joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f33a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x264
push eax
push 8
push 0x557080
push 0x55708c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e268], eax
mov esp, ebp
pop ebp
ret

Function at 0x44f3f5
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525795
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x25c
mov dword [ebp - 0x268], ecx
lea ecx, [ebp - 0x14]
call fcn.004046f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004046f0
mov byte [ebp - 4], 1
push 0x725
mov ecx, dword [ebp - 0x268]
call fcn.0050d114
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.004062e0
push 0x104
push 0
lea eax, [ebp - 0x264]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x264]
push edx
call fcn.004e96e0
add esp, 8
push 0x557094
lea eax, [ebp - 0x264]
push eax
call fcn.004e96f0
add esp, 8
lea ecx, [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44f4da
push 0x10
push 0x557098
push str.Cant_find_QC_Setting_Folder__QC_
mov ecx, dword [ebp - 0x268]
call fcn.0050b84e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0050dea1
jmp 0x44f61a
push 0x140
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.004e9480
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
push str...ini
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x44f548
push 0x10
push str.FAIL
push str.Cant_find_any_QC_Setting_INI_file
mov ecx, dword [ebp - 0x268]
call fcn.0050b84e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0050dea1
jmp 0x44f61a
cmp dword [ebp - 0x15c], 0xffffffff
je 0x44f5b6
lea ecx, [ebp - 0x14]
call fcn.0050de2c
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0050e02a
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.0050370f
mov dword [ebp - 0x160], eax
push 0
mov edx, dword [ebp - 0x160]
push edx
lea ecx, [ebp - 0x14]
call fcn.005031e2
lea ecx, [ebp - 0x14]
call fcn.00404710
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004062b0
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44f5b4
jmp 0x44f5b6
jmp 0x44f548
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
mov eax, dword [ebp - 0x268]
add eax, 0x87c
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 0x87c
push ecx
push 0
mov ecx, dword [ebp - 0x18]
call fcn.004274d0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00406220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0050dea1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45cfac
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x45cfc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x45cfdd
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x52d0e4]
mov dword [edx + ecx*4], eax
jmp 0x45cfb9
mov esp, ebp
pop ebp
ret
Function at 0x4618a2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
jmp 0x4618cb
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x40
jae 0x4619d9
mov ecx, dword [ebp - 0x48]
push ecx
push 0x55ce04
lea edx, [ebp - 0x44]
push edx
call fcn.004e998d
add esp, 0xc
mov eax, dword [ebp - 0x50]
add eax, 0x8ec
push eax
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
push 0x55ce08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x461918
jmp 0x4619d9
push 0x55ce18
lea eax, [ebp - 0x40]
push eax
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x461943
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
mov dword [edx + ecx*4 + 0x1060], 0x100
jmp 0x4619d4
push 0x55ce20
lea eax, [ebp - 0x40]
push eax
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x46196b
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
mov dword [edx + ecx*4 + 0x1060], 0x101
jmp 0x4619d4
push 0x55ce2c
lea eax, [ebp - 0x40]
push eax
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x461993
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
mov dword [edx + ecx*4 + 0x1060], 0x102
jmp 0x4619d4
push 0x55ce38
lea eax, [ebp - 0x40]
push eax
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x4619bb
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
mov dword [edx + ecx*4 + 0x1060], 0x103
jmp 0x4619d4
lea eax, [ebp - 0x40]
push eax
call fcn.004b800d
add esp, 4
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
mov dword [edx + ecx*4 + 0x1060], eax
jmp 0x4618c2
mov esp, ebp
pop ebp
ret
Function at 0x478561
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x110], ecx
mov eax, dword [ebp - 0x110]
add eax, 0x4dc
push eax
push 0
push str.ENABLEAUTOTEST
push 0x55ff4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + 0xcfc], eax
cmp dword [0x56e338], 0
jne 0x4785ac
cmp dword [0x56e334], 0
je 0x4785d5
mov edx, dword [ebp - 0x110]
mov dword [edx + 0xcfc], 0
push 0
push 0x54f
