joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cae9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x4cafee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4cafee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.004caff8
test eax, eax
je 0x4cafee
add ebx, 0x28
dec ecx
jne 0x4cafc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x4cb09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4cb0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x4cb12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4cb0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x4cb12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x4cb105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x4cb12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x4cb123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x4cb12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x4cb16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x4cb172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4cb1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4cb1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x4cbdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.004cbf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.004cbf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.004cbeec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004cbf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004cbecb
push ecx
push dword [ebp + 8]
call fcn.004cbf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004cbf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004cbecb
push ecx
push dword [ebp + 8]
call fcn.004cbf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004cbf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004cbecb
push ecx
push dword [ebp + 8]
call fcn.004cbf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004cbf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004cbecb
cmp ecx, 0x2b
jne 0x4cbe0f
leave
ret 0xc

Function at 0x4cd4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x4cd544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x63130
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4cd5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x63130
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x63130
call fcn.004cd3fa
push 0x63130
push dword [ebp + 0xc]
call fcn.004cb1a8
test eax, eax
jne 0x4cd5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x63130
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004cd5dd
test eax, eax
je 0x4cd5d6
jmp 0x4cd574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4cd5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x4cd60b
Capabilities:
Terminate process

Disassembly:
call fcn.004cd618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x406010
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417040]
jne 0x40601a
repz ret
jmp fcn.00407a56

Function at 0x40ddde
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040983c
and dword [ebp - 4], 0
cmp dword [0x418e78], 0
mov ebx, eax
jne 0x40de8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40df40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40df40
push eax
call fcn.004097ca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418e78], eax
call esi
push eax
call fcn.004097ca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418e7c], eax
call esi
push eax
call fcn.004097ca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x418e80], eax
call esi
push eax
call fcn.004097ca
pop ecx
mov dword [0x418e88], eax
test eax, eax
je 0x40de8f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004097ca
pop ecx
mov dword [0x418e84], eax
mov eax, dword [0x418e84]
cmp eax, ebx
je 0x40dee7
cmp dword [0x418e88], ebx
je 0x40dee7
push eax
call fcn.00409845
push dword [0x418e88]
mov esi, eax
call fcn.00409845
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40dee7
test edi, edi
je 0x40dee7
call esi
test eax, eax
je 0x40dede
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40dede
test byte [ebp - 0xc], 1
jne 0x40dee7
or dword [ebp + 0x10], 0x200000
jmp 0x40df20
mov eax, dword [0x418e7c]
cmp eax, ebx
je 0x40df20
push eax
call fcn.00409845
pop ecx
test eax, eax
je 0x40df20
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40df20
mov eax, dword [0x418e80]
cmp eax, ebx
je 0x40df20
push eax
call fcn.00409845
pop ecx
test eax, eax
je 0x40df20
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418e78]
call fcn.00409845
pop ecx
test eax, eax
je 0x40df40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40df42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x54fd0c91
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x53f65d60
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x426172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4261a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4261a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x426dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00426f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00426f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00426eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00426f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00426ecb
push ecx
push dword [ebp + 8]
call fcn.00426f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00426f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00426ecb
push ecx
push dword [ebp + 8]
call fcn.00426f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00426f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00426ecb
push ecx
push dword [ebp + 8]
call fcn.00426f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00426f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00426ecb
cmp ecx, 0x2b
jne 0x426e0f
leave
ret 0xc

Function at 0x4284b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x428544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0xfc10
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4285d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0xfc10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0xfc10
call fcn.004283fa
push 0xfc10
push dword [ebp + 0xc]
call fcn.004261a8
test eax, eax
jne 0x4285b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0xfc10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004285dd
test eax, eax
je 0x4285d6
jmp 0x428574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4285d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x414c1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], cl
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040488c
xor eax, eax
push ebp
push 0x414d46
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004043cc
lea eax, [ebp - 0x10]
call fcn.004043cc
mov dl, 1
mov eax, dword [0x406b54]
call fcn.00407d08
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dl, 1
call fcn.00414d54
xor eax, eax
push ebp
push 0x414d19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x414cef
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.00407d6c
mov eax, dword [ebp - 0x18]
call fcn.0040489c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 7
ja 0x414cbe
and eax, 0x7f
bt dword [ebp - 9], eax
jae 0x414ce7
mov eax, dword [ebp - 0x18]
call fcn.00414f88
test al, al
je 0x414ce7
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00414b7c
pop ecx
test al, al
je 0x414ce7
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00404464
jmp 0x414cef
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x414c97
cmp dword [ebp - 0x10], 0
je 0x414d03
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004046e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414d20
mov eax, dword [ebp - 0x1c]
call fcn.00403674
ret

