joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55cc68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x55cc9b
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x55cc94
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405a90
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 4]
mov edx, dword [0x40110c]
call fcn.00406514
xor eax, eax
push ebp
push 0x55ce2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x55cdf4
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 8]
push 0x55ce54
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.004059a4
mov eax, dword [ebp - 0x158]
call fcn.00405aa0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x55cde8
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x55cdcd
test al, 2
jne 0x55cdcd
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x55ce54
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405880
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004059a4
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.005553f8
test eax, 0x80000000
setne al
test al, al
je 0x55cd8b
or edi, 0xffffffff
jmp 0x55cd9a
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00555594
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0055535c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405880
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x55cd1d
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x55cce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ce33
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.00405634
lea eax, [ebp - 8]
call fcn.00405610
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x40110c]
call fcn.004063d4
ret

Function at 0x55e014
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55e096
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x700f0037
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0055e11c
mov eax, dword [ebp - 4]
call fcn.0055bd40
test al, al
je 0x55e067
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x55e067
and dword [ebp - 8], 0xfffbffff
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x410]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55e09d
lea eax, [ebp - 4]
call fcn.00405610
ret
Function at 0x55e0bc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x14], 0
jne 0x55e107
push 0x208
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.0055dff0
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x55e107
lea eax, [esp + 0xc]
call fcn.0040b674
mov ecx, eax
lea edx, [esp + 0xc]
lea eax, [ebx + 0x14]
call fcn.00405700
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00405664
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x561c44
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a90
xor eax, eax
push ebp
push 0x561ca3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x561c7b
dec eax
jne 0x561c8d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov si, 0xff9c
call fcn.004048a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561caa
lea eax, [ebp - 4]
call fcn.00405610
ret

Function at 0x561cb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x561d5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x410], 0
jne 0x561cfe
push 0x465
mov eax, dword [ebp - 4]
call fcn.0045e79c
mov ecx, eax
mov dl, 1
mov eax, dword [0x55e2b4]
call fcn.0055e320
mov edx, dword [ebp - 4]
mov dword [edx + 0x410], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.0055e7e8
lea eax, [ebp - 8]
mov edx, 0x561d74
call fcn.004056a8
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x561d49
test bl, 1
je 0x561d42
lea eax, [ebp - 8]
call fcn.00405b00
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.00561c44
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x561d26
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561d66
lea eax, [ebp - 8]
call fcn.00405610
ret
Function at 0x562900
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405a90
xor eax, eax
push ebp
push 0x562a1e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5629f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5629ce
test byte [ebp - 0x14c], 0x10
jne 0x5629b1
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00405880
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.0040a120
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x562974
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x5629da
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5629f8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x567848
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
movzx eax, byte [ebx + 4]
sub al, 1
jb 0x567857
je 0x56785c
jmp 0x567880
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x56787b
lea eax, [ebx + 8]
push eax
movzx eax, byte [ebx + 0xc]
push eax
mov eax, dword [0x639cd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x56fa08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042f9d4
cmp ebx, dword [ebp - 8]
jge 0x56fa6b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042fe4c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042fe4c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042fe78
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x56fa31
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x56fa74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042f9d4
cmp ebx, dword [ebp - 8]
jge 0x56fad7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042fe4c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042fe4c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042fe78
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x56fa9d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x570de8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x570e94
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 1
call fcn.00405d30
push 0
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
mov eax, esi
call fcn.00405aa0
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405d30
push ebx
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
jle 0x570e74
mov eax, dword [ebp - 4]
call fcn.00405aa0
call fcn.0040b674
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405d30
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405664
jmp 0x570e7e
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570e9b
lea eax, [ebp - 4]
call fcn.00405610
ret

