joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b320
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x554058
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call fcn.0051bc53
mov edi, eax
mov eax, dword [esp + 0x38]
or ebx, 0xffffffff
push ebx
push eax
lea ecx, [esp + 0x20]
call fcn.0049eff0
mov dword [esp + 0x18], vtable.cWCStr.0
xor ebp, ebp
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebp
call fcn.0049eaa0
cmp ax, 0x5c
je 0x43b396
push 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x5c
call fcn.0049eeb0
push ebx
push str.BCWipeSeedTest.tmp
lea ecx, [esp + 0x20]
call fcn.0049eeb0
mov edx, dword [esp + 0x1c]
push ebp
push 0x6000000
push 2
push ebp
push 3
push 0xc0000000
push edx
call fcn.004b5ff0
mov esi, eax
add esp, 0x1c
cmp esi, ebx
je 0x43b452
mov ecx, dword [esp + 0x3c]
push ebp
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x48]
push ebp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43b452
cmp dword [esp + 0x14], ebp
jne 0x43b452
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.0051bc53
sub eax, edi
cdq
push esi
mov edi, eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov edx, 0x3e8
mul edx
push ebx
push edi
push edx
push eax
call fcn.0051c9f0
lea ecx, [esp + 0x18]
mov esi, eax
mov edi, edx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x18], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], vtable.cWCS.0
call fcn.0049ee80
mov edx, ebx
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x43b820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x554146
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
cmp ebx, 4
jl 0x43b865
mov eax, 0x5736e8
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
test byte [0x5b76a0], 1
mov esi, vtable.cWCStr.0
jne 0x43b8ab
or dword [0x5b76a0], 1
push 0xffffffffffffffff
push 0
mov ecx, 0x5b7690
mov dword [esp + 0x2c], 0
call fcn.0049eff0
push 0x569ef0
mov dword [0x5b7690], esi
call fcn.005194de
add esp, 4
mov dword [esp + 0x24], 0xffffffff
mov ecx, 0x5b7690
call fcn.0049e900
test al, al
je 0x43b8d2
mov eax, dword [0x5b9f28]
push 1
push 1
push 0x13b
push eax
mov ecx, 0x5b7690
call fcn.004b5af0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
call fcn.0049eff0
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x30]
mov edx, dword [0x5b7694]
push 1
push ecx
push 1
push ebx
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 1
call fcn.0049f540
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.004ae920
add esp, 0x10
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x43c340
Capabilities:
Clear file content
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5542b1
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x18]
and eax, 0x80000
xor ecx, ecx
xor ebx, ebx
or eax, ecx
jne 0x43c559
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x28]
call fcn.0049eff0
mov dword [esp + 0x20], vtable.cWCStr.0
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
lea eax, [esp + 0x38]
push eax
mov ecx, esi
mov dword [esp + 0x18c], ebx
call fcn.0042bef0
push eax
call fcn.004b5ff0
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x43c3e5
mov dword [esp + 0x20], vtable.cWCS.0
jmp 0x43c545
lea ecx, [esp + 0x1c]
push ecx
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
sete cl
mov dword [esp + 0x18], ebp
mov byte [esp + 0x17], cl
cmp cl, bl
jne 0x43c42f
mov ecx, dword [esp + 0x1c]
mov edx, ebp
or edx, ecx
je 0x43c42f
cmp eax, ebx
je 0x43c444
mov edx, 0x400
mul edx
cmp ecx, edx
jb 0x43c444
ja 0x43c42f
cmp ebp, eax
jbe 0x43c444
mov eax, dword [esi + 0x18]
and eax, 0x20000000
xor ecx, ecx
or eax, ecx
jne 0x43c444
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x5b0da8], bl
jne 0x43c471
cmp byte [esp + 0x17], bl
jne 0x43c471
cmp dword [esp + 0x1c], ebx
ja 0x43c3d8
cmp dword [esp + 0x18], 0x400
ja 0x43c3d8
push 0x104
lea ecx, [esp + 0x34]
call fcn.0049f020
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push ebx
mov byte [esp + 0x17c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [esp + 0x34]
push ebx
push ebx
push edx
call fcn.004b30d0
mov edi, eax
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [str.STARTED]
push 0xffffffffffffffff
push ebx
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x50]
call fcn.00402f20
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
mov byte [esp + 0x184], 2
call fcn.0043ae00