mov ecx, dword [ebp - 0x110]
call fcn.0050d114
mov ecx, eax
call fcn.0050d532
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax + 0xcfc]
push ecx
push 0x54f
mov ecx, dword [ebp - 0x110]
call fcn.0050d114
mov ecx, eax
call fcn.00406e30
mov ecx, dword [ebp - 0x110]
call fcn.00478044
mov dword [ebp - 0x108], 1
jmp 0x47861f
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
cmp dword [ebp - 0x108], 0x11
jge 0x4786ad
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x108]
push ecx
push str.InitialPort_d
lea edx, [ebp - 0x104]
push edx
call fcn.004e998d
add esp, 0xc
mov eax, dword [ebp - 0x110]
add eax, 0x4dc
push eax
push 1
lea ecx, [ebp - 0x104]
push ecx
push 0x55ff64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x108]
add eax, 0x608
push eax
mov ecx, dword [ebp - 0x110]
call fcn.0050d114
mov ecx, eax
call fcn.00406e30
jmp 0x478610
mov ecx, dword [ebp - 0x110]
add ecx, 0x4dc
push ecx
push 0x14
push str.MinProgSpeed
push str.MAIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x110]
mov dword [edx + 0x1704], eax
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ecx + 0x1704]
push edx
push 0x55ff84
lea eax, [ebp - 0x104]
push eax
call fcn.004e998d
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0x898
mov ecx, dword [ebp - 0x110]
call fcn.0050d23d
mov esp, ebp
pop ebp
ret
Function at 0x47874a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov dword [ebp - 0x51c], ecx
push 0x104
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x51c]
add ecx, 0x2d4
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004e96e0
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x518]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 0x55ff88
lea edx, [ebp - 0x518]
push edx
call fcn.004e998d
add esp, 0xc
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.004e96f0
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x30c]
push edx
call fcn.004e9480
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x104
lea ecx, [ebp - 0x30c]
push ecx
push 0
push 0x55ff98
push 0x55ffa4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.004e9480
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0
push str.RDTTEST
push 0x55ffb4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
je 0x47888c
cmp dword [0x56d5d0], 0x979
jne 0x47886a
push str.ISP2258RDT.bin
lea ecx, [ebp - 0x414]
push ecx
call fcn.004e96e0
add esp, 8
jmp 0x47888a
cmp dword [0x56d5d0], 0x97a
jne 0x47888a
push str.ISP2256RDT.bin
lea edx, [ebp - 0x414]
push edx
call fcn.004e96e0
add esp, 8
jmp 0x4788ce
cmp dword [0x56d5d0], 0x979
jne 0x4788ae
push str.ISP2258.bin
lea eax, [ebp - 0x414]
push eax
call fcn.004e96e0
add esp, 8
jmp 0x4788ce
cmp dword [0x56d5d0], 0x97a
jne 0x4788ce
push str.ISP2256.bin
lea ecx, [ebp - 0x414]
push ecx
call fcn.004e96e0
add esp, 8
lea edx, [ebp - 0x30c]
push edx
push str.________________________Current_Parameter_setting__r_nFlash:____s_r_n
mov eax, dword [ebp + 8]
push eax
call fcn.004e998d
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e9480
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push str.Firmware:____s_n
lea eax, [ebp - 0x104]
push eax
call fcn.004e998d
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004e96f0
add esp, 8
mov esp, ebp
pop ebp
ret 8
Function at 0x47c70a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526001
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.004046f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
add eax, 0x6e4
push eax
push 0
push str.ENSNINDICATOR
push 0x560a9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x170c], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x170c], 0
je 0x47c88f
push 0x44
push 0
mov eax, dword [ebp - 0x30]
add eax, 0x1710
push eax
call fcn.004e9480
add esp, 0xc
push 0x165
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x1754
push ecx
call fcn.004e9480
add esp, 0xc
mov dword [ebp - 0x2c], 0
jmp 0x47c7ab
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x10
jge 0x47c88f
push 0x15
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push str.PHYSICALDRIVE_d
lea edx, [ebp - 0x28]
push edx
call fcn.00503a72
add esp, 0xc
mov eax, dword [ebp - 0x30]
add eax, 0x6e4
push eax
push 0x15
lea ecx, [ebp - 0x24]
push ecx
push 0x560ab8
lea ecx, [ebp - 0x28]
call fcn.00404710
push eax
push str.SNINDICATOR
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [eax + edx*4 + 0x1714], 1
push str.DEFAULT
lea ecx, [ebp - 0x24]
push ecx
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x47c83e
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [eax + edx*4 + 0x1714], 0
jmp 0x47c88a
movsx ecx, byte [ebp - 0x24]
test ecx, ecx
