joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad9e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x18], 0
je 0x4ad9fb
mov eax, esi
call fcn.004adabc
mov eax, dword [esi + 4]
mov dword [esi + 0x18], eax
test bl, bl
je 0x4ada24
mov eax, dword [esi + 4]
cmp word [eax], 0x25ff
jne 0x4ada24
add dword [esi + 0x18], 2
jno 0x4ada1a
call fcn.0040213c
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0x18]
jno 0x4ada31
call fcn.0040213c
sub eax, 5
jno 0x4ada3b
call fcn.0040213c
mov byte [esi + 0xc], 0xe9
mov edx, eax
and edx, 0xff
mov byte [esi + 0xd], dl
mov edx, eax
shr edx, 8
and edx, 0xff
mov byte [esi + 0xe], dl
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov byte [esi + 0xf], dl
shr eax, 0x18
and eax, 0xff
mov byte [esi + 0x10], al
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x11], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 1]
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 2]
mov byte [esi + 0x13], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 3]
mov byte [esi + 0x14], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 4]
mov byte [esi + 0x15], al
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov eax, dword [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4adab7
call fcn.0040eb28
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4adb88
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4adba6
add esp, 0xfffffff0
call fcn.004025a8
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004035f4
xor eax, eax
push ebp
push 0x4add82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403614
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
mov dword [esi + 0x20], edi
cmp edi, 0xffffffff
jne 0x4adc0e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4addb4
call fcn.00403498
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4aa6ac]
call fcn.0040d474
call fcn.00402a08
push 0
push 0
push 0
push 2
push 0
mov eax, dword [esi + 0x20]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [esi + 0x24], edi
test edi, edi
jne 0x4adc4e
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4addd0
call fcn.00403498
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4aa6ac]
call fcn.0040d474
call fcn.00402a08
push 0
push 0
push 0
push 4
mov eax, dword [esi + 0x24]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [esi + 0x28], edi
test edi, edi
jne 0x4adca1
push 0x4addfc
push dword [ebp - 4]
push 0x4ade18
lea eax, [ebp - 0x14]
call fcn.004ab5f8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040350c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4aa6ac]
call fcn.0040d474
call fcn.00402a08
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x28]
mov dword [esi + 0x2c], eax
mov byte [esi + 4], 0
mov edx, dword [esi + 0x2c]
xor ecx, ecx
mov eax, esi
call fcn.004adb64
cmp eax, 0x950412de
je 0x4adcec
cmp eax, 0xde120495
je 0x4adcec
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x4ade38
call fcn.00403498
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x4aa6ac]
call fcn.0040d474
call fcn.00402a08
cmp eax, 0xde120495
sete al
mov byte [esi + 4], al
mov edx, dword [esi + 0x2c]
mov ecx, 4
mov eax, esi
call fcn.004adb64
mov edx, dword [esi + 0x2c]
mov ecx, 8
mov eax, esi
call fcn.004adb64
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c]
mov ecx, 0xc
mov eax, esi
call fcn.004adb64
mov dword [esi + 0x10], eax
mov edx, dword [esi + 0x2c]
mov ecx, 0x10
mov eax, esi
call fcn.004adb64
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
test eax, eax
jns 0x4add48
call fcn.00402134
mov dword [esi + 0x18], 1
test eax, eax
je 0x4add5c
shr eax, 1
shl dword [esi + 0x18], 1
test eax, eax
jne 0x4add53
shr dword [esi + 0x18], 1
mov eax, dword [esi + 0x18]
shr eax, 1
mov dword [esi + 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4add89
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040317c
ret
Function at 0x4ae698
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
test al, al
je 0x4ae6df
push 0
mov eax, dword [0x4d6700]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x4d6700]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x4d6700]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
pop ebx
pop ebp
ret
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
mov eax, dword [0x4d6700]
mov eax, dword [eax]
call fcn.0047d0ec
push 0xffffffffffffffec
mov eax, dword [0x4d6700]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x40000
push eax
push 0xffffffffffffffec
mov eax, dword [0x4d6700]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
push ebx
call sub.user32.dll_SetForegroundWindow
pop ebx
pop ebp
ret
Function at 0x4ae728
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ae875
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00403614
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ae85f
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00403614
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4ae856
cmp dword [ebp - 4], 7
jne 0x4ae856
mov eax, dword [ebp - 8]
call fcn.004014d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ae84f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
jmp 0x4ae817
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x4ae834
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00403398
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA
inc eax
add ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA
inc eax
add dword [ebp - 0x10], eax
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4ae830
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4ae7e0
jmp 0x4ae834
pop edx
pop eax
jg 0x4ae7e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae856
