joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414240
Capabilities:
Get common file path

Disassembly:
sub esp, 0x408
mov eax, dword [0x5a2184]
xor eax, esp
mov dword [esp + 0x404], eax
lea eax, [esp + 4]
push eax
push 0x200
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00403380
mov ecx, dword [esp + 0x404]
xor ecx, esp
mov eax, esi
call fcn.00522672
add esp, 0x408
ret

Function at 0x415ca0
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [edi + 6]
add edx, 4
xor al, al
xor ecx, ecx
test edx, edx
jle 0x415ccc
push ebx
push esi
mov esi, dword [edi + 0x10]
movzx ebx, byte [esi + ecx]
movzx eax, al
xor ebx, eax
mov al, byte [ebx + 0x5a38a8]
add ecx, 1
cmp ecx, edx
jl 0x415cb4
pop esi
pop ebx
sub al, byte [edi + 0xc]
neg al
sbb eax, eax
and eax, 0x102
ret

Function at 0x415ce0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [edi + 0x10]
test edx, edx
je 0x415d20
push ebx
movzx ebx, word [edi + 6]
push esi
lea esi, [ebx + 4]
xor cl, cl
xor eax, eax
test esi, esi
jle 0x415d17
movzx esi, word [edi + 6]
add esi, 4
push ebp
movzx ebp, byte [edx + eax]
movzx ecx, cl
xor ebp, ecx
mov cl, byte [ebp + 0x5a38a8]
add eax, 1
cmp eax, esi
jl 0x415d00
pop ebp
mov byte [edi + 0xc], cl
pop esi
mov byte [ebx + edx + 4], cl
pop ebx
ret
Function at 0x41a580
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x5a2184]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41a5a7
xor al, al
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00522672
add esp, 0x10
ret
push esi
push edi
push eax
push 7
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0052af30
add esp, 0x10
xor edx, edx
mov edi, str.VAS6558
lea esi, [esp + 8]
mov ecx, 8
mov byte [esp + 0xf], 0
repe cmpsb byte [esi], byte es:[edi]
mov ecx, dword [esp + 0x14]
pop edi
sete al
pop esi
xor ecx, esp
call fcn.00522672
add esp, 0x10
ret

