joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2590
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4c2633
test eax, eax
jbe 0x4c2633
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4c2633
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4c25de
xor esi, esi
jmp 0x4c25e4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4c260f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00458570
add esi, eax
push esi
mov ebx, esi
call fcn.00458570
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4c25f0
pop ebp
test edi, edi
pop edi
jne 0x4c2633
test ebx, ebx
je 0x4c2633
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.005134b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4c2775
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4c288d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c288d
mov eax, dword [esi + 0x3c]
push eax
call fcn.005260c9
mov esi, eax
test esi, esi
je 0x4c288d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4c288d
mov ecx, esi
call fcn.004c26e0
cmp edi, eax
jge 0x4c288d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4c2813
mov dword [esp + 0x34], 1
jmp 0x4c286e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4c288d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004c0f70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4cb6c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004cb4c0
pop edi
add esp, 0x104
ret 4
Function at 0x4d7b00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4d7b33
push esi
call fcn.004dc870
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4d7b2c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4d7bb9
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4d7ba2
mov eax, dword [esi + 8]
test eax, eax
je 0x4d7b57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4d7b9e
cmp eax, 2
je 0x4d7ba2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4d7b4a
cmp eax, 3
je 0x4d7b7d
cmp eax, 1
jne 0x4d7b4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4d7b4a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4d7b4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004d7bf0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4d7bd9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004d7bf0
add esp, 4
pop esi
ret

Function at 0x526a6d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x526aa5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00524ae8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00524ac0
jmp 0x526ab1
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x528268
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5282aa
call fcn.0052e7cf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5282aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5282a1
xor eax, eax
jmp 0x5282b2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005282b8
pop edi
pop esi
pop ebx
ret 4
Function at 0x52ecff
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x52ed2d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x52ed4b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0052ec65
jmp 0x52ed4b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52ed4b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0052ec65
test edi, edi
mov eax, edi
jne 0x52ed35
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403b26
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x403b3f
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x403b62
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x403b67
inc edi
cmp edi, dword [ebp - 4]
jb 0x403b59
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x403c5f
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x403bbe
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x403b92
cmp cl, 0xff
jne 0x403be9
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x403bf7
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x403bfe
dec ecx
shl edx, cl
and edx, 7
je 0x403b83
movzx ecx, byte [edx + 0x473424]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x47341c], 0
mov cl, byte [ebx + 4]
je 0x403be6
test cl, cl
je 0x403be6
cmp cl, 0xff
jne 0x403b83
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x403b54
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x403c32
movzx esi, byte [edx + 0x473424]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x403c1d
cmp al, 0xff
jne 0x403c2f
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x403bb0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x403b54
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x403e2c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0xc]
push ecx
movzx ecx, byte [esp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 4
push ecx
lea eax, [esi + 0x10]
push eax
push 0x403df6
push 0
push 0
mov dword [eax], esi
call fcn.0044d00a
add esp, 0x18
xor ecx, ecx
test eax, eax
mov dword [esi + 4], eax
setne cl
mov al, cl
pop esi
ret 8

Function at 0x403e6e
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x403e90
cmp byte [esi + 0x1c], 0
je 0x403e85
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
Function at 0x4076b9
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0xa4], eax
mov eax, dword [ebp + 0xb4]
push ebx
push esi
mov esi, dword [ebp + 0xb8]
push edi
mov edi, dword [ebp + 0xbc]
push 0x4736dc
push dword [ebp + 0xb0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], edi
call fcn.0044e41d
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
cmp eax, ebx
jne 0x407738
cmp esi, ebx
je 0x407731
lea eax, [ebp - 0x80]
push eax
call fcn.00406d03
pop ecx
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00406799
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064bb
xor al, al
jmp 0x407828
cmp edi, ebx
je 0x407743
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
jmp 0x407746
mov dword [ebp - 0x5c], ebx
push 9
xor eax, eax
pop ecx
mov word [ebp + 0x7c], ax
lea edi, [ebp + 0x7e]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x58]
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.0040643b
push 2
push ebx
push dword [ebp - 0x50]
call fcn.0044e2d2
push dword [ebp - 0x50]
call fcn.0044e1da
push ebx
push ebx
push dword [ebp - 0x50]
mov edi, eax
call fcn.0044e2d2
add esp, 0x1c
xor esi, esi
cmp edi, ebx
je 0x4077ea
push edi
call fcn.0044d3ae
push dword [ebp - 0x50]
mov ebx, eax
push 1
push edi
push ebx
call fcn.0044e020
push edi
push ebx
push esi
call fcn.00405cab
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044d3ae
push edi
push ebx
push eax
mov dword [ebp - 0x54], eax
call fcn.00405cab
mov ecx, dword [ebp - 0x58]
add esp, 0x30
push esi
push dword [ebp - 0x54]
call fcn.004069ab
push dword [ebp - 0x54]
call fcn.0044d5e4
push ebx
call fcn.0044d5e4
pop ecx
pop ecx
xor ebx, ebx
push esi
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x4c]
push 0x4736a4
push eax
call fcn.0044db76
mov ecx, dword [ebp - 0x60]
add esp, 0x14
cmp ecx, ebx
je 0x407811
lea eax, [ebp - 0x4c]
push eax
call fcn.00406a49
push dword [ebp - 0x50]
call fcn.0044dd04
mov eax, dword [ebp - 0x64]
pop ecx
cmp eax, ebx
je 0x407826
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp + 0xa4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0xa8
leave
ret
Function at 0x408358
Capabilities:
Copy file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x3c0]
sub esp, 0x440
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x3bc], eax
mov eax, dword [ebp + 0x3cc]
push ebx
mov ebx, dword [ebp + 0x3c8]
push esi
push edi
mov dword [ebp - 0x60], eax
xor eax, eax
mov esi, 0x20a
push esi
push eax
mov word [ebp + 0x1b0], ax
lea eax, [ebp + 0x1b2]
push eax
call fcn.0044d0c0
xor eax, eax
push esi
push eax
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x5a]
push eax
call fcn.0044d0c0
mov edi, 0x102
push edi
push ebx
lea esi, [edi + 2]
lea eax, [ebp + 0x1b0]
push esi
push eax
call fcn.0044e8de
push edi
push dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0044e8de
push 0x1e
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0044d0c0
and dword [ebp - 0x80], 0
lea eax, [ebp + 0x1b0]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x74], eax
mov eax, 0x614
mov word [ebp - 0x70], ax
add esp, 0x44
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], 4
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x408433
push dword [ebp - 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x408433
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408435
inc eax
jmp 0x408435
xor eax, eax
mov ecx, dword [ebp + 0x3bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x3c0
leave
ret

Function at 0x4095d7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor edi, edi
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0044d0c0
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.duowanyy4.0_
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00406c07
push eax
push esi
call fcn.00406c29
add esp, 0xc
push edi
push 1
lea ecx, [ebp - 0x228]
call fcn.004064bb
cmp dword [esi + 0x18], 8
jb 0x40965a
mov eax, dword [esi + 4]
jmp 0x40965d
lea eax, [esi + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044cad9
leave
ret
Function at 0x409675
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x473a68
push eax
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x74]
push eax
call fcn.00406c29
mov eax, dword [ebp - 0x70]
add esp, 0xc
cmp dword [ebp - 0x5c], 8
jae 0x4096af
lea eax, [ebp - 0x70]
push ebx
push edi
lea ecx, [ebp - 0x2c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 0x2cc], eax
cmp eax, 0xffffffff
je 0x4097e2
push esi
mov esi, 0x473a64
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x20]
call fcn.00406c07
push 0x473a60
lea ecx, [ebp - 0x20]
call fcn.0040632c
test eax, eax
je 0x4097b0
push 0x473a58
lea ecx, [ebp - 0x20]
call fcn.0040632c
test eax, eax
je 0x4097b0
test byte [ebp - 0x2c4], 0x10
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x2c8]
lea eax, [ebp - 0x2e8]
push eax
je 0x409771
call fcn.00406c29
add esp, 0xc
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c5e
add esp, 0xc
push ebx
push edi
lea ecx, [ebp - 0x2e8]
call fcn.004064bb
lea eax, [ebp - 0x3c]
push eax
call fcn.00409675
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
pop ecx
jae 0x409765
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x3c]
jmp 0x4097a9
call fcn.00406c29
add esp, 0xc
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00406c5e
add esp, 0xc
push ebx
push edi
lea ecx, [ebp - 0x2e8]
call fcn.004064bb
cmp dword [ebp - 0x40], 8
mov eax, dword [ebp - 0x54]
jae 0x40979f
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
push ebx
push edi
call fcn.004064bb
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.004064bb
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4096d9
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
push ebx
push edi
lea ecx, [ebp - 0x74]
call fcn.004064bb
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044cad9
leave
ret
Function at 0x4097fa
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x21]
push ecx
push 3
xor esi, esi
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00406a1f
xor eax, eax
cmp dword [ebp - 8], 8
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], esi
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
jae 0x409836
lea eax, [ebp - 0x1c]
push esi
push esi
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x409868
fldz
push esi
fstp qword [ebp - 0x2c]
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
fld qword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cad9
leave
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
and eax, 0x7fffffff
and dword [ebp - 0x30], 0x80000000
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
mov dword [ebp - 0x34], esi
fild qword [ebp - 0x34]
fchs
faddp st(1)
fmul qword [0x473a78]
jmp 0x409849
Function at 0x409bcf
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa0
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
cmp dword [eax + 0x18], 8
jb 0x409bf2
mov eax, dword [eax + 4]
jmp 0x409bf5
add eax, 4
push ebx
push esi
push edi
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0040991d
lea eax, [ebp + 0x1c]
push eax
call fcn.00408cef
add esp, 0xc
lea eax, [ebp - 1]
push eax
push 3
xor esi, esi
push esi
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x38]
call fcn.00406a1f
xor eax, eax
cmp dword [ebp + 0x50], 8
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x3c]
jae 0x409c38
lea eax, [ebp + 0x3c]
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x409c8c
cmp dword [ebp - 0xc], esi
ja 0x409c56
cmp dword [ebp - 0x10], esi
jbe 0x409c8c
lea eax, [ebp - 1]
push eax
push 0xffffffffffffffff
push 3
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00406a1f
lea eax, [ebp + 0x54]
push eax
call fcn.00408cef
lea eax, [ebp + 0x54]
push eax
call fcn.00408beb
pop ecx
pop ecx
lea ecx, [ebp + 0x54]
test al, al
je 0x409cb4
push esi
push ebx
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp + 0x38]
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004064bb
xor al, al
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x74
leave
ret
push ebx
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0x5c
call fcn.0040869e
mov edi, eax
jmp 0x409d39
lea eax, [ebp - 1]
push eax
push edi
push esi
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp]
call fcn.00406a1f
lea eax, [ebp]
push eax
call fcn.00408cef
pop ecx
cmp dword [ebp + 0x14], esi
je 0x409d63
lea eax, [ebp - 1]
push eax
push 0xffffffffffffffff
inc edi
push edi
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406a1f
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00406799
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004064bb
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp + 0x54]
mov dword [ebp - 8], 0x5c
call fcn.0040869e
push esi
push ebx
lea ecx, [ebp]
mov edi, eax
call fcn.004064bb
cmp edi, 0xffffffff
jne 0x409cca
push esi
push ebx
lea ecx, [ebp + 0x54]
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp + 0x38]
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004064bb
mov al, bl
jmp 0x409ca2
push esi
push ebx
lea ecx, [ebp]
call fcn.004064bb
lea ecx, [ebp + 0x54]
jmp 0x409c85
Function at 0x40bc4c
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x483058
push dword [esi]
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00406c29
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x40bc81
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40bcda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40bcda
push str..old
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c29
mov ecx, dword [ebp - 0x38]
add esp, 0xc
cmp dword [ebp - 0x24], 8
jae 0x40bcb8
lea ecx, [ebp - 0x38]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x40bcc4
lea eax, [ebp - 0x1c]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.004064bb
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
add esi, 4
cmp esi, 0x4831f4
jl 0x40bc66
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cad9
leave
ret

Function at 0x40c27f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push ecx
mov eax, esp
mov ecx, esi
mov dword [eax], str.VersionInfo
call fcn.004065a1
test al, al
je 0x40c337
push str.yyPath
push dword [esi + 0x3c]
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004075c0
lea eax, [ebp - 0x3c]
push eax
push 0x473a64
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.00406c29
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00406c5e
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.004064bb
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x40c303
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c31a
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x20]
push eax
call fcn.0040c225
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.004064bb
jmp 0x40c29d
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0044cad9
leave
ret

Function at 0x412ab8
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.0980E678_72D2_484b_B983_D4E17598D5B7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x412ae6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x412ae6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret