [0x00693924]
mov ecx, dword [0x00694098]
add ecx, dword [0x006940fc]
cmp eax, ecx
jle 0x5c8f3a
mov eax, dword [0x006940fc]
mov dword [0x00693544], eax
mov eax, dword [0x006931c4]
mov dword [0x006942d8], eax
mov eax, dword [0x006932b4]
add eax, 1
cmp dword [0x006932b4], eax
jne 0x5c8f80
mov ecx, dword [0x00694108]
mov edx, dword [0x00693204]
mov r8d, dword [0x006933c4]
mov r9d, dword [0x0069344c]
mov eax, dword [0x006935f4]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00693558]
add eax, dword [0x00693938]
mov ecx, dword [0x006940ac]
add ecx, dword [0x006940f0]
cmp eax, ecx
jle 0x5c8fa8
mov eax, dword [0x006940f0]
mov dword [0x00693558], eax
mov eax, dword [0x00694284]
mov dword [0x006940d8], eax
xor r13, r13
lea rdi, [rbp + 0x30]
xor eax, eax
mov ecx, 0x18
rep stosq qword [rdi], rax
mov byte [rbp + 0x30], 1
mov qword [rbp + 0x40], 0
mov rcx, qword [rbx]
mov rdx, rsi
call fcn.005c9050
mov rsi, rax
mov qword [rbp + 0x38], rsi
lea rcx, [rbp + 0x30]
call fcn.005c5550
cmp byte [rbp + 0x50], 0x90
jne 0x5c9035
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x30]
call fcn.005c5550
mov rcx, rbp
lea rdx, [rbp + 0x30]
call fcn.005c8e80
test al, al
je 0x5c9035
add rsi, 1
add rsi, 0x30
sub rsi, 0x9b
mov rcx, rbx
mov rdx, rsi
call fcn.005c9ea0
test al, al
je 0x5c9035
mov r13, rsi
call fcn.005c0210
mov rax, r13
lea rsp, [rbp + 0xf0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x5cab20
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov byte [rbp + 0x60], r8b
mov eax, dword [0x00693900]
add eax, dword [0x00693968]
mov ecx, dword [0x006940b8]
add ecx, dword [0x00694120]
cmp eax, ecx
jle 0x5cab60
mov eax, dword [0x00694120]
mov dword [0x00693900], eax
call fcn.005c5240
mov eax, dword [0x00693200]
add eax, 1
cmp dword [0x00693200], eax
jne 0x5cab8e
mov ecx, dword [0x006931c8]
mov edx, dword [0x006932d4]
mov r8d, dword [0x006933f0]
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005c89f0
cmp eax, dword [0x006931e8]
jle 0x5caba5
mov dword [0x006931e8], 0x29
mov rcx, qword [0x005c4f10]
mov dl, 1
movzx r8, byte [rbp + 0x60]
call fcn.005c8af0
mov qword [rbp + 0x38], rax
nop
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x58]
movzx r9, byte [rbp + 0x60]
call fcn.005ca1f0
mov qword [rbp + 0x30], rax
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040b500
mov eax, dword [0x00694284]
mov dword [0x006940d8], eax
mov eax, dword [0x00694284]
mov dword [0x006940d8], eax
mov eax, dword [0x0069397c]
cmp eax, dword [0x006940ec]
je 0x5cac13
mov eax, dword [0x0069397c]
mov dword [0x006940ec], eax
mov eax, dword [0x00693938]
add eax, dword [0x006940ac]
mov ecx, dword [0x00694114]
add ecx, dword [0x0069429c]
cmp eax, ecx
jle 0x5cac3b
mov eax, dword [0x0069429c]
mov dword [0x00693938], eax
call fcn.005bccc0
mov dword [0x006931bc], 0x2ff
mov eax, dword [0x006931bc]
sub eax, 0x1a1
mov dword [0x00693284], eax
call fcn.005beee0
mov eax, dword [0x006942d4]
mov dword [0x0069412c], eax
call fcn.005c7c80
cmp eax, dword [0x006931bc]
jle 0x5cac84
mov dword [0x006931bc], 0x1e
call fcn.005bccc0
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x5cb470
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00693558]
add eax, dword [0x00693938]
mov ecx, dword [0x006940ac]
add ecx, dword [0x006940f0]
cmp eax, ecx
jle 0x5cb49c
mov eax, dword [0x006940f0]
mov dword [0x00693558], eax
mov eax, dword [0x006933f8]
mov dword [0x00693300], eax
mov eax, dword [0x006942ac]
mov dword [0x00694124], eax
call fcn.0040c250
mov rcx, qword [0x006a9458]
call fcn.0040c770
mov rcx, rax
or edx, 0xffffffff
call fcn.0040c480
call fcn.005c0210
mov eax, dword [0x006940ac]
add eax, dword [0x006940f4]
