joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4585c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
sub esp, 0x34c
lea ebp, [esp - 4]
mov eax, dword [0x7bb3e8]
xor eax, ebp
mov dword [ebp + 0x34c], eax
push 0xbc
mov eax, 0x6ae9d4
call fcn.006523d1
mov esi, ecx
lea eax, [ebp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x45861f
push 0
push str.WSAStartup_failed
lea ecx, [ebp + 0x2e4]
call fcn.00453beb
push 0x7625d4
lea eax, [ebp + 0x2e4]
push eax
call fcn.0066a234
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xac], edi
jne 0x458639
push edi
mov ecx, esi
call fcn.00457a8a
jmp 0x4586ee
lea eax, [esi + 0x9c]
cmp dword [eax + 0x14], 8
jb 0x458647
mov eax, dword [eax]
push 1
push 0x40
push 0x22
push eax
lea ecx, [ebp - 0xc8]
call fcn.00457318
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 1
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0xbc], 0
je 0x4586bf
push str.Cannot_open__
lea ecx, [ebp]
call fcn.00442ebe
lea eax, [esi + 0x98]
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp]
lea ecx, [ebp]
call dword [eax + 0x2c]
mov eax, dword [ebp]
lea ecx, [ebp]
push 0x7563ac
call dword [eax + 0x24]
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x27c]
call fcn.00453afb
push 0x7625d4
lea eax, [ebp + 0x27c]
jmp 0x458619
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.00457a8a
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 1
call fcn.0044cabb
lea ecx, [ebp - 0xc8]
call fcn.004483e2
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x34c]
xor ecx, ebp
call fcn.0065231e
lea esp, [ebp + 0x350]
pop ebp
ret

Function at 0x45971a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6aeb82
call fcn.00651da4
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6dc298
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0049880e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459728
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6aeb82
call fcn.00651da4
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6dc298
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0049880e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x459780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x6aeb9f
call fcn.00651da4
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi], 0x6dc298
lea ecx, [esi + 0x20]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.004c830d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45c47c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 0x1f
test al, 1
je 0x45c496
and dword [0], 0
test esi, esi
jne 0x45c4a1
xor eax, eax
jmp 0x45c524
push edi
xor edi, edi
push esi
call fcn.0067a450
pop ecx
test eax, eax
jne 0x45c523
push esi
call fcn.0046b6ee
inc edi
cmp edi, 3
jl 0x45c4a4
push 0x40
pop esi
push esi
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0066c620
add esp, 0xc
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x45c4e9
call esi
mov dword [ebp - 0x64], eax
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
push 0x28
rep stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
test eax, eax
jne 0x45c513
call esi
mov dword [ebp - 0x24], eax
call esi
mov dword [0x7c62a0], eax
and dword [0], 0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45c940
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x6caff1
call fcn.00651da4
sub esp, 0x444
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, 0x104
mov dword [ebp - 0x10], edi
test eax, eax
jne 0x45c977
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x248]
push ecx
push edi
push 0x6dc2e4
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x45c9b0
call fcn.0067b8f4
push eax
call fcn.0067b8f4
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00461447
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00428153
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
test esi, esi
je 0x45ca2d
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x45c9db
sub ecx, edx
mov eax, 0x103
sar ecx, 1
sub eax, ecx
lea ecx, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.0043b7d2
push esi
mov byte [ebp - 4], 1
call fcn.004287c6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004285c7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.0042810c
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004284eb
jmp 0x45ca39
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.0042810c
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45cacc
Capabilities:
Create directory

Disassembly:
mov eax, 0x6aadef
call fcn.00651da4
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x45caeb
mov eax, dword [esi]
jmp 0x45caed
mov eax, esi
push 0x5c
push eax
call fcn.0066cbdb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45cb1c
cmp dword [esi + 0x14], ebx
jb 0x45cb06
mov eax, dword [esi]
jmp 0x45cb08
mov eax, esi
push 0x2f
push eax
call fcn.0066cbdb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45cb9e
cmp dword [esi + 0x14], ebx
jb 0x45cb25
mov eax, dword [esi]
jmp 0x45cb27
mov eax, esi
sub edi, eax
sar edi, 1
cmp dword [esi + 0x14], ebx
jb 0x45cb34
mov eax, dword [esi]
jmp 0x45cb36
mov eax, esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00428153
xor ecx, ecx
mov dword [ebp - 0x10], 7
xor eax, eax
mov dword [ebp - 4], ecx
push edi
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
push eax
call fcn.00428657
push 1
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
call fcn.0045cacc
xor edi, edi
lea ecx, [ebp - 0x24]
push edi
push 1
call fcn.004284eb
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.004284eb
cmp byte [ebp + 0xc], 0
je 0x45cb9e
cmp dword [esi + 0x14], ebx
jb 0x45cb96
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d23f
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x6aadef
call fcn.00651da4
sub esp, 0x280
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str._s.
push eax
call fcn.00462014
add esp, 0xc
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
cmp dword [ebp - 0x28], 8
mov dword [ebp - 4], ebx
jae 0x45d276
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45d332
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x6d6aa0
push eax
call fcn.00462014
add esp, 0x10
test byte [ebp - 0x28c], 0x10
mov byte [ebp - 4], 1
jne 0x45d2cb
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x45d2c3
lea eax, [ebp - 0x24]
push eax
call fcn.0046cc19
jmp 0x45d307
push 0x6dc30c
lea eax, [ebp - 0x260]
push eax
call fcn.005f3608
test eax, eax
je 0x45d307
push 0x6dc304
lea eax, [ebp - 0x260]
push eax
call fcn.005f3608
test eax, eax
je 0x45d307
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x45d301
lea eax, [ebp - 0x24]
push eax
call fcn.0045d23f
push ebx
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004284eb
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45d28f
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x45d443
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d45b
test al, 0x10
je 0x45d45b
xor eax, eax
inc eax
jmp 0x45d45d
xor eax, eax
ret 4