Function at 0x414d54
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x414e4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407eb8
mov eax, pe_nt_image_headers32
call fcn.00402a38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x414e28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x414e12
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x414e0a
cmp byte [ebp - 5], 0
je 0x414de6
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 2
jb 0x414dfe
add al, 0xe2
sub al, 2
jb 0x414dfe
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004045d4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407df4
jmp 0x414dfe
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.004045d4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407df4
mov eax, dword [ebp - 0x10]
call fcn.0040afec
inc eax
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x414db5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414e2f
mov eax, dword [ebp - 0xc]
call fcn.00402a68
ret
Function at 0x414e58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
xor edx, edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040488c
xor eax, eax
push ebp
push 0x414f60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov edx, dword [0x424e80]
mov edx, dword [edx]
call fcn.004047e8
je 0x414f32
lea eax, [ebp - 0x220]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048f4
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0xc]
mov ecx, 0x414f78
call fcn.004046e8
mov eax, dword [ebp - 0xc]
call fcn.0040489c
mov dword [ebp - 0x10], eax
push 0xff
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x224]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.0040464c
mov eax, dword [ebp - 0x224]
mov edx, 0x414f84
call fcn.0040b664
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414f67
lea eax, [ebp - 0x224]
mov edx, 2
call fcn.004043f0
lea eax, [ebp - 0xc]
call fcn.004043cc
lea eax, [ebp - 4]
call fcn.004043cc
ret

Function at 0x414f88
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040488c
xor eax, eax
push ebp
push 0x415011
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0040469c
dec eax
jne 0x414fc9
lea eax, [ebp - 4]
mov edx, 0x415028
call fcn.004046a4
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040489c
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415018
lea eax, [ebp - 4]
call fcn.004043cc
ret
Function at 0x4150e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x415208
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.004043cc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
call fcn.004043cc
mov al, byte [0x415214]
mov byte [ebp - 0x21], al
mov dl, 1
mov eax, dword [0x406b54]
call fcn.00407d08
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
mov dl, 1
call fcn.00414d54
xor eax, eax
push ebp
push 0x4151e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x4151bc
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
call fcn.00407d6c
mov eax, dword [ebp - 0x20]
call fcn.00414e58
test al, al
jne 0x4151b4
mov eax, dword [ebp - 0x20]
call fcn.0040489c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 7
ja 0x415198
and eax, 0x7f
bt dword [ebp - 0x21], eax
jae 0x4151b4
mov eax, dword [ebp - 0x20]
call fcn.00414f88
test al, al
je 0x4151b4
push ebp
mov eax, dword [ebp - 0x20]
call fcn.0041502c
pop ecx
test al, al
jne 0x4151bc
inc dword [ebp - 0x1c]
dec dword [ebp - 0x2c]
jne 0x415165
cmp dword [ebp - 4], 0
je 0x4151cd
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4151ea
mov eax, dword [ebp - 0x28]
call fcn.00403674
ret

Function at 0x415308
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040488c
xor eax, eax
push ebp
push 0x415377
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040489c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
jne 0x415355
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x415361
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41537e
lea eax, [ebp - 4]
call fcn.004043cc
ret
Function at 0x4157c4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040488c
xor eax, eax
push ebp
push 0x4158e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.0040b214
test al, al
je 0x415833
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040b758
push dword [ebp - 0x14]
push 0x4158fc
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004149dc
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040475c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b2ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp word [eax + 0x1a], 0
je 0x41585d
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x41590c
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
jmp 0x4158b5
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00415dc0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0x41590c
call fcn.004046e8
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040b758
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.00414818
mov eax, dword [ebp - 0xc]
call fcn.0040b214
test al, al
je 0x4158b5
push 0
mov eax, dword [ebp - 4]
call fcn.0040489c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040489c
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 4]
call fcn.0040b214
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4158ea
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004043f0
lea eax, [ebp - 4]
call fcn.004043cc
ret
Function at 0x415ea8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4161ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004043cc
mov eax, dword [ebp - 0xc]
call fcn.004043cc
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402d3c
cmp dword [ebp - 0x14], 0
je 0x415f3f
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov dl, byte [edx]
call fcn.004045b4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov ecx, 0x416208
call fcn.004046e8
mov eax, dword [ebp - 0x14]
call fcn.0040489c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x415f3f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00404420
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x415f80
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov dl, byte [0x41620c]
mov eax, 0x416218
call fcn.00414c1c
cmp dword [ebp - 0x14], 0
je 0x415f80
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dl, byte [edx]
call fcn.004045b4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, 0x416208
call fcn.004046e8
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4161c6
mov dl, 1
mov eax, dword [0x412d1c]
call fcn.00413190
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x415fe4
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0x24]
call fcn.00414198
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00404420
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
setne byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415feb
mov eax, dword [ebp - 0x24]
call fcn.00403674
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4161f5
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.004043f0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004043f0
ret