joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff4
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
inc eax
jne 0x47a2f9
xor eax, eax
jmp 0x47a345
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WriteFile_1
neg eax
sbb eax, eax
neg eax
test al, al
je 0x47a334
mov edx, dword [ebx]
cmp edx, dword [ebp - 4]
jle 0x47a345
push 0x2000001e
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x47a345
call sub.kernel32.dll_GetLastError_1
sub eax, 5
je 0x47a2f9
sub eax, 0x1c
je 0x47a2f9
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x47a34c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
inc eax
jne 0x47a373
mov byte [ebp - 1], 0
jmp 0x47a3ea
xor ebx, ebx
jmp 0x47a3e6
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x47a3cf
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, dword [ebp - 8]
jle 0x47a3b6
push 0x2000001e
call sub.kernel32.dll_SetLastError
mov byte [ebp - 1], 0
jmp 0x47a3cb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_FlushFileBuffers
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
mov bl, 1
jmp 0x47a3e6
call sub.kernel32.dll_GetLastError_1
not eax
sub eax, 5
je 0x47a3e0
sub eax, 0x1c
jne 0x47a3e6
mov byte [ebp - 1], 0
mov bl, 1
test bl, bl
je 0x47a377
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x47a3f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047a528
test al, al
je 0x47a3fa
xor eax, eax
push ebp
push 0x47a4b1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
inc eax
jne 0x47a443
mov byte [ebp - 1], 0
jmp 0x47a48c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x47a488
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, dword [ebp - 8]
jle 0x47a482
push 0x2000001e
call sub.kernel32.dll_SetLastError
mov byte [ebp - 1], 0
jmp 0x47a48c
mov byte [ebp - 1], 1
jmp 0x47a48c
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a4b8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047a654
ret

Function at 0x47cc84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040402c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47cc9d
test al, 0x10
jne 0x47cca1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x494d04
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x494f58
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, edx
mov byte [esi + 4], bl
push 0x81
lea eax, [esi + 0xa6]
push eax
lea eax, [esi + 0x21]
push eax
lea eax, [esi + 0x1d]
push eax
lea eax, [esi + 0x19]
push eax
push 0x81
lea eax, [esi + 0x25]
push eax
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00403d90
lea eax, [ebp - 0x110]
mov edx, 0x494f70
call fcn.00403e70
mov eax, dword [ebp - 0x110]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x494d8b
mov eax, esi
call fcn.00494c60
jmp case.0x494ea7.0
lea eax, [ebp - 0x110]
mov dl, byte [esi + 4]
call fcn.00403d90
lea eax, [ebp - 0x110]
mov edx, 0x494f70
call fcn.00403e70
mov eax, dword [ebp - 0x110]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [esi + 5], eax
lea eax, [esi + 0x15]
push eax
lea eax, [esi + 0x11]
push eax
lea eax, [esi + 0xd]
push eax
lea eax, [esi + 9]
push eax
lea eax, [ebp - 0x110]
mov dl, byte [esi + 4]
call fcn.00403d90
lea eax, [ebp - 0x110]
mov edx, 0x494f70
call fcn.00403e70
mov eax, dword [ebp - 0x110]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0x114]
mov dl, byte [esi + 4]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x118]
call fcn.00402bec
mov edx, 0x494f74
lea eax, [ebp - 0x118]
mov cl, 2
call fcn.00402bbc
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x110]
call fcn.00403e0c
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 9]
call fcn.00408a40
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
lea eax, [ebp - 9]
push eax
call sub.mpr.dll_WNetGetConnectionA
test eax, eax
jne 0x494e90
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00408bc0
mov edx, dword [ebp - 0x110]
lea eax, [esi + 0x127]
call fcn.00403c40
jmp 0x494e9b
lea eax, [esi + 0x127]
call fcn.00403bec
mov eax, dword [esi + 5]
cmp eax, 6
ja case.0x494ea7.0
jmp dword [eax*4 + 0x494eae]
lea eax, [ebp - 0x110]
mov dl, byte [esi + 4]
call fcn.00403d90
mov eax, dword [ebp - 0x110]
call fcn.00495014
mov ebx, eax
test ebx, ebx
je case.0x494ea7.0
lea eax, [esi + 0x12b]
mov edx, dword [ebx + 0x24]
call fcn.00403c40
jmp case.0x494ea7.0
lea eax, [esi + 0x12b]
mov edx, 0x494f80
call fcn.00403c40
jmp case.0x494ea7.0
lea eax, [esi + 0x12b]
mov edx, 0x494f90
call fcn.00403c40
jmp case.0x494ea7.0
lea eax, [esi + 0x12b]
mov edx, 0x494fa0
call fcn.00403c40
jmp case.0x494ea7.0
lea eax, [esi + 0x12b]
mov edx, 0x494fb0
call fcn.00403c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494f5f
lea eax, [ebp - 0x110]
call fcn.00403bec
ret
Function at 0x49c4fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
mov esi, 0x4f5b84
xor eax, eax
push ebp
push 0x49c5d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebx + 0x6fa6]
call fcn.0049a138
lea edx, [esi + 4]
mov eax, dword [ebx + 0x6faa]
call fcn.0049a138
lea edx, [esi + 8]
mov eax, dword [ebx + 0x6fae]
call fcn.0049a138
lea edx, [esi + 0xc]
mov eax, dword [ebx + 0x6fb2]
call fcn.0049a138
lea edx, [esi + 0x10]
mov eax, dword [ebx + 0x6fb6]
call fcn.0049a138
lea edx, [esi + 0x14]
mov eax, dword [ebx + 0x6fba]
call fcn.0049a138
mov edx, esi
xor ecx, ecx
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0x30]
test al, al
jne 0x49c5b8
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov dword [ebx + 0x112], esi
lea edx, [ebp - 8]
mov eax, esi
call fcn.004080dc
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x49c5e8
call fcn.00403eb4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x499b30]
call fcn.0040b770
call fcn.004036c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c5da
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c10
ret

Function at 0x4a9648
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a965c
add esp, 0xfffffff0
call fcn.0040330c
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a96e6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403068
lea edx, [ebp - 4]
mov eax, esi
call fcn.0048698c
mov edx, dword [ebp - 4]
lea eax, [edi + 0x14]
call fcn.00403c40
mov eax, dword [esi + 0xf3]
mov dword [edi + 0x18], eax
mov eax, esi
call fcn.0048885c
mov dword [edi + 0x24], eax
lea edx, [ebp - 4]
mov eax, dword [esi + 0xc]
call fcn.00486974
mov edx, dword [ebp - 4]
lea eax, [edi + 0x1c]
call fcn.00403c40
mov dword [edi + 0x20], esi
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a96ed
lea eax, [ebp - 4]
call fcn.00403bec
ret
Function at 0x4b95f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dl, byte [esi + 0x1b1]
je 0x4b9636
mov byte [esi + 0x1b1], dl
mov eax, esi
call fcn.00424f80
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b962f
inc ebx
xor edi, edi
mov edx, edi
mov eax, esi
call fcn.00424f50
mov dl, byte [esi + 0x1b1]
xor dl, 1
call fcn.004235fc
inc edi
dec ebx
jne 0x4b9614
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
pop edi
pop esi
pop ebx
ret

Function at 0x4d16e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d187f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [esi + 0x1a], 0
je 0x4d171a
push 0
push 0
push 1
mov ecx, 0x1771
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x5b]
mov eax, dword [esi + 0x29]
call fcn.004c0a5c
mov eax, dword [esi + 0x29]
add eax, 0x32
mov edx, 0x4d1898
call fcn.00403c40
mov eax, dword [esi + 0x29]
mov byte [eax + 0x30], 0
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + 0x47]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d18a8
call fcn.00411830
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x5b]
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d18bc
call fcn.00411830
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x77]
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d18d4
call fcn.00411830
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x7b]
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d18e8
call fcn.00411830
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov ecx, 0x4d18fc
mov edx, 0x4d190c
call fcn.00411830
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov ecx, 0x4d1920
mov edx, 0x4d193c
call fcn.00411830
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d17f9
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00403e18
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d1958
call fcn.00411830
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a58
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408574
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi + 0x29]
mov eax, dword [eax + 0x2c]
mov edx, 0x4d196c
call fcn.00411830
mov dl, 1
mov eax, dword [esi + 0x29]
call fcn.004c0b80
mov eax, dword [esi + 0x29]
mov bl, byte [eax + 0x31]
cmp word [esi + 0x1a], 0
je 0x4d1864
test bl, bl
je 0x4d1851
push 0
push 0
push 0
mov ecx, 0x1771
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
jmp 0x4d1864
push 0
push 0
push 0xffffffffffffffff
mov ecx, 0x1771
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1886
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403c10
ret
Function at 0x4dd6d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea eax, [ebp - 0x168]
mov edx, dword [0x407180]
call fcn.00404430
xor eax, eax
push ebp
push 0x4dd7eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
mov edx, ebx
call fcn.00403d90
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
mov ecx, 0x4dd804
call fcn.00403eb4
xor ebx, ebx
mov eax, pe_nt_image_headers32
call fcn.00408bd4
mov edi, eax
mov eax, pe_nt_image_headers32
call fcn.00408bd4
mov esi, eax
push 0xff
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xff
push edi
mov eax, dword [ebp - 8]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4dd7ab
lea eax, [ebp - 0x16c]
mov ecx, 0x4dd810
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.00408348
mov dword [ebp - 4], eax
lea eax, [ebp - 0x168]
call fcn.004083b8
mov eax, dword [ebp - 4]
sub eax, 1
jae 0x4dd7ab
mov bl, 1
mov eax, edi
call fcn.00408c20
mov eax, esi
call fcn.00408c20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd7f2
lea eax, [ebp - 0x16c]
call fcn.00403bec
lea eax, [ebp - 0x168]
mov edx, dword [0x407180]
call fcn.004044f8
lea eax, [ebp - 8]
call fcn.00403bec
ret
Function at 0x4de2ec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040401c
xor eax, eax
push ebp
push 0x4de4ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00403bec
test ebx, ebx
je 0x4de49f
mov eax, esi
call fcn.004defb4
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
call fcn.00403e68
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4de365
lea eax, [ebp - 4]
mov edx, 0x4de4e0
call fcn.00403e70
push 0x4201
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x170]
call fcn.0040402c
mov edi, eax
push edi
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00407d54
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, 0x4de4ec
call fcn.00403eb4
mov edx, dword [ebp - 0x170]
mov eax, dword [esi + 0x1dc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp byte [ebp - 9], 0
je 0x4de40f
lea ecx, [ebp - 0x170]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004defe4
mov ecx, dword [ebp - 0x170]
mov edx, ebx
mov eax, dword [ebx + 4]
call fcn.00443a5c
mov ebx, eax
jmp 0x4de437
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x160]
mov ecx, 0x104
call fcn.00403e18
mov ecx, dword [ebp - 0x170]
mov edx, ebx
mov eax, dword [ebx + 4]
call fcn.00443a5c
mov ebx, eax
mov eax, dword [esi + 0x1dc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, ebx
call fcn.00442bec
mov dl, 1
mov eax, ebx
call fcn.004430e0
cmp byte [ebp - 9], 0
jne 0x4de49f
mov edx, dword [ebp - 0x168]
mov eax, ebx
call fcn.00442cd8
push 0x4003
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403eb4
push edi
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x168]
mov eax, ebx
call fcn.00442d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de4d1
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00403c10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c10
ret
Function at 0x4de4f0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp + 8]
call fcn.0040401c
xor eax, eax
push ebp
push 0x4de6fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00403bec
mov eax, edi
call fcn.004defb4
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00403e68
mov edx, dword [ebp + 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4de560
lea eax, [ebp + 8]
mov edx, 0x4de718
call fcn.00403e70
push 0x4201
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x16c]
call fcn.0040402c
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x174]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00407d54
mov ecx, dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
mov edx, 0x4de724
call fcn.00403eb4
mov edx, dword [ebp - 0x16c]
mov eax, dword [edi + 0x1dc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
test bl, bl
je 0x4de5f7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x134]
call fcn.00443a78
mov dword [esi], eax
jmp 0x4de623
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00403e18
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x134]
call fcn.00443a78
mov dword [esi], eax
mov eax, dword [edi + 0x1dc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, dword [esi]
call fcn.00442bec
test bl, bl
jne 0x4de6d0
mov eax, dword [esi]
mov edx, dword [ebp - 0x164]
call fcn.00442cd8
mov eax, dword [ebp - 0x164]
cmp eax, dword [edi + 0x258]
je 0x4de6c3
push 0x4003
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00403eb4
mov eax, dword [ebp - 0x16c]
call fcn.0040402c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esi]
mov edx, dword [ebp - 0x164]
call fcn.00442d0c
mov eax, dword [ebp + 8]
call fcn.00403e68
cmp eax, 3
jle 0x4de6d0
mov eax, dword [esi]
mov eax, dword [eax + 0x14]
mov dword [edi + 0x258], eax
mov eax, dword [ebp - 0x164]
mov dword [edi + 0x254], eax
jmp 0x4de6d0
mov eax, dword [esi]
mov edx, dword [edi + 0x254]
call fcn.00442d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de705
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00403c10
lea eax, [ebp - 8]
call fcn.00403bec
lea eax, [ebp + 8]
call fcn.00403bec
ret
Function at 0x4dec08
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x4dec8f
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [ebp + 8]
cmp edx, 0x1f
ja 0x4dec36
bt dword [ecx - 8], edx
jae 0x4dec79
add al, 0x41
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp byte [eax + 0x25f], 0
jne 0x4dec77
lea eax, [ebp - 8]
mov dl, byte [ebp - 1]
call fcn.00403d90
lea eax, [ebp - 8]
mov edx, 0x4deca8
call fcn.00403e70
mov eax, dword [ebp - 8]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 4
je 0x4dec79
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dec96
lea eax, [ebp - 8]
call fcn.00403bec
ret
Function at 0x4decac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dee6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004274e4
test al, al
je 0x4dee59
mov eax, dword [ebp - 0xc]
test byte [eax + 0x20], 1
jne 0x4dee59
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x25d], 0
mov eax, dword [0x4f4ab8]
mov eax, dword [eax]
mov si, word [eax + 0x38]
mov eax, dword [0x4f4ab8]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00431dfc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1dc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x134]
call fcn.00443d5c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x134]
call fcn.00443a3c
mov eax, dword [0x4f4940]
mov eax, dword [eax]
call fcn.004331d0
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
push ebp
mov al, byte [ebp - 4]
call fcn.004dec08
pop ecx
test al, al
je 0x4dee14
mov bl, byte [ebp - 4]
add bl, 0x41
mov eax, dword [ebp - 0xc]
cmp word [eax + 0x24a], 0
je 0x4ded9a
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403d90
lea eax, [ebp - 0x14]
mov edx, 0x4dee84
call fcn.00403e70
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004ddc6c
test al, al
je 0x4dee14
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403d90
lea eax, [ebp - 0x14]
mov edx, 0x4dee84
call fcn.00403e70
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004de4f0
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403d90
lea eax, [ebp - 0x14]
mov edx, 0x4dee84
call fcn.00403e70
mov eax, dword [ebp - 0x14]
call fcn.0040402c
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jb 0x4dedf1
sub eax, 2
jne 0x4dee09
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x134]
mov ecx, 0x4dee90
mov edx, dword [ebp - 0x10]
call fcn.00443a5c
jmp 0x4dee14
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004dea14
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jne 0x4ded4f
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x25d], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x134]
call fcn.00443dcc
mov eax, dword [ebp - 0xc]
call fcn.00444898
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00444870
mov eax, dword [0x4f4ab8]
mov eax, dword [eax]
mov edx, esi
call fcn.00431dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dee76
lea eax, [ebp - 0x14]
call fcn.00403bec
ret
Function at 0x4e0144
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
xor eax, eax
mov dword [ebp - 0x124], eax
xor eax, eax
push ebp
push 0x4e0313
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x120], 0x94
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x110]
sub eax, 1
jb 0x4e018a
dec eax
je 0x4e0196
jmp 0x4e01a0
mov dword [ebp - 4], 0xffffffff
jmp 0x4e02fa
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4e02fa
push 0x81
lea eax, [ebp - 0x89]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4df650]
call fcn.004dfaf8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e02f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x89]
call fcn.00408bc0
lea eax, [ebp - 0x124]
mov edx, 0x4e032c
call fcn.00403e70
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.004dfbf0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d]
xor edx, edx
call fcn.004dfabc
cmp ax, 4
jb 0x4e02a7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d]
mov edx, 1
call fcn.004dfabc
test ax, ax
jne 0x4e02a7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d]
mov edx, 3
call fcn.004dfabc
cmp ax, 0x3bb
jb 0x4e02a7
mov dl, 1
mov eax, dword [0x44b718]
call fcn.0044b84c
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0044b8e0
xor ecx, ecx
mov edx, 0x4e0340
mov eax, ebx
call fcn.0044b944
test al, al
je 0x4e029e
mov edx, 0x4e0378
mov eax, ebx
call fcn.0044bcc0
test al, al
jne 0x4e0297
mov ecx, 1
mov edx, 0x4e0378
mov eax, ebx
call fcn.0044bb58
mov dword [ebp - 4], 1
jmp 0x4e02dd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4e02dd
mov dword [ebp - 4], 0xffffffff
jmp 0x4e02dd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d]
xor edx, edx
call fcn.004dfabc
cmp ax, 4
jb 0x4e02d6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d]
mov edx, 1
call fcn.004dfabc
test ax, ax
jbe 0x4e02d6
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4e02dd
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e02fa
mov eax, dword [ebp - 8]
call fcn.00403090
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e031a
lea eax, [ebp - 0x124]
call fcn.00403bec
ret