Function at 0x45d475
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d48d
test al, 0x10
jne 0x45d48d
xor eax, eax
inc eax
jmp 0x45d48f
xor eax, eax
ret 4
Function at 0x45d552
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6b6ec3
call fcn.00651da4
sub esp, 0x29c
push ebx
push esi
push edi
push 0x6dc434
lea ecx, [ebp - 0x40]
call fcn.00428153
push 1
lea eax, [ebp - 0x40]
xor edi, edi
push eax
sub esp, 0x18
mov dword [ebp - 4], edi
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004295d6
lea eax, [ebp - 0x28]
push eax
call fcn.0045c726
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004284eb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45d5af
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45d61c
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x45d5d5
cmp word [ebp - 0x27c], 0x2e
je 0x45d603
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00428153
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 3
call fcn.0045e003
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004284eb
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45d5c7
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45d648
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6b6ec3
call fcn.00651da4
mov eax, dword [ebp + 0x10]
sub esp, 0x29c
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x45d669
mov eax, 0x6dc434
push eax
lea ecx, [ebp - 0x40]
call fcn.00428153
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push 1
push eax
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004295d6
lea eax, [ebp - 0x28]
push eax
call fcn.0045c726
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004284eb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45d6af
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45d6c8
xor esi, esi
jmp 0x45d723
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004295d6
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.0045e003
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004284eb
lea eax, [ebp - 0x2a8]
inc esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45d6c8
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
push str.Found__d_entries_using_filter__s_in_directory__s
call fcn.0040e854
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d775
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6aee31
call fcn.00651da4
sub esp, 0x64
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
mov dword [ebp - 4], edi
cmp byte [0x7c62a6], al
je 0x45d7b6
push 0x6dc4a4
push dword [ebp + 8]
call fcn.00470203
jmp 0x45d8c6
push str.SHGetKnownFolderPath
push 0x6d6e4c
call fcn.004608c1
mov dword [ebp - 0x28], 0x374de290
mov dword [ebp - 0x24], 0x4565123f
mov dword [ebp - 0x20], 0xc4396491
mov dword [ebp - 0x1c], 0x7b465e92
test eax, eax
je 0x45d852
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x8000
lea ecx, [ebp - 0x28]
push ecx
call eax
test eax, eax
js 0x45d852
push dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
call fcn.00428153
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0043b84e
push eax
lea ecx, [ebp - 0x40]
call fcn.004281d1
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.004284eb
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004284eb
push 2
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x45d84a
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x45d8ba
push 2
push 0x118
call fcn.0045c449
push 1
push 5
mov esi, eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45d8ba
push 0x6dc4d0
lea ecx, [ebp - 0x58]
call fcn.00428153
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00428153
lea eax, [ebp - 0x70]
push eax
call fcn.0045c726
push eax
lea ecx, [ebp - 0x40]
call fcn.004281d1
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.004284eb
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004284eb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.0042810c
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45d936
Capabilities:
Move file