mov ecx, dword [0x006937f8]
add ecx, dword [0x0069395c]
cmp ecx, eax
jle 0x5cb4fd
mov ecx, dword [0x006940f4]
mov dword [0x006937f8], ecx
mov ecx, dword [0x006937f8]
add ecx, dword [0x0069395c]
cmp ecx, eax
jle 0x5cb519
mov eax, dword [0x006940f4]
mov dword [0x006937f8], eax
mov eax, dword [0x0069394c]
cmp eax, dword [0x006940bc]
je 0x5cb533
mov eax, dword [0x0069394c]
mov dword [0x006940bc], eax
call fcn.005c8240
cmp eax, dword [0x006942f4]
jle 0x5cb54a
mov dword [0x006942f4], 0xd
mov eax, dword [0x006934f0]
add eax, dword [0x00693534]
mov ecx, dword [0x006935f8]
add ecx, dword [0x00693958]
cmp eax, ecx
jle 0x5cb56b
call fcn.004096f0
mov eax, dword [0x006932c4]
add eax, 1
cmp dword [0x006932c4], eax
jne 0x5cb594
mov ecx, dword [0x0069390c]
mov edx, dword [0x006940e8]
mov r8d, dword [0x00694294]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693910]
add eax, dword [0x00693954]
mov ecx, dword [0x006940c8]
add ecx, dword [0x00694130]
cmp eax, ecx
jle 0x5cb5bc
mov eax, dword [0x00694130]
mov dword [0x00693910], eax
mov eax, dword [0x0069350c]
add eax, dword [0x006935f4]
mov ecx, dword [0x00693930]
add ecx, dword [0x006940a4]
cmp eax, ecx
jle 0x5cb5dd
call fcn.004096f0
add rsp, 0x28
ret

Function at 0x5cb5f0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00693510]
add eax, dword [0x006935f8]
mov ecx, dword [0x00693934]
add ecx, dword [0x00693978]
cmp eax, ecx
jle 0x5cb61c
mov eax, dword [0x00693978]
mov dword [0x00693510], eax
call fcn.005cacc0
cmp eax, dword [0x006931c0]
jle 0x5cb633
mov dword [0x006931c0], 0x1f
mov dword [0x006931c4], 0x323
mov eax, dword [0x006931c4]
sub eax, 0x1a4
mov dword [0x0069328c], eax
mov eax, dword [0x00693530]
add eax, dword [0x00693910]
mov ecx, dword [0x00693958]
add ecx, dword [0x006940a8]
cmp eax, ecx
jle 0x5cb677
mov eax, dword [0x006940a8]
mov dword [0x00693530], eax
call fcn.005c9c20
cmp eax, dword [0x006931c4]
jle 0x5cb68e
mov dword [0x006931c4], 0x20
call fcn.005c9d40
cmp eax, dword [0x006931cc]
jle 0x5cb6a5
mov dword [0x006931cc], 0x19
call fcn.005c7c80
mov rcx, qword [0x006a9458]
call fcn.0040c6b0
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5cb6df
mov ecx, dword [0x006932b8]
mov edx, dword [0x006934d4]
mov r8d, dword [0x00693560]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069320c]
add eax, 1
cmp dword [0x0069320c], eax
jne 0x5cb6fb
mov ecx, dword [0x006931bc]
call sub.kernel32.dll_SetConsoleKeyShortcuts
add rsp, 0x28
ret
Function at 0x5cba30
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
mov eax, dword [0x006942e0]
mov dword [0x00694134], eax
mov eax, dword [0x006942e0]
mov dword [0x00694134], eax
mov eax, dword [0x00693964]
cmp eax, dword [0x006940d8]
je 0x5cba66
mov eax, dword [0x00693964]
mov dword [0x006940d8], eax
call fcn.005ae610
mov byte [0x00694a30], al
call fcn.005aec10
mov eax, dword [0x00693500]
add eax, dword [0x00693544]
mov ecx, dword [0x00693924]
add ecx, dword [0x00693968]
cmp eax, ecx
jle 0x5cba97
call fcn.004096f0
lea rcx, [0x006a9460]
call qword [0x006a8e40]
mov eax, dword [0x00693908]
add eax, dword [0x00693970]
mov ecx, dword [0x006940c0]
add ecx, dword [0x00694128]
cmp eax, ecx
jle 0x5cbacc
mov eax, dword [0x00694128]
mov dword [0x00693908], eax
mov eax, dword [0x00693508]
mov dword [0x006934c0], eax
mov eax, dword [0x006932c4]
add eax, 1
cmp dword [0x006932c4], eax
jne 0x5cbb01
mov ecx, dword [0x00693920]
mov edx, dword [0x006940d8]
mov r8d, dword [0x006942a8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006940bc]
add eax, dword [0x00694124]
mov ecx, dword [0x00693904]
add ecx, dword [0x0069396c]
cmp ecx, eax
jle 0x5cbb29
mov ecx, dword [0x00694124]
mov dword [0x00693904], ecx
mov ecx, dword [0x00693904]
add ecx, dword [0x0069396c]
cmp ecx, eax
jle 0x5cbb45
mov eax, dword [0x00694124]
mov dword [0x00693904], eax
mov eax, dword [0x0069397c]
cmp eax, dword [0x006940f0]
je 0x5cbb5f
mov eax, dword [0x0069397c]
mov dword [0x006940f0], eax
mov eax, dword [0x00693900]
add eax, dword [0x00693968]
mov ecx, dword [0x006940dc]
add ecx, dword [0x00694120]
cmp eax, ecx
jle 0x5cbb87
mov eax, dword [0x00694120]
mov dword [0x00693900], eax
mov eax, dword [0x006942a0]
mov dword [0x006940f4], eax
mov eax, dword [0x006a9464]
mov dword [0x006953a8], eax
mov eax, dword [0x006942a0]
mov dword [0x006940f4], eax
mov eax, dword [0x00693950]
cmp eax, dword [0x006940c4]
je 0x5cbbc5
mov eax, dword [0x00693950]
mov dword [0x006940c4], eax
mov eax, dword [0x00693524]
add eax, dword [0x00693904]
mov ecx, dword [0x0069396c]
add ecx, dword [0x006940bc]
cmp eax, ecx
jle 0x5cbbed
mov eax, dword [0x006940bc]
mov dword [0x00693524], eax
call fcn.005c6f10
cmp dword [0x006953a8], 0xa0
jae 0x5cbc08
mov dword [0x006953a8], 0xa0
mov byte [0x006953a4], 0
mov eax, dword [0x006932cc]
add eax, 1
cmp dword [0x006932cc], eax
jne 0x5cbc38
mov ecx, dword [0x006932f0]
mov edx, dword [0x00693530]
mov r8d, dword [0x00693958]
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005c6f10
mov eax, dword [0x006934ec]
add eax, dword [0x00693554]
mov ecx, dword [0x00693934]
add ecx, dword [0x006940a8]
cmp eax, ecx
jle 0x5cbc5e
call fcn.004096f0
mov eax, dword [0x006934ec]
add eax, dword [0x00693554]
mov ecx, dword [0x00693934]
add ecx, dword [0x006940a8]
cmp eax, ecx
jle 0x5cbc7f
call fcn.004096f0
mov eax, dword [0x00694098]
cmp eax, dword [0x00694100]
je 0x5cbc99
mov eax, dword [0x00694098]
mov dword [0x00694100], eax
call fcn.005cb7b0
add rsp, 0x28
ret
Function at 0x5cc340
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x240
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x250], rcx
mov eax, dword [0x00693284]
add eax, 1
cmp dword [0x00693284], eax
jne 0x5cc372
mov ecx, dword [0x0069592c]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006932f8]
add eax, 1
cmp dword [0x006932f8], eax
jne 0x5cc39b
mov ecx, dword [0x00695904]
mov edx, dword [0x006932d0]
mov r8d, dword [0x00693414]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693308]
add eax, 1
cmp dword [0x00693308], eax
jne 0x5cc3c4
mov ecx, dword [0x006931d8]
mov edx, dword [0x006933a4]
mov r8d, dword [0x0069342c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov dword [0x006931d4], 0x30a
mov eax, dword [0x006931d4]
sub eax, 0x1a7
mov dword [0x006932b8], eax
mov eax, dword [0x006957fc]
cmp eax, dword [0x00695880]
je 0x5cc3fa
mov eax, dword [0x006957fc]
mov dword [0x00695880], eax
mov eax, dword [0x006958e0]
mov dword [0x00695840], eax
call fcn.005c9c20
mov eax, dword [0x006958e0]
mov dword [0x00695840], eax
mov eax, dword [0x006942bc]
cmp eax, dword [0x00695828]
je 0x5cc431
mov eax, dword [0x006942bc]
mov dword [0x00695828], eax
mov eax, dword [0x00695944]
add eax, dword [0x0069328c]
mov ecx, dword [0x006933a0]
add ecx, dword [0x00693428]
cmp eax, ecx
jle 0x5cc457
mov dword [0x00695944], 0x39
nop
lea rcx, [rbp + 0x38]
mov edx, 0x104
call qword [0x006a8c70]
mov rcx, qword [rbp + 0x250]
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.0040ec40
mov rax, qword [rbp + 0x250]
mov rcx, qword [rax]
xor edx, edx
call fcn.00410520
test eax, eax
je 0x5cc4b9
mov rcx, qword [rbp + 0x250]
lea rdx, [0x005cc4f4]
call fcn.00410070
jmp 0x5cc4b9
call fcn.005cb920
cmp eax, dword [0x00693204]
jle 0x5cc4d0
mov dword [0x00693204], 0x38
mov rax, qword [rbp + 0x250]
lea rsp, [rbp + 0x240]
pop rbp
ret