joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f130
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a628
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0xc0]
test al, al
je 0x44f2a6
cmp al, 2
jne 0x44f1c9
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xa0]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xa4]
mov edi, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x44f1a2
jg 0x44f19b
cmp eax, 0x800000
jbe 0x44f1a2
mov eax, 0x800000
xor ecx, ecx
push 0
add edx, eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], edx
push eax
push 0x980c8
push dword [esi]
adc edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push dword [esi + 0xa4]
push dword [esi + 0xa0]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x44f29e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.0044e420
push eax
mov edx, str.Cannot_set_file_pointer_4_._Code
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00454600
add esp, 4
lea ecx, [esi + 0x30]
push eax
call fcn.00449990
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44f250
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44f246
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f2c5
push edx
push ecx
call fcn.00536da7
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x44f29a
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44f290
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f2ca
push edx
push ecx
call fcn.00536da7
add esp, 8
xor al, al
jmp 0x44f2a8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536b66
mov esp, ebp
pop ebp
ret 8
call fcn.00552841
call fcn.00552841
int3
Function at 0x453510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4535fb
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4535ea
jg 0x453550
test edx, edx
je 0x4535ea
nop dword [eax]
call fcn.0044bbc0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4535a7
jg 0x453567
test esi, esi
je 0x4535a7
cmp ebx, eax
jg 0x453577
jl 0x453571
cmp edi, esi
jae 0x453577
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.0054e680
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x4535cc
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4535e4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x453550
jl 0x4535e4
test edi, edi
jne 0x453550
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45361d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x45361f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4536d5
jg 0x45363a
test esi, esi
je 0x4536d5
test eax, eax
jl 0x453683
jg 0x453644
test ebx, ebx
je 0x453683
cmp edi, eax
jg 0x453654
jl 0x45364e
cmp esi, ebx
jae 0x453654
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.0054e680
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x45368a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4536d5
jg 0x453694
test esi, esi
je 0x4536d5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4536d5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x4536c0
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.00553b1f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b1b0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp byte [0x5fd909], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
jne 0x457f6d
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
lea edx, [ebp - 0x1c]
call fcn.00457ab0
add esp, 4
mov bl, al
jmp 0x457fd2
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
call fcn.0045ba80
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.00457d20
mov byte [ebp - 4], 0
add esp, 8
mov edx, dword [ebp - 0x20]
mov bl, al
cmp edx, 8
jb 0x457fd2
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457fc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4580ad
push edx
push ecx
call fcn.00536da7
add esp, 8
test bl, bl
je 0x4580b2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45805a
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x458056
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45804c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4580cd
push edx
push ecx
call fcn.00536da7
add esp, 8
mov al, 1
jmp 0x458092
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x458090
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x458086
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4580d2
push edx
push ecx
call fcn.00536da7
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536b66
mov esp, ebp
pop ebp
ret
call fcn.00552841
push str.Cannot_read_tail
lea ecx, [ebp - 0x28]
call fcn.00447f40
push 0x5f2f74
lea eax, [ebp - 0x28]
push eax
call fcn.0054f86d
call fcn.00552841
call fcn.00552841
int3
Function at 0x45baf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b490
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x28], ecx
jb 0x45bb41
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x45bb61
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45bb50
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov esi, dword [ebx + 4]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x45bbe1
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x45bbe1
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x45bb96
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x45bba0
mov ecx, dword [edi]
cmp dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
jne 0x45bb81
push dword [edi + 0x10]
call fcn.00454330
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x45bb81
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00536b66
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.0044cca0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x45bc9c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x45bc51
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.0045bf60
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0045bec0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x45bbc3
push str.list_T__too_long
call fcn.00533fbe
int3
Function at 0x45bfe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x45c00d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x45c029
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x45c018
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x45c062
cmp eax, edi
jne 0x45c05a
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x45c06a
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x45c06a
cmp eax, edi