Disassembly:
push 3
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
ret 8

Function at 0x45dbed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x18]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x45dc30
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x45dc52
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
test ecx, ecx
je 0x45dc3c
mov dword [ecx], eax
cmp eax, esi
je 0x45dc50
sub esi, eax
add eax, edi
push esi
push 0
push eax
call fcn.0066c620
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x45dc5a
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
xor ebx, ebx
call fcn.0045d23f
mov esi, ebx
push ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45dc96
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x45dc98
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc esi
cmp esi, 5
jl 0x45dc69
jmp 0x45dc98
mov bl, 1
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x45dcf2
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
push 0x22
pop eax
cmp word [edi], ax
jne 0x45dd0f
add edi, 2
push eax
lea eax, [edi + 2]
push eax
jmp 0x45dd12
push 0x20
push edi
call fcn.0066ad67
mov esi, eax
xor ebx, ebx
mov ebp, ebx
pop ecx
pop ecx
test esi, esi
je 0x45dd2e
movzx ebp, word [esi]
xor ecx, ecx
mov word [esi], cx
add esi, 2
push edi
call fcn.0045d475
test al, al
jne 0x45dd40
push 2
pop eax
jmp 0x45ddcf
push 0x3c
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0066c620
add esp, 0xc
mov dword [esp + 0x20], edi
xor edi, edi
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 0x24], esi
inc edi
mov dword [esp + 0x14], 0x540
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x45ddc5
cmp dword [esp + 0x48], ebx
je 0x45ddc5
push 0x493e0
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x45ddb0
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x45ddbb
mov ebx, dword [esp + 0x50]
jmp 0x45ddbb
mov ecx, 0x102
cmp eax, ecx
jne 0x45ddbb
mov ebx, ecx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x45ddcd
mov word [esi - 2], bp
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4
Function at 0x45e721
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x45e72f
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
test eax, eax
js 0x45e755
lea eax, [edi*2 + 2]
call fcn.00652450
mov esi, esp
jmp 0x45e766
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x7c62a0], eax
mov dword [0], esi
lea eax, [edi*2 + 2]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
push esi
call fcn.0066a680
add esp, 0xc
push 0x5c
pop edx
cmp word [esi], dx
jne 0x45e79b
cmp word [esi + 2], dx
jne 0x45e79b
cmp word [esi + 4], 0x3f
jne 0x45e800
cmp word [esi + 6], dx
jne 0x45e800
add esi, 8
cmp edi, 3
jl 0x45e7aa
cmp word [esi + 2], 0x3a
jne 0x45e7aa
add esi, 6
push edx
push esi
call fcn.0047931c
mov esi, eax
test esi, esi
je 0x45e7f3
mov edi, dword [ebp - 4]
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45e7d5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x45e81b
push 0x5c
xor ecx, ecx
pop eax
mov word [esi - 2], ax
cmp word [esi], cx
je 0x45e7f3
push eax
lea eax, [esi + 2]
push eax
call fcn.0047931c
mov esi, eax
test esi, esi
jne 0x45e7ba
mov al, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
pop ecx
add esi, 4
movzx eax, word [esi]
add esi, 2
cmp ax, dx
jne 0x45e816
sub ecx, 1
je 0x45e7aa
test ax, ax
jne 0x45e806
xor al, al
jmp 0x45e7f5

Function at 0x45ee99
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6af091
call fcn.00651da4
push ecx
xor edx, edx
mov dword [ebp - 0x10], edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edx
jb 0x45eec2
mov eax, dword [esi]
jmp 0x45eec4
mov eax, esi
xor ecx, ecx
push ebx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edx
push edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 1
call ebx
mov edi, eax
test edi, edi
je 0x45ef41
push 0
push edi
mov ecx, esi
call fcn.0043ab3d
cmp dword [esi + 0x14], 8
jb 0x45eef8
mov eax, dword [esi]
jmp 0x45eefa
mov eax, esi
push eax
push edi
call ebx
test eax, eax
jne 0x45ef18
and dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x45ef0f
mov eax, dword [esi]
jmp 0x45ef11
mov eax, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x45ef41
cmp dword [esi + 0x14], 8
jb 0x45ef22
mov ecx, dword [esi]
jmp 0x45ef24
mov ecx, esi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x45ef29
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0043ab3d
xor eax, eax
pop ebx
cmp dword [esi + 0x10], eax
jne 0x45ef5e
mov edi, 0x6dc30c
push edi
call fcn.004287c6
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004286de
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x45f5f9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
mov ebx, 0x104
or esi, 0xffffffff
push ebx
push eax
push dword [ebp + 8]
mov edi, SysReAllocString
call fcn.0046e640
test al, al
je 0x45f6a1
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x45f6a1
push str.FATE
lea eax, [ebp - 0x208]
push eax
call fcn.0047ae37
test al, al
jne 0x45f6a1
push str.FAT32
lea eax, [ebp - 0x208]
push eax
call fcn.0047ae37
test al, al
jne 0x45f69f
push 0x6dcc28
lea eax, [ebp - 0x208]
push eax
call fcn.0047ae37
test al, al
jne 0x45f69a
push str.FAT16
lea eax, [ebp - 0x208]
push eax
call fcn.0047ae37
test al, al
je 0x45f6a1
mov esi, 0x7ffa8000
mov edi, ebx
push dword [ebp + 8]
push edi
push esi
push str.GetMaxFileSize___returning__Ld_for___s_
call fcn.0040e854
add esp, 0x10
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45fa95
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x438]
push ebx
push esi
push 0x21c
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, eax
call fcn.00473102
xor ebx, ebx
test al, al
je 0x45fb01
mov ecx, str.Sysnative..explorer.exe
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x45fad1
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
test ecx, ecx
je 0x45fb3f
mov ecx, 0x6dcd7c
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x45fb13
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
xor ecx, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45fd5e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x6aef96
call fcn.00651da4
sub esp, 0x2c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push 0x104
push 0
push eax
call fcn.0043b7d2
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x45fd8e
lea eax, [ebp - 0x38]
push ebx
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0046e640
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
lea ecx, [ebp - 0x38]
push 0
push 1
sete bl
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4