joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ad94
Capabilities:
Get disk information
Write file on windows

Disassembly:
add byte [ebp + 0x662f74c0], al
cmp dword [eax], 0x2a
jne 0x45adc8
xor eax, eax
mov al, byte [ebp + 0x47]
and eax, 2
shr eax, 1
push eax
push ebx
call fcn.0044aadc
pop ecx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x80], eax
xor eax, eax
rol byte [eax + 0x4c13080d], 0
and byte [ecx - 0x3a], bl
inc ebp
invalid
invalid
test ebx, ebx
jge 0x45addc
cmp dword [ebp - 0x68], esi
jl 0x45addc
jg 0x45add8
cmp dword [ebp - 0x6c], esi
jbe 0x45addc
test eax, eax
je 0x45ae2a
push eax
xor eax, eax
mov al, byte [ebp + 0x47]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push ebx
call fcn.0045ef8f
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x68]
add esp, 0x1c
cmp eax, esi
je 0x45ae23
or byte [ebp + 0x68], 0x10
or byte [0x4c1308], 0x10
jmp 0x45ae2a
mov byte [0x4c1308], 0
cmp byte [ebp - 6], 0
jbe 0x45b083
cmp byte [ebp + 0x5e], 0
jne 0x45b083
xor esi, esi
cmp dword [ebp - 0x28], esi
jge 0x45ae54
mov eax, dword [ebp - 0xb4]
cmp word [eax], si
je 0x45b061
add byte [eax], al
mov eax, dword [ebp - 0x64]
cmp eax, esi
jle 0x45ae64
cmp eax, dword [ebp + 0x60]
je 0x45b061
cmp dword [ebp + 0x60], 4
jg 0x45b061
cmp byte [ebp + 0x19], 2
jl 0x45b061
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0xfc]
lea ecx, [ebp + 0x6c]
call fcn.0045f464
cmp dword [ebp + 0x6c], esi
je 0x45afad
push 0x800
push 1
push esi
push dword [ebp + 0x6c]
call fcn.0049c9c9
lea ecx, [ebp + 0x68]
call fcn.00495fc1
lea ecx, [ebp + 0x6c]
call fcn.0045cf13
push 0x4c1740
lea ecx, [ebp + 0x68]
call fcn.00496075
lea ecx, [ebp + 0x6c]
call fcn.0045cfc7
push 0x4c1740
call dword [0x4a64f4]
mov esi, edi
jmp 0x45e762
cmp byte [ebp + 0x17], 0x10
jne 0x45b096
test byte [ebp + 0x5d], 0x20
jne 0x45d5bc
or esi, 0xffffffff
xor ebx, ebx

Function at 0x45adbb
Capabilities:
Get disk information
Write file on windows

Disassembly:
and bh, bh
invalid
rol byte [eax + 0x4c13080d], 0
and byte [ecx - 0x3a], bl
inc ebp
push 0x7ddb8520
adc byte [ecx], bh
jne 0x45ad67

Function at 0x45aeaf
Capabilities:
Get disk information
Write file on windows

Disassembly:
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x14], eax
call fcn.00495931
jno 0x45ae68
add eax, dword [eax]
add esp, 0x18
cmp eax, esi
mov ebx, eax
jge 0x45aecb
mov ebx, esi
lea eax, [ebx + ebx*2]
push eax
lea ecx, [ebp + 0x1c]
mov dword [ebp], ebx
call fcn.00497f4a
mov eax, dword [ebp + 0x1c]
lea edi, [eax + ebx]
lea eax, [ebx - 1]
not eax
push 0
and edi, eax
lea eax, [ebp - 0x54]
push eax
push ebx
lea esi, [edi + ebx]
push esi
push dword [ebp + 0x6c]
call dword [0x4a64e8]
test eax, eax
Function at 0x45aebc
Capabilities:
Get disk information
Write file on windows

Disassembly:
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x14], eax
call fcn.00495931
jno 0x45ae68
add eax, dword [eax]
add esp, 0x18
cmp eax, esi
mov ebx, eax
jge 0x45aecb
mov ebx, esi
lea eax, [ebx + ebx*2]
push eax
lea ecx, [ebp + 0x1c]
mov dword [ebp], ebx
call fcn.00497f4a
mov eax, dword [ebp + 0x1c]
lea edi, [eax + ebx]
lea eax, [ebx - 1]
not eax
push 0
and edi, eax
lea eax, [ebp - 0x54]
push eax
push ebx
lea esi, [edi + ebx]
push esi
push dword [ebp + 0x6c]
call dword [0x4a64e8]
test eax, eax

Function at 0x45aefd
Capabilities:
Get disk information
Write file on windows

Disassembly:
jne 0x45af2e
call dword [0x4a6498]
mov esi, eax
test esi, esi
jne 0x45af0c
inc esi
lea ecx, [ebp + 0x1c]
call fcn.0049212a
lea ecx, [ebp + 0x68]
call fcn.00495f28
lea ecx, [ebp + 0x6c]
call fcn.0045ce7a
push 0x4c1740
jmp 0x45e612
push 0x200
push esi
push edi
call fcn.0046cbec
sbb al, 1
add bh, bh
dec ebp
pushfd
dec dword [ebp + 0x60]
mov ebx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x60]
shl eax, 4
shl ebx, 4
push 0x10
lea ecx, [ebx + edi + 0x1be]
mov dword [ebp + 0x28], eax
push ecx
lea eax, [eax + esi + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
xchg bh, bh
add dword [eax], eax
add byte [edx + 0x11cb2e8], ch
add byte [ebx - 0x7b72d7bb], cl
cmp byte [esi + 0x6a000001], bh
adc byte [eax - 0x73], dl
test byte [ebx], dh
mov esi, 0x50000001
call fcn.0046cc40
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.00493425
add esp, 0x34
test eax, eax
je 0x45afd0
lea ecx, [ebp + 0x1c]
call fcn.004921c3
push dword [ebp]
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x80], ebx
call 0x49842b
add esp, 0xc
test eax, eax
jne 0x45b015
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp]
invalid
push esi
call dword [0x4a64f4]

Function at 0x45af69
Capabilities:
Get disk information
Write file on windows

Disassembly:
jne 0x45af2e
call dword [0x4a6498]
mov esi, eax
test esi, esi
jne 0x45af0c
inc esi
lea ecx, [ebp + 0x1c]
call fcn.0049212a
lea ecx, [ebp + 0x68]
call fcn.00495f28
lea ecx, [ebp + 0x6c]
call fcn.0045ce7a
push 0x4c1740
jmp 0x45e612
push 0x200
push esi
push edi
call fcn.0046cbec
sbb al, 1
add bh, bh
dec ebp
pushfd
dec dword [ebp + 0x60]
mov ebx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x60]
shl eax, 4
shl ebx, 4
push 0x10
lea ecx, [ebx + edi + 0x1be]
mov dword [ebp + 0x28], eax
push ecx
lea eax, [eax + esi + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
xchg bh, bh
add dword [eax], eax
add byte [edx + 0x11cb2e8], ch
add byte [ebx - 0x7b72d7bb], cl
cmp byte [esi + 0x6a000001], bh
adc byte [eax - 0x73], dl
test byte [ebx], dh
mov esi, 0x50000001
call fcn.0046cc40
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.00493425
add esp, 0x34
test eax, eax
je 0x45afd0
lea ecx, [ebp + 0x1c]
call fcn.004921c3
push dword [ebp]
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x80], ebx
call 0x49842b
add esp, 0xc
test eax, eax
jne 0x45b015
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp]
invalid
push esi
call dword [0x4a64f4]
Function at 0x45afed
Capabilities:
Get disk information
Write file on windows