Function at 0x41a630
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x556b66
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5a2184]
xor eax, esp
mov dword [esp + 0x88], eax
push esi
mov eax, dword [0x5a2184]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
call fcn.00517e28
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41a68c
push 0x80004005
call fcn.00402db0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
test esi, esi
mov dword [esp + 0x9c], 0
jne 0x41a6b0
lea esi, [eax - 0x10]
jmp 0x41a714
push esi
push 0x80
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0052af30
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00411800
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xa0], 1
call fcn.00403130
mov byte [esp + 0x9c], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41a70d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 8]
add esi, 0xfffffff0
push esi
call fcn.00403060
add eax, 0x10
mov dword [esp + 0xa0], 0xffffffff
or edx, 0xffffffff
lea ecx, [esi + 0xc]
mov dword [edi], eax
add esp, 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a746
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00522672
add esp, 0x98
ret
Function at 0x41aa40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x408
test esi, esi
push ebx
push ebp
push edi
jne 0x41aa59
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x408
ret
lea edx, [esp + 0x10]
call fcn.004210b0
push 2
push 0
push esi
call fcn.0052aa48
push esi
call fcn.0052ac65
push 0
mov ebx, eax
push 0
push esi
sub ebx, 4
call fcn.0052aa48
add esp, 0x1c
or edi, 0xffffffff
test ebx, ebx
jle 0x41aaac
jmp 0x41aa90
push esi
call fcn.0052a88a
xor eax, edi
and eax, 0xff
shr edi, 8
xor edi, dword [esp + eax*4 + 0x14]
add esp, 4
sub ebx, 1
jne 0x41aa90
push esi
not edi
call fcn.0052a88a
push esi
movzx ebp, al
call fcn.0052a88a
xor ecx, ecx
mov ch, al
push esi
or ebp, ecx
call fcn.0052a88a
movzx edx, al
shl edx, 0x10
push esi
or ebp, edx
call fcn.0052a88a
movzx ebx, al
push 0
push 0
shl ebx, 0x18
push esi
or ebx, ebp
call fcn.0052aa48
add esp, 0x1c
xor eax, eax
cmp edi, ebx
pop edi
pop ebp
sete al
pop ebx
add esp, 0x408
ret
Function at 0x420e20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
push edi
lea edx, [esp + 0x10]
mov edi, ecx
call fcn.004210b0
or esi, 0xffffffff
cmp dword [ebp + 8], 0
je 0x420e9b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x420e9b
jle 0x420e7f
mov eax, dword [ebp + 8]
push eax
call fcn.0052a88a
mov edx, dword [edi]
mov edx, dword [edx + 0x38]
mov byte [esp + 0x13], al
xor eax, esi
and eax, 0xff
add esp, 4
shr esi, 8
xor esi, dword [esp + eax*4 + 0x10]
push 1
lea eax, [esp + 0x13]
push eax
mov ecx, edi
call edx
sub ebx, 1
jne 0x420e4c
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push 0
push 0
push 0
mov ecx, edi
call edx
mov eax, esi
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4210b0
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x4210c0
xor eax, 0xedb88320
test al, 1
je 0x4210cd
shr eax, 1
xor eax, 0xedb88320
jmp 0x4210cf
shr eax, 1
test al, 1
je 0x4210dc
shr eax, 1
xor eax, 0xedb88320
jmp 0x4210de
shr eax, 1
test al, 1
je 0x4210eb
shr eax, 1
xor eax, 0xedb88320
jmp 0x4210ed
shr eax, 1
test al, 1
je 0x4210fa
shr eax, 1
xor eax, 0xedb88320
jmp 0x4210fc
shr eax, 1
test al, 1
je 0x421109
shr eax, 1
xor eax, 0xedb88320
jmp 0x42110b
shr eax, 1
test al, 1
je 0x421118
shr eax, 1
xor eax, 0xedb88320
jmp 0x42111a
shr eax, 1
test al, 1
je 0x421127
shr eax, 1
xor eax, 0xedb88320
jmp 0x421129
shr eax, 1
mov dword [edx + ecx*4], eax
add ecx, 1
cmp ecx, 0x100
jl 0x4210b2
ret
Function at 0x45c6c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.00526010
push esi
push edi
lea edi, [ebp - 0x4014]
mov ecx, 0x1005
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5a51dc], 0x14
jl 0x45c743
mov eax, dword [ebp + 8]
push eax
push 0x2000
lea ecx, [ebp - 0x4008]
push ecx
call fcn.0045bb40
add esp, 0xc
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0
je 0x45c723
mov eax, dword [ebp - 0x4010]
jmp 0x45c79d
mov esi, esp
lea edx, [ebp - 0x4008]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x45c741
xor eax, eax
jmp 0x45c79d
jmp 0x45c75e
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x45c75e
xor eax, eax
jmp 0x45c79d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45c77d
mov dword [ebp - 0x4014], 0
jmp 0x45c797
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x4014], eax
mov eax, dword [ebp - 0x4014]
push edx
mov ecx, ebp
push eax
lea edx, [0x45c7d0]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522672
add esp, 0x4014
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 8
Function at 0x45c7f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8024
call fcn.00526010
push esi
push edi
lea edi, [ebp - 0x8024]
mov ecx, 0x2009
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5a51dc], 0x14
jl 0x45c8bb
mov eax, dword [ebp + 8]
push eax
push 0x2000
lea ecx, [ebp - 0x4008]
push ecx
call fcn.0045bb40
add esp, 0xc
mov dword [ebp - 0x8018], eax
cmp dword [ebp - 0x8018], 0
je 0x45c85a
mov eax, dword [ebp - 0x8018]
jmp 0x45c9c2
mov edx, dword [ebp + 0xc]
push edx
push 0x2000
lea eax, [ebp - 0x8010]
push eax
call fcn.0045bb40
add esp, 0xc
mov dword [ebp - 0x8018], eax
cmp dword [ebp - 0x8018], 0
je 0x45c88c
mov eax, dword [ebp - 0x8018]
jmp 0x45c9c2
mov esi, esp
push 3
lea ecx, [ebp - 0x8010]
push ecx
lea edx, [ebp - 0x4008]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x45c8b6
xor eax, eax
jmp 0x45c9c2
jmp 0x45c983
mov dword [ebp - 0x801c], 0xffffffff
mov esi, esp
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x801c], eax
cmp dword [ebp - 0x801c], 0xffffffff
je 0x45c964
mov esi, esp
mov ecx, dword [ebp - 0x801c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0052354c
mov esi, esp
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45c964
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45c942
mov dword [ebp - 0x8020], 0
jmp 0x45c95c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x8020], eax
mov eax, dword [ebp - 0x8020]
jmp 0x45c9c2
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x45c983
xor eax, eax
jmp 0x45c9c2
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45c9a2
mov dword [ebp - 0x8024], 0
jmp 0x45c9bc
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x8024], eax
mov eax, dword [ebp - 0x8024]
push edx
mov ecx, ebp
push eax
lea edx, [0x45c9f4]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522672
add esp, 0x8024
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45f3a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.00526010
push esi
push edi
lea edi, [ebp - 0x4018]
mov ecx, 0x1006
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5a51dc], 0x14
jl 0x45f469
mov eax, dword [ebp + 8]
push eax
push 0x2000
lea ecx, [ebp - 0x4008]
push ecx
call fcn.0045bb40
add esp, 0xc
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0
je 0x45f40a
mov eax, dword [ebp - 0x4010]
jmp 0x45f4c5
mov esi, esp
push 0
lea edx, [ebp - 0x4008]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45f467
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45f445
mov dword [ebp - 0x4014], 0
jmp 0x45f45f
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x4014], eax
mov eax, dword [ebp - 0x4014]
jmp 0x45f4c5
jmp 0x45f4c3
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45f4c3
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x45f4a1
mov dword [ebp - 0x4018], 0
jmp 0x45f4bb
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x4018], eax
mov eax, dword [ebp - 0x4018]
jmp 0x45f4c5
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x45f4f8]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522672
add esp, 0x4018
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ade70
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
push 8
mov eax, dword [ebp + 0x10]
push eax
call fcn.00497ff0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x4ade9b
mov eax, 0xc
jmp 0x4adf01
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp esi, esp
call fcn.0052354c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx + 4], 0xffffffff
je 0x4adecb
xor eax, eax
jmp 0x4adf01
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4adee7
mov dword [ebp - 4], 0
jmp 0x4adefe
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4adf20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp esi, esp
call fcn.0052354c
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4adf53
xor eax, eax
jmp 0x4adf89
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4adf6f
mov dword [ebp - 4], 0
jmp 0x4adf86
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 8

Function at 0x4adfa0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x4adfce
xor eax, eax
jmp 0x4ae004
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4adfea
mov dword [ebp - 4], 0
jmp 0x4ae001
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x2c]
test ecx, ecx
je 0x4b1018
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x44], 1
jne 0x4b1013
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3c], 0
je 0x4b1013
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xffffffff
jbe 0x4b0f4c
mov dword [ebp - 4], 0xffffffff
jmp 0x4b0f52
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov esi, esp
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b0fce
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b0f96
mov dword [ebp - 0x20], 0
jmp 0x4b0fad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp + 8]
add eax, dword [edx + 0x48]
mov edx, dword [edx + 0x4c]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x4c], edx
jmp 0x4b1003
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
add edx, dword [ecx + 0x48]
mov ecx, dword [ecx + 0x4c]
adc ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x1c], 0
ja 0x4b0f3d
cmp dword [ebp - 0x14], 0
jne 0x4b1013
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0
mov eax, dword [ebp - 0x14]
jmp 0x4b101a
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4b103c]
call fcn.0052356f
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1f80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00526010
push esi
push edi
lea edi, [ebp - 0x4010]
mov ecx, 0x1004
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5a51dc], 0x1e
jl 0x4b1ff5
mov eax, dword [ebp + 8]
push eax
push 0x2000
lea ecx, [ebp - 0x400c]
push ecx
call fcn.0045bb40
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b1fda
mov eax, dword [ebp - 8]
jmp 0x4b2020
mov esi, esp
lea edx, [ebp - 0x400c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 8], eax
jmp 0x4b200b
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2017
cmp dword [ebp - 8], 1
jne 0x4b201e
mov eax, 0x4e38
jmp 0x4b2020
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4b2050]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522672
add esp, 0x4010
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret
Function at 0x4b2550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6020
call fcn.00526010
push esi
push edi
lea edi, [ebp - 0x6020]
mov ecx, 0x1808
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5a51dc], 0x14
jl 0x4b2622
mov esi, esp
lea eax, [ebp - 0x6010]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b25eb
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b25c6
mov dword [ebp - 0x601c], 0
jmp 0x4b25e0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x601c], eax
mov eax, dword [ebp - 0x601c]
jmp 0x4b26de
lea ecx, [ebp - 0x6010]
push ecx
push 0x2000
lea edx, [ebp - 0x2008]
push edx
call fcn.0045bcf0
add esp, 0xc
mov dword [ebp - 0x6018], eax
cmp dword [ebp - 0x6018], 0
je 0x4b2620
mov eax, dword [ebp - 0x6018]
jmp 0x4b26de
jmp 0x4b2682
mov esi, esp
lea eax, [ebp - 0x2008]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b2682
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4b2660
mov dword [ebp - 0x6020], 0
jmp 0x4b267a
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp - 0x6020]
jmp 0x4b26de
mov ecx, dword [ebp + 0xc]
and ecx, 0x10
jne 0x4b26c7
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x2008]
mov dword [edx], eax
jmp 0x4b26a4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movsx eax, byte [edx]
test eax, eax
je 0x4b26c7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x4b26c5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov byte [edx], 0x2f
jmp 0x4b2697
lea eax, [ebp - 0x2008]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004991e0
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4b2710]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522672
add esp, 0x6020
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dba60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x4dbacf
mov esi, esp
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4dbacb
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4dbaaf
mov dword [ebp - 4], 0
jmp 0x4dbac6
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4dbad4
xor eax, eax
jmp 0x4dbad4
mov eax, 0x4e3b
pop esi
add esp, 4
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 8
Function at 0x4ddc60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ecx + 0x14], 0x10
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add eax, 0x14
mov esi, esp
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
add edx, 0x28
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp esi, esp
call fcn.0052354c
test eax, eax
jge 0x4ddce1
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4ddcc3
mov dword [ebp - 4], 0
jmp 0x4ddcda
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4ddd1b
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov esi, esp
mov ax, word [edx + 0x2a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
cmp esi, esp
call fcn.0052354c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov word [edx + 0xc], ax
xor eax, eax
pop esi
add esp, 4
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret