joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41efaa
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push esi
push edi
push eax
xor esi, esi
push 0x28
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41f08d
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41f048
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
neg edi
sbb edi, edi
not edi
and edi, esi
jne 0x41f046
push eax
push ebx
push 0x406da8
call sub.msvcrt.dll_wprintf
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push 3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 0x40e49c
push dword [ebp - 0x1c]
call fcn.00430fdd
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push esi
push 3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push esi
call fcn.00430822
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 4

Function at 0x41ff1f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x208
xor ebx, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ff59
sub ecx, esi
sar ecx, 1
je 0x41fff0
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ff73
sub ecx, esi
sar ecx, 1
cmp ecx, 0x103
jae 0x41fff0
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41ff8f
push edx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
sub esi, ecx
push eax
sar esi, 1
call fcn.00410df0
test eax, eax
js 0x41fff0
cmp word [ebp + esi*2 - 0x20e], 0x5c
je 0x41ffd9
push 0x40e5b8
lea eax, [esi + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00412b90
test eax, eax
js 0x41fff0
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x41fff0
mov al, 1
jmp 0x41fff2
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 8
Function at 0x4200e8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x420119
xor eax, eax
jmp 0x4201f0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x420130
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420112
test bl, 1
je 0x42014b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x407670
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
jmp 0x420112
shr eax, 1
mov dword [ebp - 8], eax
add eax, eax
push edi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x42016f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4076d8
jmp 0x4201e2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x420192
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.msvcrt.dll_free]
jmp 0x4201e7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, dword [ebp - 4]
je 0x4201b7
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 4]
push ebx
push 0x407748
call sub.msvcrt.dll_wprintf
add esp, 0x10
jmp 0x4201e8
mov esi, dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 8]
and dword [esi], 0
mov ecx, esi
push edi
call fcn.004176dd
test eax, eax
je 0x4201ec
push edi
call dword [sym.imp.msvcrt.dll_free]
mov dword [esp], 0x4077e8
call sub.msvcrt.dll_wprintf
pop ecx
xor eax, eax
jmp 0x4201ef
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x420730
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [eax]
push edi
push ebx
push eax
mov esi, dword [ecx + 0x68]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42077c
push esi
call fcn.0042423d
push eax
push esi
push 0x407568
push 0x1db
push 0x406d58
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov ecx, 0x4373b0
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x420786
sub ecx, edx
sar ecx, 1
je 0x42081e
cmp dword [ebx], esi
jne 0x4207a3
mov edi, esi
jmp 0x4207ad
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push 0x4373b0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4207f0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [edi*2 + 2]
push ecx
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x420807
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4075e0
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
xor eax, eax
jmp 0x420821
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4373b0
push 0x407588
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x420c3a
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x43270e
call fcn.00430dc8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0042405d
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004176dd
push 2
push 0x40a20c
lea ecx, [ebp - 0x10]
call fcn.004176dd
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp + 0xc]
mov esi, 0x3e8
push ebx
push esi
push 0x40a214
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00421063
push ebx
push esi
push 0x40a21c
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00421063
push 2
push 0x40a224
lea ecx, [ebp - 0x10]
call fcn.004176dd
xor eax, eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
mov esi, 0x2710
mov ecx, edi
push esi
push 0x40a214
push dword [ebp - 0x10]
call fcn.00421063
push ebx
push esi
push 0x40a21c
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00421063
push 2
push 0x40a20c
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov esi, dword [ebp - 0x10]
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push 0x186a0
push 0x40a214
push esi
mov ecx, edi
call fcn.00421063
push ebx
push 0x186a0
push 0x40a21c
push esi
mov ecx, edi
call fcn.00421063
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x420d33
sub ecx, edx
push 0x63
sar ecx, 1
pop eax
mov word [esi + ecx*2 - 2], ax
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push 0xa
push 0x40a214
push esi
mov ecx, edi
call fcn.00421063
push ebx
push 0xa
push 0x40a21c
push esi
mov ecx, edi
call fcn.00421063
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00430d96
ret 8

Function at 0x420dd1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0x400
push edi
push 0x409704
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x420e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x420dfe
mov ecx, eax
jmp 0x420e07
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x409720
push ecx
call fcn.004241bf
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x420e19
push 9
pop ecx
mov esi, 0x409780
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
pop ebp
ret 4
Function at 0x421063
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x43275c
call fcn.00430dc8
mov edi, ecx
and dword [ebp - 0x10], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call fcn.0042405d
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004176dd
push 1
push 0x40e5b8
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0042405d
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.004176dd
cmp byte [ebp + 0x14], 0
je 0x421101
mov eax, dword [edi + 0x18]
cmp eax, dword [edi + 0x1c]
jne 0x421101
push 0x40e49c
xor ecx, ecx
add eax, 4
push 4
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00430fdd
mov ecx, dword [edi + 0x18]
mov esi, eax
shl ecx, 2
push ecx
push dword [edi + 0x14]
push esi
call sub.msvcrt.dll_memcpy
push dword [edi + 0x14]
call fcn.00430822
mov eax, dword [edi + 0x18]
add esp, 0x18
add eax, ebx
mov dword [edi + 0x14], esi
mov dword [edi + 0x1c], eax
mov ebx, dword [ebp + 0x10]
push 0x40e49c
push ebx
call fcn.00430fdd
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x421128
push 0x40a2d0
push 0x8007000e
call fcn.004241bf
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, edx
movzx eax, word [eax]
add eax, ebx
test ebx, ebx
je 0x421141
mov byte [ecx + esi], al
inc ecx
inc eax
cmp ecx, ebx
jb 0x421138
push edx
push edx
push 2
push edx
push 1
push 0xc0000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x421194
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 0x18], eax
call fcn.00430822
mov eax, dword [ebp - 0x18]
pop ecx
test eax, eax
jg 0x421179
mov ecx, eax
jmp 0x421182
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40a2f0
push ecx
call fcn.004241bf
mov eax, dword [ebp - 0x14]
add esp, 0xc
push 0
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4211ac
cmp dword [ebp - 0x1c], ebx
je 0x4211eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 0x18], eax
call fcn.00430822
mov ebx, dword [ebp - 0x14]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
jg 0x4211d1
mov ecx, eax
jmp 0x4211da
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40a338
push ecx
call fcn.004241bf
add esp, 0xc
jmp 0x4211ee
mov ebx, dword [ebp - 0x14]
push esi
call fcn.00430822
cmp byte [ebp + 0x14], 0
pop ecx
je 0x421209
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
mov dword [eax + ecx*4], ebx
inc dword [edi + 0x18]
jmp 0x421210
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00430d96
ret 0x10
Function at 0x421b5c
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
push edi
push eax
mov edi, ecx
call fcn.00420dd1
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [ebx]
xor eax, eax
push eax
push 3
push eax
mov ecx, dword [esi + 0x18]
push eax
mov eax, dword [edi + 0xc]
not eax
and eax, 1
inc eax
push eax
push ebx
call dword [0x4392d8]
call dword [esi + 0x18]
mov esi, eax
test esi, esi
je 0x421be0
push esi
call fcn.0042423d
push eax
push esi
push 0x4097a8
push 0x26f
push 0x407ed0
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
xor esi, esi
lea eax, [ebp - 0x804]
push esi
push 1
push 1
push 0x40986c
push 0x409878
push esi
push eax
push 0x409880
push ebx
mov ecx, edi
call fcn.00420e37
push esi
push 1
push esi
push 0x409884
push 0x407100
mov ecx, 0x409890
lea eax, [ebp - 0x804]
push ecx
push eax
push ecx
push ebx
mov ecx, edi
call fcn.00420e37
push esi
push 1
push 1
push 0x409894
push 0x4098a0
push esi
lea ecx, [ebp - 0x804]
push ecx
push 0x4098a8
push ebx
mov ecx, edi
call fcn.00420e37
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 4
Function at 0x4224b4
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x4328ae
call fcn.00430dc8
xor edi, edi
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0042405d
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004176dd
push 1
push 0x40e5b8
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0042405d
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov esi, dword [ebp - 0x10]
push edi
push edi
push 3
push edi
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xffffffff
jne 0x422541
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42252e
cmp eax, 3
jne 0x422541
push esi
push 0x40a380
push 0x8000ffff
call fcn.004241bf
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x422587
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
jg 0x42256c
mov ecx, eax
jmp 0x422575
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40a3b0
push ecx
call fcn.004241bf
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, dword [ebp + 0x10]
je 0x4225a6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x40a400
push 0x8000ffff
call fcn.004241bf
add esp, 0xc
push 0x40e49c
push dword [ebp + 0x10]
call fcn.00430fdd
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4225d5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40a2d0
push 0x8007000e
call fcn.004241bf
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422627
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 0x1c], eax
call fcn.00430822
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
test eax, eax
jg 0x42260f
mov ecx, eax
jmp 0x422618
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40a338
push ecx
call fcn.004241bf
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx]
add eax, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x14], eax
jbe 0x42266d
cmp byte [edi + ebx], al
je 0x422663
push ebx
call fcn.00430822
push esi
push 0x40a400
push 0x8000ffff
call fcn.004241bf
mov eax, dword [ebp - 0x14]
add esp, 0x10
inc edi
inc eax
mov dword [ebp - 0x14], eax
cmp edi, dword [ebp + 0x10]
jb 0x422642
push ebx
call fcn.00430822
pop ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00430d96
ret 0xc
Function at 0x423eac
Capabilities:
Create directory

Disassembly:
push 4
mov eax, 0x4329ab
call fcn.00430dc8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0042405d
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004176dd
push 5
push 0x40a22c
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov esi, 0x3e8
mov ecx, edi
push esi
push 0x40a214
push dword [ebp - 0x10]
call fcn.004224b4
push esi
push 0x40a21c
push dword [ebp - 0x10]
mov ecx, edi
call fcn.004224b4
push 2
push 0x40a224
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov esi, 0x2710
mov ecx, edi
push esi
push 0x40a214
push dword [ebp - 0x10]
call fcn.004224b4
push esi
push 0x40a21c
push dword [ebp - 0x10]
mov ecx, edi
call fcn.004224b4
push 2
push 0x40a20c
lea ecx, [ebp - 0x10]
call fcn.004176dd
mov esi, dword [ebp - 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, 0x186a0
mov ecx, edi
push ebx
push 0x40a214
push esi
call fcn.004224b4
push ebx
push 0x40a21c
push esi
mov ecx, edi
call fcn.004224b4
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x423f80
push 0x63
sub ecx, edx
pop eax
sar ecx, 1
push 0xa
push 0x40a214
push esi
mov word [esi + ecx*2 - 2], ax
mov ecx, edi
call fcn.004224b4
push 0xa
push 0x40a21c
push esi
mov ecx, edi
call fcn.004224b4
push 0x40a238
call sub.msvcrt.dll_wprintf
pop ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00430d96
ret 4

Function at 0x424141
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00414e9b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x20c]
push eax
push 0x40f828
call sub.msvcrt.dll_wprintf
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push 0x43555c
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x4241bf
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00414e9b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x20c]
push eax
push 0x40f828
call sub.msvcrt.dll_wprintf
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push 0x436ac0
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x424990
Capabilities:
Get disk information

Disassembly:
push 0x428
mov eax, 0x432aab
call fcn.00430dfb
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x434]
push ecx
push ebx
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
jne 0x424bc0
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x4249e0
push eax
push 0x40b090
call sub.msvcrt.dll_wprintf
mov eax, dword [ebp - 0x434]
pop ecx
pop ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0x424bb8
mov dword [ebp - 0x424], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], ecx
mov esi, dword [ebx]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 3
push eax
mov ecx, dword [esi + 0x34]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x424]
push eax
push edi
push ebx
call dword [0x4392d8]
call dword [esi + 0x34]
mov esi, eax
test esi, esi
jne 0x424ba4
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push dword [ebp - 0x430]
push dword [ebp - 0x424]
push 0x40b0c0
call sub.msvcrt.dll_wprintf
mov eax, dword [ebp - 0x424]
add esp, 0x14
mov esi, eax
test esi, esi
jne 0x424a76
xor ecx, ecx
jmp 0x424a85
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov eax, dword [ebp - 0x424]
cmp word [esi + ecx*2 - 2], 0x5c
je 0x424abb
push 0x40e5b8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push esi
lea ecx, [ebp - 0x424]
call fcn.004176dd
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x424]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x424aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x424ae9
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x424b7c
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x424b25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x424b23
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x424b90
lea eax, [ebp - 0x420]
push eax
push 0x40b110
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
push dword [ebp - 0x428]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x42c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x430]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x424]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc edi
cmp edi, dword [ebp - 0x434]
jae 0x424bb8
xor ecx, ecx
jmp 0x4249ec
push esi
call fcn.0042423d
push eax
push esi
push 0x402c68
push 0x11a
jmp 0x424bd2
push esi
call fcn.0042423d
push eax
push esi
push 0x402c68
push 0x11c
jmp 0x424bd2
push esi
call fcn.0042423d
push eax
push esi
push 0x406a38
push 0x10c
jmp 0x424bd2
call fcn.00430daa
ret 4
push esi
call fcn.0042423d
push eax
push esi
push 0x405868
push 0xfd
push 0x40b068
push 0x402cb8
push 1
call fcn.00424141
int3
Function at 0x424ce6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00414e9b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x40afb8
call sub.msvcrt.dll_wprintf
add esp, 0xc
cmp byte [0x438217], 0
jne 0x424d65
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00430d80
leave
ret
push 0x436ac0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
call sub.msvcrt.dll__CxxThrowException
int3