Function at 0x572984
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x572a3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405aa0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x5729c6
call fcn.0040500c
jmp 0x572a42
mov eax, ebx
call fcn.00402fa8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405aa0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x5729ef
call fcn.0040500c
jmp 0x572a42
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x572a50
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x572a10
call fcn.0040500c
jmp 0x572a42
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572a42
mov eax, dword [ebp - 8]
call fcn.00402fc4
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x572c9c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x572d04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b9c
test ebx, ebx
jne 0x572cd9
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572d10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x572d1c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x572d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b9c
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00405aa0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572d8a
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5730c8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x573274
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x57326c
xor eax, eax
push ebp
push 0x573265
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x573280
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x573140
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x573280
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x573181
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00429b70
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00429b70
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00429b70
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00429b70
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x638240], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57326c
cmp dword [ebp - 4], 0
je 0x573264
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x573284
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.00572978
test al, al
je 0x5732b1
cmp dword [0x64218c], 0x40047
jl 0x5732b1
cmp byte [0x638240], 0
jne 0x5732b1
call fcn.005730c8
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x638244]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x573314
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x573309
mov word [esp], 0
mov eax, dword [esi*4 + 0x638244]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x579670
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
test ebx, ebx
je 0x579704
mov edx, dword [0x576578]
mov eax, 8
call fcn.00406800
mov esi, eax
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405664
mov byte [esi + 4], 0
mov edx, esi
mov eax, ebx
call fcn.004bfa00
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.004bfbb0
mov eax, dword [edi + 0x3f4]
cmp eax, dword [ebp + 8]
jne 0x5796d4
mov edx, dword [edi + 0x3f0]
mov eax, ebx
call fcn.004bfc0c
jmp 0x579704
push 0x4003
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
call fcn.00405aa0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x160]
mov eax, ebx
call fcn.004bfc0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5886c8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5886d0
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x58881d
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x588726
lea edx, [ebp - 4]
mov eax, dword [0x639754]
call fcn.00407a10
cmp ebx, 1
jbe 0x58875d
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x588834
call fcn.0040c140
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004058dc
jmp 0x58875d
lea eax, [ebp - 4]
mov edx, 0x588844
call fcn.004056a8
cmp ebx, 1
jbe 0x58875d
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x588854
call fcn.0040c140
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004058dc
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.00405928
mov eax, dword [ebp - 0x18]
call fcn.00405aa0
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x5887e5
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x588795
mov bl, 1
jmp 0x5887f5
push 0
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040e83c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x639dc4]
call fcn.00407a10
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.005740b0
mov eax, dword [ebp - 0x1c]
movzx ecx, word [0x588858]
xor edx, edx
call fcn.00446fac
mov bl, 2
jmp 0x5887f5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00405664
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588824
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405634
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405634
ret

Function at 0x588e98
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x588eba
mov edx, ebx
mov eax, dword [0x639dc0]
call fcn.00407a10
jmp 0x588ef1
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x588eea
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.00405880
jmp 0x588ef1
mov eax, ebx
call fcn.00405610
add esp, 0x160
pop esi
pop ebx
ret
Function at 0x589914
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x589947
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x589940
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405a90
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 4]
mov edx, dword [0x40110c]
call fcn.00406514
xor eax, eax
push ebp
push 0x589ad5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x589a9d
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 8]
push 0x589afc
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.004059a4
mov eax, dword [ebp - 0x158]
call fcn.00405aa0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x589a91
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x589a76
test al, 2
jne 0x589a76
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x589afc
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405880
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004059a4
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.00572b00
call fcn.004117d4
test al, al
je 0x589a34
or edi, 0xffffffff
jmp 0x589a43
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00572c9c
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.00572a64
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405880
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x5899c9
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x58998c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x589adc
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.00405634
lea eax, [ebp - 8]
call fcn.00405610
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x40110c]
call fcn.004063d4
ret
Function at 0x58ac3c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58acd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x700f0037
mov eax, dword [0x63a008]
cmp dword [eax + 4], 0x60000
jl 0x58ac74
or dword [ebp - 8], 0x400000
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0058adb8
mov eax, dword [ebp - 4]
call fcn.00588a4c
test al, al
je 0x58aca4
mov eax, dword [ebp - 4]
call fcn.00405aa0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x58aca4
and dword [ebp - 8], 0xfffbffff
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x468]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58acda
lea eax, [ebp - 4]
call fcn.00405610
ret

Function at 0x58e8a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00405aa0
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
je 0x58e8e2
dec eax
je 0x58e8c3
sub eax, 2
je 0x58e8e2
jmp 0x58e8f3
movzx eax, byte [ebx]
call fcn.005746a8
test al, al
je 0x58e8f3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.004048a8
jmp 0x58e8f3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.004048a8
pop esi
pop ebx
pop ebp
ret

Function at 0x58e8f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58e9a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x428], 0
jne 0x58e946
push 0x465
mov eax, dword [ebp - 4]
call fcn.0045e79c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58af54]
call fcn.0058afc0
mov edx, dword [ebp - 4]
mov dword [edx + 0x428], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
call fcn.0058b488
lea eax, [ebp - 8]
mov edx, 0x58e9bc
call fcn.004056a8
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x58e991
test bl, 1
je 0x58e98a
lea eax, [ebp - 8]
call fcn.00405b00
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.0058e8a0
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x58e96e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e9ae
lea eax, [ebp - 8]
call fcn.00405610
ret