push eax
mov eax, dword [esp + 0x4c]
lea ecx, [eax + edi*2]
push ecx
push str.Action:_Module__s_v._s_tStatus:__s_tOS:_pl__x__mj__x__mn__x__bn__x
push esi
call fcn.0042f3c0
mov esi, vtable.cWCS.0
add esp, 0x24
lea ecx, [esp + 0x40]
mov byte [esp + 0x170], 1
mov dword [esp + 0x40], esi
call fcn.0049ee80
lea ecx, [esp + 0x30]
mov byte [0x5b0da8], bl
mov byte [esp + 0x170], bl
mov dword [esp + 0x30], esi
call fcn.0049ee80
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x170], 0xffffffff
call fcn.0049ee80
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0051916c
add esp, 0x160
ret 4
Function at 0x43f9f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5546b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], 0xbc00
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x10]
mov dword [esi], vtable.cMode.0
push 2
push ebx
mov dword [esp + 0x20], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov byte [ecx + 8], 1
call fcn.0043f1f0
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x43fc90
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x554768
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
push 0
lea eax, [esi + 0x38]
mov dword [esp + 0x1c], ecx
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.cLockBlock.0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 0
call fcn.004162f0
test al, al
jne 0x43fd06
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.004162f0
test al, al
je 0x43fcf1
mov edx, dword [esi]
mov eax, dword [esp + 0x30]
mov edx, dword [edx + 0x24]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call edx
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00416230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x43ff00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55483b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi], vtable.cSharedPointer.0
mov dword [esi + 8], ebx
mov dword [esi + 4], 0xbc00
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00414f00
lea ecx, [esi + 0x88]
mov byte [esp + 0x1c], 1
call fcn.004164a0
mov dword [esi], vtable.cTaskSet.0
mov dword [esi + 0x100], 0xffffffff
mov dword [esi + 0x104], 0xffffffff
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov byte [esi + 0x110], 1
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
push 0x56ba1c
push 1
lea ecx, [esi + 0x138]
mov byte [esp + 0x24], 4
call fcn.0043ced0
lea ecx, [esi + 0x1e8]
mov byte [esp + 0x1c], 5
call fcn.00439a50
mov eax, dword [esp + 0x24]
push eax
mov ecx, esi
mov dword [esi + 0x1c0], esi
mov byte [esi + 0x65c], bl
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x660], ebx
mov dword [esi + 0x658], ebx
call fcn.0043d680
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
lea edi, [esi + 0x130]
mov byte [esi + 0x134], bl
mov dword [esi + 0x640], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], 0xffffffff
mov dword [esi + 0xd8], ecx
mov dword [esi + 0xdc], edx
mov dword [edi], ebx
cmp eax, ebx
jne 0x440044
push ebx
call fcn.004915f0
add esp, 4
cmp eax, ebx
je 0x440050
push 0xffffffffffffffff
push eax
push edi
call fcn.004ae9d0
add esp, 0xc
invalid
mov byte [esi + 0x125], bl
mov byte [esi + 0x124], 1
mov dword [esi + 0x644], ebx
mov dword [esi + 0x648], ebx
mov dword [esi + 0x64c], ebx
mov dword [esi + 0x650], ebx
mov dword [esi + 0x654], 1
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x441a90
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [esp + 0x18]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x441ab4
pop esi
xor al, al
pop ebx
pop ecx
ret
push edi
push 0
push 0
push 3
push 0
push 4
push SysReAllocString
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x441ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
push ebp
push edi
push 0
push 1
push 0
push 0
push 0x40000000
push ebx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441b0d
push edi
xor bl, bl
call ebp
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x441b47
cmp ebx, dword [esp + 0x10]
jne 0x441b47
push esi
mov bl, 1
call ebp
push edi
call ebp
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
pop ecx
ret
push esi
xor bl, bl
call ebp
push edi
call ebp
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x441b60
Capabilities:
Delete file
Get file size
Move file
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x554cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 4