jne 0x45c06d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0044c140
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.00536b66
mov esp, ebp
pop ebp
ret 8
Function at 0x45c160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b530
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x20], ecx
jb 0x45c1b3
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x45c1d4
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45c1c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x18], eax
cmp dword [eax], esi
je 0x45c1f4
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
cmp esi, dword [eax]
je 0x45c272
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x45c20c
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x45c216
mov ecx, dword [edi]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
jne 0x45c1f7
push ebx
call fcn.00454330
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x18]
jne 0x45c1f7
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [eax + 8]
call fcn.0044c140
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00536b66
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x45c29f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.0045bf60
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0045bec0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x45c254
Function at 0x45c450
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0xffffffff
je 0x45c668
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x45c661
mov esi, dword [esp + 0x28]
mov eax, esi
or eax, dword [esp + 0x2c]
je 0x45c661
push esi
call fcn.0055a43a
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x45c661
push esi
push 0
push ebx
call fcn.0054ec00
add esp, 0xc
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push 0
push eax
push dword [esp + 0x30]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c661
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp dword [esp + 0x38], ecx
jne 0x45c661
mov eax, dword [esp + 0x2c]
cmp edx, eax
jne 0x45c661
mov dword [esp + 0x14], edx
mov edi, ebx
test eax, eax
jl 0x45c534
jg 0x45c527
cmp ecx, 2
jbe 0x45c534
mov eax, 0xfeff
cmp word [ebx], ax
jne 0x45c534
lea edi, [ebx + 2]
push 0x5e21ec
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
jne 0x45c56e
push eax
push 2
push dword [esp + 0x34]
mov dword [esp + 0x20], 1
push dword [esp + 0x34]
call fcn.00579af0
mov ecx, dword [esp + 0x18]
add eax, eax
sub eax, edi
add eax, ebx
jmp 0x45c572
mov eax, ecx
sub eax, edi
sar eax, 1
lea esi, [eax + eax]
test esi, esi
je 0x45c627
cmp esi, 0x4000
ja 0x45c627
lea ecx, [esi + 2]
call fcn.0045c420
mov ebx, eax
test ebx, ebx
je 0x45c634
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], esi
jae 0x45c5cd
nop dword [eax + eax]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov al, byte [edx + edi]
mov byte [ecx + ebx], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], esi
jb 0x45c5b0
shr esi, 1
xor eax, eax
cmp word [ebx + esi*2 - 2], 0xd
jne 0x45c5e0
mov word [ebx + esi*2 - 2], ax
jmp 0x45c5e4
mov word [ebx + esi*2], ax
push 0x10000
call fcn.00536d77
add esp, 4
mov dword [esp + 0x34], eax
lea ecx, [esi + 1]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x34]
push eax
call fcn.0045ca90
push ebx
call fcn.0055250a
add esp, 4
cmp dword [esp + 0x14], 0
jne 0x45c634
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edi, ecx
add edi, 2
test ecx, ecx
jne 0x45c534
push dword [esp + 0x1c]
call fcn.0055250a
add esp, 4
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00536b66
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00536b66
mov esp, ebp
pop ebp
ret
Function at 0x45cb80
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b56b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], 0
nop dword [eax]
nop dword [eax + eax]
push 0x248
push 8
push dword [0x5ffafc]
call edi
mov esi, eax
test esi, esi
je 0x45cbd0
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x240], eax
mov ebx, eax
nop dword [eax]
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x45cc34
cmp dword [ebp - 0x21c], 1
ja 0x45cd30
xor eax, eax
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov eax, esi
mov dword [ebp - 0x220], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45cc56
sub eax, edx
lea ecx, [ebp - 0x234]
sar eax, 1
push eax
push esi
call fcn.0044b740
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
mov edx, 3
cmovae ecx, dword [ebp - 0x234]
call fcn.0045dfa0
mov dword [ebp - 0x238], eax
mov byte [eax + 0x240], 1
mov eax, dword [ebp - 0x23c]
mov edi, dword [eax]
lea eax, [ebp - 0x238]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.0045cb60
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 4]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x45cd77
lea ecx, [edx + 1]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x23c]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x220]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45cd2a
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45cd20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45cd81
push edx
push ecx
call fcn.00536da7
add esp, 8
mov ebx, dword [ebp - 0x240]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x45cc00
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push esi
push 0
push dword [0x5ffafc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536b66
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.00533fbe
call fcn.00552841
int3
Function at 0x45dbb0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45dbf9
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00536b66
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0055a445
cdq
mov ecx, 3
idiv ecx
mov eax, 0xffff
sub eax, edx
add word [esp + 0xc], ax
call fcn.0055a445
cdq
mov ecx, 0xc
idiv ecx
inc edx
mov word [esp + 0xe], dx
call fcn.0055a445
cdq
mov ecx, 0x1c
idiv ecx
inc edx
mov word [esp + 0x12], dx
call fcn.0055a445
cdq
mov ecx, 0x18
idiv ecx
mov word [esp + 0x14], dx
call fcn.0055a445
cdq
mov esi, 0x3c
idiv esi
mov word [esp + 0x16], dx
call fcn.0055a445
cdq
idiv esi
mov word [esp + 0x18], dx
call fcn.0055a445
cdq
mov ecx, 0x3e8
idiv ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
mov word [esp + 0x1e], dx
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0xffffffff
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00536b66
mov esp, ebp
pop ebp
ret