mov eax, dword [ebp - 0xc]
call fcn.004014f0
xor eax, eax
mov dword [ebp - 0x10], eax
ret
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae87c
lea eax, [ebp - 0x18]
call fcn.00403114
ret
Function at 0x4ae8ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aea38
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4aea07
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ae92e
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.00403444
add eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x4ae907
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [0x4ae888]
call fcn.0040482c
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ae9c5
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00403444
mov esi, eax
test esi, esi
jle 0x4ae9ad
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], al
inc ebx
inc dword [ebp - 0x18]
dec esi
jne 0x4ae988
mov eax, dword [ebp - 0x1c]
mov byte [eax + ebx], 0
inc ebx
mov eax, dword [ebp - 0x1c]
mov byte [eax + ebx], 0
inc ebx
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x4ae965
mov eax, dword [ebp - 0x1c]
mov byte [eax + ebx], 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.00403614
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
push 0
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [0x4ae888]
call fcn.0040482c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea3f
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040317c
lea eax, [ebp - 0x20]
call fcn.00403114
lea eax, [ebp - 0x1c]
mov edx, dword [0x4ae888]
call fcn.00404838
ret
Function at 0x4aea48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aeb90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00403614
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4aeb7a
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00403614
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4aeb7a
cmp dword [ebp - 4], 7
jne 0x4aeb7a
mov eax, dword [ebp - 8]
call fcn.004014d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4aeb73
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
jmp 0x4aeb3b
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x4aeb58
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00403398
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA
add eax, 2
add ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA
add eax, 2
add dword [ebp - 0x10], eax
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4aeb54
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4aeb00
jmp 0x4aeb58
pop edx
pop eax
jg 0x4aeb00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aeb7a
mov eax, dword [ebp - 0xc]
call fcn.004014f0
xor eax, eax
mov dword [ebp - 0x10], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aeb97
lea eax, [ebp - 0x18]
call fcn.00403114
ret
Function at 0x4aeba0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035f4
mov eax, dword [ebp - 8]
call fcn.004035f4
xor eax, eax
push ebp
push 0x4aede8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 1
xor ebx, ebx
xor eax, eax
mov al, byte [0x4d8868]
mov ecx, eax
shl ecx, 8
or ecx, 0x2001f
mov dl, 1
mov eax, dword [0x43aa8c]
call fcn.0043ac3c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4aedc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4aee04
mov eax, dword [ebp - 0x10]
call fcn.0043ad3c
test al, al
je 0x4aec84
mov bl, 1
xor eax, eax
push ebp
push 0x4aec63
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
jne 0x4aec4b
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043b268
jmp 0x4aec56
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043afd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aed1f
cmp byte [0x4d8868], 0
je 0x4aed1f
mov eax, dword [ebp - 0x10]
call fcn.0043aca4
lea eax, [ebp - 0x10]
call fcn.0040f100
mov ecx, 0x2021f
mov dl, 1
mov eax, dword [0x43aa8c]
call fcn.0043ac3c
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, 0x4aee04
mov eax, dword [ebp - 0x10]
call fcn.0043ad3c
test al, al
je 0x4aed1f
mov bl, 1
xor eax, eax
push ebp
push 0x4aed03
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
jne 0x4aecee
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043b268
jmp 0x4aecf9
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043afd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aed1f
test bl, bl
jne 0x4aeda8
mov eax, dword [ebp - 0x10]
call fcn.0043aca4
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.0043acd4
mov cl, 1
mov edx, 0x4aee40
mov eax, dword [ebp - 0x10]
call fcn.0043ad3c
test al, al
je 0x4aeda4
xor eax, eax
push ebp
push 0x4aed88
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
jne 0x4aed73
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043b268
jmp 0x4aed7e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0043afd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aeda8
mov byte [ebp - 0xa], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aedcd
mov eax, dword [ebp - 0x10]
call fcn.0043aca4
lea eax, [ebp - 0x10]
call fcn.0040f100
ret
Function at 0x4aee74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, dword [0x4d68bc]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0047b6ec
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.shell32.dll_ShellExecuteA
mov esi, eax
cmp ebx, 0x14
jge 0x4aeecb
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4d6700]
mov eax, dword [eax]
call fcn.0047d568
inc ebx
cmp ebx, 0x14
jl 0x4aeeb2
mov eax, dword [0x4d68bc]
mov eax, dword [eax]
xor edx, edx
call fcn.0047b6ec
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4aeee4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
mov ebx, eax
push 0x65
lea eax, [ebp - 0x65]
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
push eax
call sub.kernel32.dll_VerLanguageNameA
mov eax, ebx
lea edx, [ebp - 0x65]
mov ecx, 0x65
call fcn.004033f4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aefbc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4af064
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
mov eax, esi
call fcn.00403614
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
jne 0x4af009
mov eax, ebx
mov edx, esi
call fcn.004031d4
jmp 0x4af02c
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004033f4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00408274
cmp dword [ebx], 0
jne 0x4af04b
mov eax, esi
mov edx, 0x4af07c
call fcn.00403598
jne 0x4af04b
mov edx, ebx
mov eax, 0x4af08c
call fcn.004aefbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af06b
lea eax, [ebp - 0x10c]
call fcn.00403114
ret

Function at 0x4afb9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4afc53
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
test ebx, ebx
jle 0x4afbf5
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403834
mov eax, dword [ebp - 4]
call fcn.00403614
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403834
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031d4
jmp 0x4afbff
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031d4
cmp dword [esi], 0
je 0x4afc38
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00403444
mov edx, eax
mov eax, dword [esi]
mov ecx, 1
call fcn.00403668
mov eax, dword [ebp - 8]
mov edx, 0x4afc68
call fcn.00403598
je 0x4afc38
mov eax, esi
mov edx, 0x4afc68
call fcn.00403450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afc5a
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040317c
ret
Function at 0x4b19ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035f4
xor eax, eax
push ebp
push 0x4b1a98
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403668
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x4b1aac
call fcn.00403498
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403614
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b1a6e
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040879c
jmp 0x4b1a75
mov eax, ebx
call fcn.00403114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1a9f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040317c
lea eax, [ebp - 4]
call fcn.00403114
ret

Function at 0x4b1ab0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1b1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov dl, byte [ebx]
call fcn.00403378
lea eax, [ebp - 8]
mov edx, 0x4b1b38
call fcn.00403450
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004b19ec
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1b24
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040317c
ret

Function at 0x4b1cb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035f4
xor eax, eax
push ebp
push 0x4b1dfd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b1d94
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00408b74
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4b1d0c
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x4b1d7e
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b1d39
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4b1d39
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x4b1d7e
push 0x4000
push 0x80000000
push 0
push 0x4004
push 0x80000000
push 0
call fcn.0042e358
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fmulp st(1)
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x30], eax
fild qword [ebp - 0x34]
faddp st(1)
call fcn.00401a1c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1d9b
mov eax, dword [ebp - 0x14]
call fcn.00408c88
ret
Function at 0x4b1ee8
Capabilities:
Check for time delay via queryperformancecounter
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035f4
lea ebx, [ebp - 0x5c]
lea esi, [ebp - 0x10]
mov edi, dword [0x4d6700]
xor eax, eax
push ebp
push 0x4b2066
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push esi
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
jmp 0x4b2028
mov eax, ebx
xor ecx, ecx
mov edx, 0x3c
call fcn.00401c14
mov dword [ebx], 0x3c
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], 0x440
mov eax, 0x4b2074
mov dword [ebx + 0x10], eax
push 0x4b2080
lea eax, [ebp - 0x64]
call fcn.004b6218
push dword [ebp - 0x64]
push 0x4b2090
push 0x4b20a4
push dword [ebp - 4]
push 0x4b20c4
lea eax, [ebp - 0x60]
mov edx, 6
call fcn.0040350c
mov eax, dword [ebp - 0x60]
call fcn.00403614
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push ebx
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4b1ffe
push 0x64
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esi]
mov edx, dword [esi + 4]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
fild qword [ebp - 0x6c]
fild qword [ebp - 0x20]
fdivp st(1)
fcomp dword [0x4b20c8]
fnstsw ax
sahf
ja 0x4b1ffe
push esi
call sub.kernel32.dll_QueryPerformanceCounter
cmp dword [ebp - 8], 0x103
jne 0x4b1ffe
mov eax, dword [edi]
cmp byte [eax + 0x9c], 0
je 0x4b1fac
mov eax, dword [esi]
mov edx, dword [esi + 4]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
fild qword [ebp - 0x6c]
fild qword [ebp - 0x20]
fdivp st(1)
fcomp dword [0x4b20c8]
fnstsw ax
sahf
ja 0x4b2043
push esi
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [ebp - 4]
call fcn.004b1e10
test al, al
je 0x4b2043
mov eax, dword [edi]
cmp byte [eax + 0x9c], 0
je 0x4b1f3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b206d
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040317c
lea eax, [ebp - 4]
call fcn.00403114
ret