jne 0x47c868
push 0x14
push 0x20
mov edx, dword [ebp - 0x2c]
add edx, 1
imul edx, edx, 0x15
mov eax, dword [ebp - 0x30]
lea ecx, [eax + edx + 0x1754]
push ecx
call fcn.004e9480
add esp, 0xc
jmp 0x47c88a
push 0x14
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 1
imul eax, eax, 0x15
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + eax + 0x1754]
push edx
call fcn.004e9b20
add esp, 0xc
jmp 0x47c7a2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0050dea1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x47d5aa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], ecx
cmp dword [0x56d58c], 0
je 0x47d64a
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.004e9480
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x208]
push ecx
call fcn.004e9480
add esp, 0xc
push str.C:SMI_Port_InfoBypassVol.map
lea edx, [ebp - 0x104]
push edx
call fcn.004e96e0
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push 0x56e838
push 0x560d2c
push 0x560d30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 5
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x20c]
add ecx, 0xd4
call fcn.0047eb30
mov esp, ebp
pop ebp
ret
Function at 0x497446
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
push edi
mov byte [ebp - 0x408], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x304], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x303]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x608], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x607]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x200], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x1ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x60c], 0
push 0x104
lea eax, [ebp - 0x304]
push eax
call fcn.004b8167
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 0xeb2
push ecx
lea edx, [ebp - 0x304]
push edx
push 0x562e58
lea eax, [ebp - 0x408]
push eax
call fcn.004e998d
add esp, 0x10
lea ecx, [ebp - 0x408]
push ecx
push 0
push 0x562e68
push 0x562e6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0
je 0x4975ca
mov edx, dword [ebp + 8]
mov dword [edx + 0xc10], 0x91
push 0x200
push 0
lea eax, [ebp - 0x608]
push eax
call fcn.004e9480
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x200]
push ecx
call fcn.004e9480
add esp, 0xc
mov byte [ebp - 0x608], 0xf0
mov byte [ebp - 0x607], 0xcc
mov byte [ebp - 0x606], 0xc1
mov byte [ebp - 0x5fd], 1
push 0
push 0x200
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x608]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004831c8
add esp, 0x14
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
jne 0x4975ac
xor eax, eax
jmp 0x4975cf
mov edx, dword [ebp - 0x200]
and edx, 0xff
and edx, 2
test edx, edx
je 0x4975c6
mov eax, 1
jmp 0x4975cf
xor eax, eax
jmp 0x4975cf
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4acac8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x31c], 0
push 0x104
lea eax, [ebp - 0x420]
push eax
call fcn.004b8167
add esp, 8
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4acb1a
push 0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
add eax, 0xeb2
push eax
push str._s_All.txt
lea ecx, [ebp - 0x304]
push ecx
call fcn.004e998d
add esp, 0xc
lea edx, [ebp - 0x304]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.004e96f0
add esp, 8
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x564e9c
lea edx, [ebp - 0x420]
push edx
call fcn.004e9834
add esp, 8
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x4acb82
jmp 0x4acc4f
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x4ff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc10]
push eax
mov ecx, dword [ebp - 0x31c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc60]
push eax
mov ecx, dword [ebp - 0x30c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x30e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x310]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x312]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x316]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x318]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeb2
push ecx
push str._s____.4d__.2d__.2d____.2d:_.2d:_.2d____d____d____x____s_n
lea edx, [ebp - 0x200]
push edx
call fcn.004e998d
add esp, 0x34
mov eax, dword [ebp - 0x308]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.004ea2e0
add esp, 4
push eax
push 1
lea edx, [ebp - 0x200]
push edx
call fcn.004e9694
add esp, 0x10
cmp dword [ebp - 0x308], 0
je 0x4acc67
mov eax, dword [ebp - 0x308]
push eax
call fcn.004e952c
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b254a
Capabilities:
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52624d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
lea ecx, [ebp - 0x360]
call fcn.004046f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004046f0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x258]
push ecx
push 0x5662b8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffff
jne 0x4b25e4
mov dword [ebp - 0x368], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0050dea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.0050dea1
mov eax, dword [ebp - 0x368]
jmp 0x4b270a
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x4b26a4
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5662bc
lea ecx, [ebp - 0x360]
push ecx
call fcn.00503a72
add esp, 0x10
lea ecx, [ebp - 0x360]
call fcn.00404710
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x4b2663
movsx edx, byte [ebp - 0x22c]
cmp edx, 0x2e
je 0x4b2661
mov eax, dword [ebp - 0x360]
push eax
push 0x5662c4
lea ecx, [ebp - 0x35c]
push ecx
call fcn.004e998d
add esp, 0xc
lea edx, [ebp - 0x35c]
push edx
call fcn.004b254a
add esp, 4
jmp 0x4b2675
lea ecx, [ebp - 0x360]
call fcn.00404710
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b269f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4b269f
mov dword [ebp - 0x10], 1
jmp 0x4b25eb
mov edx, dword [ebp - 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.004b8167
add esp, 8
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x36c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0050dea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.0050dea1
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b2f04
Capabilities:
Delete file
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e96e0
add esp, 8
push 0x2e
lea edx, [ebp - 0x20c]
push edx
call fcn.004ec200
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b2f41
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x70
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4b2f5c
jmp 0x4b3033
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4b2f77
jmp 0x4b3033
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.004e96e0
add esp, 8
push str.inf
lea edx, [ebp - 0x314]
push edx
call fcn.004e96f0
add esp, 8
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4b2fb4
jmp 0x4b3033
push 0x20
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
push str.other
lea ecx, [ebp - 0x314]
push ecx
call fcn.004e96f0
add esp, 8
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4b300a
jmp 0x4b3033
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x4b7216
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004e9480
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004e9480
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4b7278
xor eax, eax
jmp 0x4b72a0
push 0x927c0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b72a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
mov dword [ebp - 0x430], 0
push 0xc
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
mov eax, dword [edx*4 + 0x674414]
mov dword [ebp - 0x210], eax
cmp dword [0x56d5a8], 0
je 0x4b72eb
jmp 0x4b7315
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
movsx eax, byte [edx + 0x674490]
cmp eax, 0x43
jl 0x4b7315
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
mov al, byte [edx + 0x674490]
mov byte [ebp - 0x434], al
movsx ecx, byte [ebp - 0x434]
push ecx
push 0x566c54
lea edx, [ebp - 0x428]
push edx
call fcn.004e998d
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004e9480
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push 3
lea edx, [ebp - 0x428]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebp - 0x418], 0x5c
mov word [ebp - 0x416], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004e9480
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x63c]
push ecx
call fcn.004e9480
add esp, 0xc
push 0x104
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4b7496
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x63c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x744], eax
push 0
push 0
mov eax, dword [ebp - 0x744]
push eax
lea ecx, [ebp - 0x740]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x63c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
mov dword [ebp - 0x748], ecx
cmp dword [ebp - 0x748], 0
je 0x4b744c
cmp dword [ebp - 0x748], 1
je 0x4b7472
jmp 0x4b7496
push 4
push str.NTFS
lea edx, [ebp - 0x740]
push edx
call fcn.004e9a20
add esp, 0xc
test eax, eax
jne 0x4b7470
mov dword [ebp - 0x430], 1
jmp 0x4b7496
push 5
push str.exFAT
lea eax, [ebp - 0x740]
push eax
call fcn.004e9a20
add esp, 0xc
test eax, eax
jne 0x4b7496
mov dword [ebp - 0x430], 1
mov eax, dword [ebp - 0x430]
mov esp, ebp
pop ebp
ret