Disassembly:
jne 0x45af2e
call dword [0x4a6498]
mov esi, eax
test esi, esi
jne 0x45af0c
inc esi
lea ecx, [ebp + 0x1c]
call fcn.0049212a
lea ecx, [ebp + 0x68]
call fcn.00495f28
lea ecx, [ebp + 0x6c]
call fcn.0045ce7a
push 0x4c1740
jmp 0x45e612
push 0x200
push esi
push edi
call fcn.0046cbec
sbb al, 1
add bh, bh
dec ebp
pushfd
dec dword [ebp + 0x60]
mov ebx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x60]
shl eax, 4
shl ebx, 4
push 0x10
lea ecx, [ebx + edi + 0x1be]
mov dword [ebp + 0x28], eax
push ecx
lea eax, [eax + esi + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
xchg bh, bh
add dword [eax], eax
add byte [edx + 0x11cb2e8], ch
add byte [ebx - 0x7b72d7bb], cl
cmp byte [esi + 0x6a000001], bh
adc byte [eax - 0x73], dl
test byte [ebx], dh
mov esi, 0x50000001
call fcn.0046cc40
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.00493425
add esp, 0x34
test eax, eax
je 0x45afd0
lea ecx, [ebp + 0x1c]
call fcn.004921c3
push dword [ebp]
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x80], ebx
call 0x49842b
add esp, 0xc
test eax, eax
jne 0x45b015
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp]
invalid
push esi
call dword [0x4a64f4]
Function at 0x45b34d
Capabilities:
Get disk information
Write file on windows

Disassembly:
jge 0x45b38f
cmp dword [ebp + 0x4c], ebx
jg 0x45e13a
add byte [eax], al
jl 0x45b363
cmp dword [ebp + 0x48], ebx
jae 0x45e13a
cmp dword [ebp + 0x30], ebx
jg 0x45e13a
jl 0x45b377
cmp dword [ebp + 0x2c], ebx
jae 0x45e13a
cmp dword [ebp - 0x5c], ebx
jge 0x45e13a
mov dword [ebp - 0x5c], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
cmp byte [ebp + 0x67], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x150], ebx
dec dword [ecx - 0x14b63]
dec dword [ecx - 0xcb63]
dec dword [ecx - 0xc763]
dec dword [ecx - 0x19b4b]
dec dword [ecx - 0x1974b]
dec dword [ecx + 0x75899475]
cwde
mov dword [ebp + 0x1c], eax
jne 0x45b3d4
cmp byte [ebp + 0x1a], 0
jne 0x45b3d4
cmp eax, 4
jl 0x45ba08
cmp byte [ebp + 0x5e], 0
jne 0x45ba08
cmp byte [ebp + 0x5b], 0
jne 0x45ba08
cmp byte [ebp + 0x67], 0
je 0x45b3f5
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x5c], 5
je 0x45bd7a
cmp dword [ebp - 0x5c], 0xf
je 0x45bd7a
push 0x100000
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x3c], ebx
call fcn.00498489
lea eax, [ebp + 0x3c]
push eax
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.00496275
mov edx, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x67], 0
mov edi, eax
jne 0x45b45d
cmp edx, ecx
jge 0x45b442
cmp ecx, 4
jge 0x45b4a3
cmp byte [ebp + 0x67], 0
jne 0x45b45d
cmp byte [ebp + 0x1a], 0
jne 0x45b45d
lea eax, [ecx + 1]
cmp eax, 4
mov byte [ebp + 0x3b], 0
jg 0x45b48f
dec eax
jmp 0x45b496
cmp byte [ebp + 0x1a], 0
mov byte [ebp + 0x3b], 1
jne 0x45b4ab
cmp byte [ebp + 0x67], 0
je 0x45b4b0
cmp dword [ebp - 0x5c], ebx
jl 0x45b4a3
cmp word [ebp - 0xa4], bx
jle 0x45b487
mov dword [ebp - 0xa4], 0x80
jmp 0x45b4b0
mov dword [ebp - 0xa4], ebx
jmp 0x45b4b0
lea eax, [eax*4 - 0x10]
cmp eax, ebx
jle 0x45b4a3
cmp eax, edx
jl 0x45b4b0
cmp ecx, 4
jle 0x45b4b0
lea ecx, [ebp - 0x38]
jmp 0x45bd75
cmp edx, 4
jle 0x45b4a3
cmp edx, 4
jle 0x45b4c0
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0xc], eax
jmp 0x45b4c3
mov dword [ebp + 0xc], ebx
invalid
jge 0x45b501