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x441bc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x441bee
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push esi
call fcn.00518c06
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x441bd1
push ebx
lea ecx, [esp + 0x18]
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441bd1
cmp esi, dword [esp + 0x14]
jne 0x441bd1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x5b0e8c]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x24], ebx
push esi
push ebp
lea ebx, [esp + 0x2c]
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], esi
call fcn.00441a00
mov bl, al
xor eax, eax
add esp, 0x14
cmp bl, al
je 0x441cef
cmp dword [esp + 0x18], 1
jne 0x441c6a
xor bl, bl
jmp 0x441d0c
mov ecx, dword [esp + 0x48]
add dword [ecx], esi
mov esi, dword [esp + 0x4c]
adc dword [ecx + 4], eax
cmp esi, eax
je 0x441d0c
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0x627470
push 0xc
push 0x5b0ea0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], eax
call fcn.00421320
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
sub edx, eax
push edx
add eax, ebp
push eax
lea ecx, [esp + 0x2c]
call fcn.00421320
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push esi
push eax
push ecx
push edx
call fcn.00441a90
add esp, 0x10
lea ecx, [esp + 0x24]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
call fcn.00420ae0
jmp 0x441d0c
mov esi, dword [esp + 0x4c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x44]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x441d0c
mov bl, 1
push ebp
call fcn.00519d85
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4455c0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x555326
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24c]
mov ebp, ecx
push 0x69
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
call fcn.0049f020
mov dword [esp + 0x14], vtable.cWCStr.0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push ecx
xor edi, edi
push edx
mov dword [esp + 0x24c], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x44565b
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], 0xffffffff
mov dword [esp + 0x14], vtable.cWCS.0
call fcn.0049ee80
xor al, al
jmp 0x445706
push 1
mov byte [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x18]
mov byte [esp + 0x244], 1
cmp word [esi], di
je 0x4456d8
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
movzx eax, word [esi]
sub eax, 0x41
cmp eax, 2
jl 0x4456cf
push esi
call ebx
cmp eax, 4
je 0x4456cf
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push esi
push edx
call fcn.004301a0
add esp, 0xc
test al, al
je 0x4456cf
lea eax, [esp + 0x30]
push eax
call fcn.004ba280
add esp, 4
test eax, eax
je 0x4456cf
push 0
lea ecx, [esp + 0x34]
push ecx
push 0
mov ecx, ebp
call fcn.00445480
inc edi
add esi, 8
cmp word [esi], 0
jne 0x445683
mov edx, dword [esp + 0x2c]
test edi, edi
push edx
setne bl
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], 0xffffffff
mov dword [esp + 0x14], vtable.cWCS.0
call fcn.0049ee80
mov al, bl
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0051916c
add esp, 0x234
ret 4
Function at 0x4467c0
Capabilities:
Get disk information

Disassembly:
cmp byte [eax + 1], 0x3a
je 0x4467c9
mov al, 1
ret
movsx eax, byte [eax]
push esi
push eax
call fcn.0051cf10
push 0x41
mov esi, eax
call fcn.0051cf10
add esp, 8
sub esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, esi
mov edx, 1
shl edx, cl
pop esi
and eax, edx
neg eax
sbb eax, eax
neg eax
ret

Function at 0x446f20
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x446fac
push 0x104
mov ecx, esi
call fcn.0049f100
mov eax, dword [esi + 0xc]
mov ecx, dword [0x574058]
mov dx, word [0x57405c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov ax, word [edi]
lea ecx, [esp + 8]
mov word [esp + 0x10], dx
mov edx, dword [esi + 4]
push ecx
mov word [esp + 0x10], ax
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004b9290
add esp, 0xc
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.0049f100
test edi, edi
pop edi
sete al
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0051916c
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0051916c
add esp, 0x10
ret

Function at 0x446fd0
Capabilities:
Get disk information

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov eax, ecx
and eax, 4
xor edx, edx
or eax, edx
mov byte [esp + 0xc], 1
jne 0x446fe9
mov byte [esp + 0xc], dl
mov eax, ecx
and eax, 8
xor edx, edx
or eax, edx
mov byte [esp + 2], 1
jne 0x446ffd
mov byte [esp + 2], dl
mov eax, ecx
and eax, 0x20
xor edx, edx
or eax, edx
mov byte [esp + 3], 1
jne 0x447011
mov byte [esp + 3], dl
and ecx, 1
xor eax, eax
or ecx, eax
push ebx
push esi
je 0x447020
mov bl, 1
jmp 0x447022
xor bl, bl
mov esi, dword [esp + 0x10]
xor eax, eax
cmp word [esi], 0x41
sete al
movzx ecx, ax
push ecx
call fcn.00519e45
add esp, 4
test ax, ax
jne 0x44706d
xor edx, edx
cmp word [esi], 0x42
sete dl
movzx eax, dx
push eax
call fcn.00519e45
add esp, 4
test ax, ax
jne 0x44706d
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x447073
cmp byte [esp + 0x14], 0
jne 0x447084
pop esi
xor al, al
pop ebx
pop ecx
ret
cmp eax, 5
je 0x44706d
cmp eax, 4
jne 0x447084
cmp byte [esp + 0xa], 0
je 0x44706d
push esi
call fcn.00430560
add esp, 4
test al, al
je 0x44709e
cmp byte [esp + 0xb], 0
jne 0x4470a2
pop esi
xor al, al
pop ebx
pop ecx
ret
test bl, bl
je 0x44706d
pop esi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x447630
Capabilities:
Get disk information

Disassembly:
sub esp, 0x420
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
mov ebx, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, dword [esp + 0x434]
push 0x104
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x104
lea ecx, [esp + 0x30]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push edi
push esi
test eax, eax
jne 0x4476b3
call fcn.00446f20
add esp, 8
test al, al
jne 0x4476cd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0051916c
add esp, 0x420
ret
call fcn.00446f20
add esp, 8
test al, al
jne 0x4476cd
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00406a80
cmp byte [esp + 0x43c], 0
je 0x4476fb
mov eax, dword [esi + 4]
push str.Reserved
push 0
push eax
mov ecx, esi
call fcn.0049f6e0
mov ecx, dword [esi + 4]
push 0x571580
push 0
push ecx
mov ecx, esi
call fcn.0049f6e0
mov ecx, esi
call fcn.0049e900
test al, al
je 0x447714
push 0xffffffffffffffff
push str.Local_Disk
mov ecx, esi
call fcn.00406a80
test ebx, ebx
je 0x44771e
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0051916c
add esp, 0x420
ret
Function at 0x447860
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x55566e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x48]
mov esi, ecx
cmp ebp, 4
jae 0x4478ac
xor al, al
jmp 0x447a14
mov dword [esp + 0x18], 0
test edi, edi
jne 0x4478bc
lea edi, [esp + 0x18]
push edi
push ebp
push ebx
call fcn.004abbd0
shr eax, 0x1a
mov dword [esi + 0x210], eax
xor ecx, ecx
and eax, 0x10
add esp, 0xc
or eax, ecx
mov dword [esi + 0x214], ecx
je 0x4478e3
mov al, 1
jmp 0x4478e5
xor al, al
cmp ebp, 4
jne 0x4479b3
test al, al
je 0x4479b3
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
and ebx, 0xfffffffc
je 0x447a12
mov ebp, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov byte [esp + 0x20], 1
call ebp
mov dword [esp + 0x20], eax
xor edi, edi
mov dword [esp + 0x38], edi
mov eax, 1
mov ecx, edi
shl eax, cl
test ebx, eax
je 0x4479a0
mov ecx, dword [0x56f41c]
mov edx, dword [0x56f420]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x214]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x210]
lea eax, [edi + 0x41]
push ecx
mov word [esp + 0x28], ax
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00446fd0
add esp, 0xc
test al, al
je 0x4479a0
push 0x250
call fcn.0051a2f5
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x38], 1
test eax, eax
je 0x447991
lea ecx, [esp + 0x24]
push ecx
push esi
mov ecx, eax
call fcn.004474c0
jmp 0x447993
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x3c], 0
call fcn.0045a460
inc edi
cmp edi, 0x1a
jl 0x447920
mov edx, dword [esp + 0x20]
push edx
call ebp
jmp 0x447a12
cmp ebp, dword [edi]
jle 0x447a12
push edi
push ebp
push ebx
call fcn.004abe70
push 0x250
mov dword [esp + 0x24], eax
call fcn.0051a2f5
add esp, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], 2
test eax, eax
je 0x4479ef
mov ecx, dword [esp + 0x14]
push ecx
push esi
mov ecx, eax
call fcn.004474c0
jmp 0x4479f1
xor eax, eax
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0xffffffff
call fcn.0045a460
lea edx, [esp + 0x14]
push edx
call fcn.004ae600
add esp, 4
cmp ebp, dword [edi]
jg 0x4479b7
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0051916c
add esp, 0x28
ret 0xc