Function at 0x45b39b
Capabilities:
Get disk information
Write file on windows

Disassembly:
dec dword [ecx - 0x14b63]
dec dword [ecx - 0xcb63]
dec dword [ecx - 0xc763]
dec dword [ecx - 0x19b4b]
dec dword [ecx - 0x1974b]
dec dword [ecx + 0x75899475]
cwde

Function at 0x45b4c6
Capabilities:
Get disk information
Write file on windows

Disassembly:
add byte [ecx + 0x75893475], cl
sbb al, 0x75
adc al, 0x83
stc
add al, 0x7c
or al, 0x8d
add al, 0x8d
invalid
Function at 0x45b50d
Capabilities:
Get disk information
Write file on windows

Disassembly:
mov cl, byte [eax]
cmp cl, 5
je 0x45b4f7
cmp cl, 0xf
jne 0x45b4fa
mov dword [ebp + 0x40], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x45b4eb
cmp byte [ebp + 0x3b], 0
je 0x45b510
cmp dword [ebp + 0x40], ebx
jl 0x45b4a3
mov eax, dword [ebp + 0x40]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x98], esi
push dword [esi + 8]
call 0x4ed792
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xd4], eax
push dword [esi + 0x10]
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
call 0x4ed7b8
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x1a], 0
mov dword [ebp - 0x1f0], edx
lea esi, [eax + edi + 0x30]
je 0x45b663
mov eax, dword [ebp + 0x3c]
xor esi, esi
cmp eax, 8
jne 0x45b593
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0xd0]
jmp 0x45b60a
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x45b5e9
cmp cl, 0xf
je 0x45b5e9
inc esi
add eax, 0x90
cmp esi, 4
jl 0x45b5a6
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call 0x4ed857
cmp dword [ebp + 0x3c], 4
jg 0x45b671
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0x34], eax
jmp 0x45b69c
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x45b682
cmp cl, 0xf
jne 0x45b685
mov dword [ebp + 0x34], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x45b676
cmp byte [ebp + 0x3b], 0
jne 0x45b69c
mov eax, dword [ebp + 0xc]
add dword [ebp + 0x34], eax
cmp dword [ebp + 0x34], 0
jge 0x45b6ac
cmp byte [ebp + 0x67], 0
je 0x45b5bd
cmp byte [ebp + 0x3b], 0
je 0x45b6b8
and dword [ebp + 0x1c], 0
jmp 0x45b6e2
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x45b6ca
test edx, edx
jne 0x45b6d7
cmp cl, 5
je 0x45b6d7
cmp cl, 0xf
je 0x45b6d7
mov dword [ebp + 0x1c], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x45b6c0
cmp byte [ebp + 0x3b], 0
jne 0x45b6f2
cmp dword [ebp + 0x1c], 0
jl 0x45b5bd
cmp byte [ebp + 0x67], 0
je 0x45b93b
mov eax, dword [ebp + 0xc]
test eax, eax
jg 0x45b706
mov eax, dword [ebp + 0x40]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0x10], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x230], eax
call 0x4ed989
cmp dword [ebp + 0x3c], 4
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], edx
invalid
invalid
int1
add byte [eax], al
Function at 0x45b5fb
Capabilities:
Get disk information
Write file on windows

Disassembly:
lea ecx, [ebp - 0x38]
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x45b5bd
and dword [ebp - 0x244], 0
xor eax, eax
add ecx, dword [ebp - 0xac]
lea edi, [ebp - 0x240]
adc edx, dword [ebp - 0xa8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.004a523a
and dword [ebp - 0x80], 0
add esp, 0x14
cmp byte [ebp + 0x5d], 0
jne 0x45b657
cmp byte [ebp + 0x5c], 0
jne 0x45b657
cmp byte [ebp + 0x27], 0
je 0x45e15e
and dword [ebp + 0x3c], 0
lea ecx, [ebp - 0x38]
jmp 0x45d5af
Function at 0x45c559
Capabilities:
Get disk information
Write file on windows

Disassembly:
push dword [ebp + 0x3c]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push ebx
push eax
call fcn.004974b8
add esp, 0x20

Function at 0x45d602
Capabilities:
Get disk information
Write file on windows

Disassembly:
jg 0x45d6b2
test byte [0x4c1308], 0x20
jne 0x45d623
test byte [ebp + 0x68], 0x20
jne 0x45d623
push 1
push dword [ebp - 0x48]
call 0x4a74f9
pop ecx
pop ecx
or byte [ebp + 0x68], 2
test byte [0x4c1308], 0x10
jne 0x45d64e
test byte [ebp + 0x68], 0x11
jne 0x45d64e
push edi
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push dword [ebp - 0x48]
call fcn.004617d6
add esp, 0x1c
or byte [ebp + 0x68], 1
or byte [ebp + 0x68], 1

Function at 0x45d864
Capabilities:
Write file on windows

Disassembly:
jl 0x45d89a
jg 0x45d870
cmp dword [ebp - 0x8c], ebx
jb 0x45d89a
cmp ebx, dword [ebp - 0x88]
jl 0x45d89a
jg 0x45d885
mov eax, dword [ebp + 0x40]
cmp eax, dword [ebp - 0x8c]
jbe 0x45d89a
mov eax, dword [ebp - 0x8c]
mov dword [ebp + 0x40], eax
jmp 0x45d89a

Function at 0x45d8a3
Capabilities:
Write file on windows

Disassembly:
cmp dword [ebp - 0x14], ebx
je fcn.0045da43

Function at 0x45d927
Capabilities:
Write file on windows

Disassembly:
jne 0x45d8e9
push dword [ebp + 0x6c]
call fcn.00495db8
add esp, 0x10

Function at 0x45d934
Capabilities:
Write file on windows

Disassembly:
cmp eax, dword [ebp - 0x40]
jne 0x45da1e
add byte [eax], al
invalid
cmp edx, dword [ebp - 0x3c]
jne 0x45da1e
push 0
lea eax, [ebp - 0x54]
push eax

Function at 0x45d93a
Capabilities:
Write file on windows

Disassembly:
cmp eax, dword [ebp - 0x40]
jne 0x45da1e
add byte [eax], al
invalid
cmp edx, dword [ebp - 0x3c]
jne 0x45da1e
push 0
lea eax, [ebp - 0x54]
push eax

Function at 0x45d93f
Capabilities:
Write file on windows

Disassembly:
cmp eax, dword [ebp - 0x40]
jne 0x45da1e
add byte [eax], al
invalid
cmp edx, dword [ebp - 0x3c]
jne 0x45da1e
push 0
lea eax, [ebp - 0x54]
push eax

Function at 0x45d94c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push dword [ebp + 0x6c]
call dword [0x4a64e8]
test eax, eax
je 0x45da1e
add byte [eax], al
push ebx
push esi
push edi
call fcn.0046f619
mov ecx, dword [ebp + 0x40]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x45d978
mov ecx, eax
push ecx
push dword [ebp - 0x14]
push esi
call fcn.0046f634
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x40]
add esp, 0xc
cmp eax, 0x200
jbe 0x45d9bb
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x200
add byte [edx], al
add byte [eax], al
push eax
lea eax, [esi + 0x200]
push eax
call fcn.0046f66a
add esp, 0xc
push ebx
push esi
push edi
call fcn.0049ae0f
add esp, 0xc
test eax, eax
jne 0x45da06
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.00495e60
add esp, 0x10
cmp eax, dword [ebp - 0x40]
jne 0x45da1e
lea ecx, [ebp - 0xc]
call fcn.00494c24
lea ecx, [ebp - 0x194]
call fcn.00494c2f
Function at 0x45d9a7
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push dword [ebp + 0x6c]
call dword [0x4a64e8]
test eax, eax
je 0x45da1e
add byte [eax], al
push ebx
push esi
push edi
call fcn.0046f619
mov ecx, dword [ebp + 0x40]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x45d978
mov ecx, eax
push ecx
push dword [ebp - 0x14]
push esi
call fcn.0046f634
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x40]
add esp, 0xc
cmp eax, 0x200
jbe 0x45d9bb
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x200
add byte [edx], al
add byte [eax], al
push eax
lea eax, [esi + 0x200]
push eax
call fcn.0046f66a
add esp, 0xc
push ebx
push esi
push edi
call fcn.0049ae0f
add esp, 0xc
test eax, eax
jne 0x45da06
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.00495e60
add esp, 0x10
cmp eax, dword [ebp - 0x40]
jne 0x45da1e
lea ecx, [ebp - 0xc]
call fcn.00494c24
lea ecx, [ebp - 0x194]
call fcn.00494c2f

Function at 0x45d9e1
Capabilities:
Write file on windows

Disassembly:
cmp edx, dword [ebp - 0x3c]
jne 0x45da1e
push 0
lea eax, [ebp - 0x54]
push eax
push ebx
push esi
push dword [ebp + 0x6c]
call dword [0x4a6194]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.004989c7
scasd eax, dword es:[edi]
add eax, dword [eax]
test esi, esi
call dword [0x4a6498]
mov esi, eax
test esi, esi
jne 0x45da2b
inc esi
lea ecx, [ebp - 0xc]
invalid

Function at 0x45eacc
Capabilities:
Get disk information

Disassembly:
add byte [esi - 0x75], ah
push es
mov edi, dword [ebp - 0x24]
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x18], 0xffffffff
push 4
mov word [edi + 8], ax
push esi
mov word [edi + 0xe], bx
push 0x4afab4

Function at 0x45eaeb
Capabilities:
Get disk information

Disassembly:
mov word [edi + 0xc], bx
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], 0x800
call fcn.00497075
add esp, 0xc
test al, al
jne 0x45ebb5
push 8
push esi
push str.Device_
call fcn.0049708d
add esp, 0xc
test al, al
jne 0x45ebb5
cmp byte [ebp - 3], bl
mov word [esi + 2], 0x3a
mov word [esi + 6], bx
mov word [esi + 4], bx
mov dword [ebp - 0x1c], edi
je 0x45eb5a
mov ax, word [esi]
cmp ax, 0x41
jb 0x45ebb5
cmp ax, 0x42
ja 0x45ebb5
push esi
call dword [0x4a61ec]
cmp eax, 2
clc
add dh, byte [ebp + 0x63]
movzx esi, word [esi]
sub esi, 0x41
jmp 0x45ebb8
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x45eb6d
push esi
call dword [0x4a61ec]
mov esi, eax
jmp 0x45eb70
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
jne 0x45eb8c
cmp byte [ebp - 2], bl
jne 0x45eb98
cmp esi, 2
je 0x45eb8c
cmp esi, 3
je 0x45eb8c
cmp esi, 5
jne 0x45eb98
push ebx
push edi
call 0x49da8e
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
or eax, 0xffffffff
cmp byte [ebp - 2], bl
jne 0x45eba3
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.00499a48
add byte [ebx + 0x9fe9f0], cl
add byte [eax], al
mov esi, dword [ebp + 8]
cmp esi, 1
mov dword [ebp + 8], ebx
mov edi, 0x80000000
Function at 0x45ff55
Capabilities:
Query or enumerate registry key

Disassembly:
add byte [ebp - 0x75], dl
in al, dx
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [0x4a609c]
mov ebx, eax
cmp ebx, esi
jne 0x46007e
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0043dd9c
cmp dword [ebp - 0x14], esi
in al, dx
mov dword [ebp - 0xc], esi
jle 0x460076
push edi
mov edi, dword [ebp - 0x18]

Function at 0x45ffe7
Capabilities:
Query or enumerate registry key

Disassembly:
xor byte [ebp - 0x6c1703b3], cl
pop eax
add al, 0

Function at 0x45fffe
Capabilities:
Query or enumerate registry key

Disassembly:
lea ecx, [ebp - 4]
call fcn.0049d1ec
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push 4
push dword [ebp - 4]
jne 0x46000f
call dword [0x4a60a8]
lea eax, [ebp - 8]
push eax
movzx eax, word [0x4c0bc8]

Function at 0x460011
Capabilities:
Query or enumerate registry key

Disassembly:
lea ecx, [ebp - 4]
call fcn.0049d1ec
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push 4
push dword [ebp - 4]
jne 0x46000f
call dword [0x4a60a8]
lea eax, [ebp - 8]
push eax
movzx eax, word [0x4c0bc8]

Function at 0x460024
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
or byte [esi - 0x77], ah
aaa
call dword [0x4a6094]
mov ebx, eax
cmp ebx, esi
jne 0x460066
cmp word [edi], si
je 0x460066
mov eax, dword [ebp + 0x10]
push dword [eax]
xor byte [ebp - 0x6c1703b3], cl
pop eax
add al, 0
push 0x4a754c
lea ecx, [ebp - 4]
cld
call fcn.0049d1e3
push edi
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [0x4a6090]
cmp dword [ebp - 8], esi
clc
mov ebx, eax
je 0x46005e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call 0x4bf39c
add eax, 0xcc48300
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46005e
push dword [ebp - 8]
call dword [0x4a6060]
lea ecx, [ebp - 4]
call fcn.0049727c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x45ffac
pop edi
lea ecx, [ebp - 0x18]
call fcn.00437e1a
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x460037
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
or byte [esi - 0x77], ah
aaa
call dword [0x4a6094]
mov ebx, eax
cmp ebx, esi
jne 0x460066
cmp word [edi], si
je 0x460066
mov eax, dword [ebp + 0x10]
push dword [eax]
xor byte [ebp - 0x6c1703b3], cl
pop eax
add al, 0
push 0x4a754c
lea ecx, [ebp - 4]
cld
call fcn.0049d1e3
push edi
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [0x4a6090]
cmp dword [ebp - 8], esi
clc
mov ebx, eax
je 0x46005e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call 0x4bf39c
add eax, 0xcc48300
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46005e
push dword [ebp - 8]
call dword [0x4a6060]
lea ecx, [ebp - 4]
call fcn.0049727c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x45ffac
pop edi
lea ecx, [ebp - 0x18]
call fcn.00437e1a
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x460049
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
or byte [esi - 0x77], ah
aaa
call dword [0x4a6094]
mov ebx, eax
cmp ebx, esi
jne 0x460066
cmp word [edi], si
je 0x460066
mov eax, dword [ebp + 0x10]
push dword [eax]
xor byte [ebp - 0x6c1703b3], cl
pop eax
add al, 0
push 0x4a754c
lea ecx, [ebp - 4]
cld
call fcn.0049d1e3
push edi
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [0x4a6090]
cmp dword [ebp - 8], esi
clc
mov ebx, eax
je 0x46005e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call 0x4bf39c
add eax, 0xcc48300
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46005e
push dword [ebp - 8]
call dword [0x4a6060]
lea ecx, [ebp - 4]
call fcn.0049727c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x45ffac
pop edi
lea ecx, [ebp - 0x18]
call fcn.00437e1a
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x46108d
Capabilities:
Write file on windows

Disassembly:
add esp, 0x10
push esi
mov byte [esi + 0x18], 0x3a
call dword [0x4a64cc]
dec edx
add byte [ebx - 0x73], dl
dec ebp
or al, 0x51
sub eax, edi
push eax
add edi, esi
push edi
push dword [0x4c0eb0]