joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0a23
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x4e0a4d
xor eax, eax
inc eax
jmp 0x4e0b26
and dword [ebp - 0x214], 0
mov eax, ebx
push esi
mov esi, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4e0a5c
sub eax, ecx
sar eax, 1
cmp eax, 0x104
jbe 0x4e0a79
xor eax, eax
jmp 0x4e0b25
xor eax, eax
push edi
cmp ax, word [ebx]
je 0x4e0b1e
push 0x6403a4
push esi
call fcn.005e8146
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4e0aab
push 0x6377d4
push esi
call fcn.005e8146
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4e0b1e
mov esi, edi
sub esi, ebx
sar esi, 1
test esi, esi
jle 0x4e0b10
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00402394
push esi
push ebx
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004190f0
add esp, 0x1c
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4e0b0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], 1
cmp eax, 0xb7
je 0x4e0b10
mov dword [ebp - 0x214], esi
lea esi, [edi + 2]
xor eax, eax
cmp ax, word [esi]
jne 0x4e0a85
mov eax, dword [ebp - 0x214]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4e0b33
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea ecx, [eax - 1]
push esi
push edi
cmp ecx, 0x30
ja 0x4e0b55
mov ecx, dword [ebp + 8]
push eax
call fcn.004e070e
xor eax, eax
inc eax
jmp 0x4e0c54
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x4e0c52
call fcn.004e0fd5
push eax
lea eax, [ebp - 4]
call fcn.004243de
push 5
push 0x66d9c0
lea eax, [ebp - 4]
call fcn.00449618
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e0ba5
push ebx
call fcn.004e0a23
pop ecx
test eax, eax
jne 0x4e0ba5
lea eax, [ebx - 0x10]
call fcn.0040ace0
mov eax, edi
jmp 0x4e0c54
mov eax, dword [0x6d0fd0]
mov ecx, 0x6d0fd0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Skin_d.srx
lea ecx, [ebp - 8]
call fcn.0046a779
mov esi, dword [ebp - 8]
pop ecx
pop ecx
push dword [esi - 0xc]
lea eax, [ebp - 4]
push esi
call fcn.00449618
mov ebx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
jne 0x4e0c01
push edi
push edi
push 2
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
cmp eax, edi
je 0x4e0c42
push dword [ebp + 8]
mov eax, esi
call fcn.004627b4
cmp eax, edi
je 0x4e0c42
push dword [eax]
mov ecx, dword [ebp + 8]
call fcn.004e070e
test eax, eax
je 0x4e0c42
push ecx
lea eax, [esi - 0x10]
mov edi, esp
call fcn.0040ae97
add eax, 0x10
mov dword [edi], eax
call fcn.004e07af
lea eax, [esi - 0x10]
call fcn.0040ace0
xor edi, edi
inc edi
jmp 0x4e0b96
lea eax, [esi - 0x10]
call fcn.0040ace0
lea eax, [ebx - 0x10]
call fcn.0040ace0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4e0d9a
Capabilities:
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x60800d
call fcn.005f766b
mov esi, ecx
mov dword [ebp - 0x278], esi
call fcn.004e0d58
push esi
mov eax, str.res:__SKIN_DEFAULT_SKIN
call fcn.004627b4
push esi
mov eax, str.res:__SKIN_SKIN_5
call fcn.004627b4
push esi
mov eax, str.res:__SKIN_IE8_SKIN
call fcn.004627b4
or ebx, 0xffffffff
mov dword [ebp - 0x270], ebx
mov ecx, 0x6d0fd0
mov eax, dword [0x6d0fd0]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x274], eax
call fcn.004e0fd5
push eax
push str._sSkin.
lea ecx, [ebp - 0x274]
call fcn.0046a779
pop ecx
pop ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, ebx
je 0x4e0f1b
push 4
pop edi
mov ecx, 0x6654f0
lea eax, [ebp - 0x240]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e0e65
test dx, dx
je 0x4e0e61
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e0e65
add eax, edi
add ecx, edi
test dx, dx
jne 0x4e0e41
xor eax, eax
jmp 0x4e0e69
sbb eax, eax
sbb eax, ebx
test eax, eax
je 0x4e0ef4
mov ecx, 0x6654f4
lea eax, [ebp - 0x240]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e0ea0
test dx, dx
je 0x4e0e9c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e0ea0
add eax, edi
add ecx, edi
test dx, dx
jne 0x4e0e7c
xor eax, eax
jmp 0x4e0ea4
sbb eax, eax
sbb eax, ebx
test eax, eax
je 0x4e0ef4
test byte [ebp - 0x26c], 0x10
jne 0x4e0ef4
lea eax, [ebp - 0x240]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e0eba
sub eax, edx
sar eax, 1
cmp eax, 5
jl 0x4e0ef4
push edi
push str..srx
lea eax, [ebp + eax*2 - 0x248]
push eax
call fcn.0043d3af
add esp, 0xc
test eax, eax
jne 0x4e0ef4
push esi
lea eax, [ebp - 0x240]
call fcn.004627b4
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e0e36
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x270], ebx
mov dword [ebp - 4], ebx
jmp 0x4e0f4c
mov dword [esi + 0x20], 1
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
call fcn.0040ace0
call fcn.005f76a4
ret

Function at 0x4e0f67
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [0x6d0fd0]
mov ecx, 0x6d0fd0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 4], esi
test edi, edi
je 0x4e0fd1
cmp word [edi], 0
je 0x4e0fd1
call fcn.004e0fd5
mov esi, eax
call fcn.0042444f
push eax
push esi
lea eax, [ebp - 4]
call fcn.0040aa40
push edi
push str.Skin_s
lea ecx, [ebp - 4]
call fcn.0046a779
mov esi, dword [ebp - 4]
pop ecx
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e0fd1
xor edi, edi
inc edi
lea eax, [esi - 0x10]
call fcn.0040ace0
mov eax, edi
pop edi
pop esi
leave
ret
xor edi, edi
jmp 0x4e0fc3
Function at 0x4e0fd5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6f2660], 0
push edi
mov edi, 0x6f2448
jne 0x4e1060
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [0x6f2660], 1
call fcn.00402394
mov ebx, 0x104
push ebx
lea esi, [ebp - 0x20c]
call fcn.004d2589
mov eax, esi
push eax
push str._s....User_Data_
push ebx
push edi
call fcn.004190b1
add esp, 0x20
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e105e
mov eax, esi
push eax
push str._sUser_Data_
push ebx
push edi
call fcn.004190b1
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00403fc1
leave
ret

Function at 0x4e1346
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.004e0fd5
push eax
lea eax, [ebp - 8]
call fcn.004243de
push 5
push 0x66d9c0
lea eax, [ebp - 8]
call fcn.00449618
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e13a2
push esi
call fcn.004e0a23
pop ecx
test eax, eax
jne 0x4e13a2
mov eax, dword [ebp + 8]
push 0x63e360
call fcn.004243de
lea eax, [esi - 0x10]
call fcn.0040ace0
mov eax, dword [ebp + 8]
jmp 0x4e145c
push str.SkinSe6.srx
lea eax, [ebp - 0xc]
call fcn.004243de
mov edi, dword [ebp - 0xc]
push dword [edi - 0xc]
lea eax, [ebp - 8]
push edi
call fcn.00449618
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push ecx
mov eax, esp
mov dword [eax], str.SE6_SKIN
push ecx
mov eax, esp
lea esi, [ebp - 0x14]
mov dword [eax], str.SKIN
call fcn.0043affa
push dword [ebp - 0x10]
push dword [0x6d08a8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x14]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x66da38
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.005f52e7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4e1427
push esi
push 1
push ebx
push dword [ebp - 0xc]
call fcn.005f62f2
push esi
call fcn.005f3a1d
add esp, 0x14
lea esi, [edi - 0x10]
mov eax, esi
call fcn.0040ae97
mov edi, dword [ebp + 8]
add eax, 0x10
cmp dword [ebp - 0x14], 0
mov dword [edi], eax
je 0x4e1448
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
call fcn.0040ace0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040ace0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e458c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00405ecb
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test esi, esi
je 0x4e4662
test ebx, ebx
je 0x4e4662
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push eax
call fcn.00402394
and dword [ebp - 0x400c], 0
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x4e4662
cmp eax, 0x3fff
ja 0x4e4662
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4e4662
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x6403a4
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4e4662
mov eax, dword [ebp - 0x4008]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
mov eax, 0x102
push eax
push eax
push ebx
call fcn.00413801
xor eax, eax
add esp, 0x20
inc eax
jmp 0x4e4664
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret

Function at 0x4e4935
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
xor esi, esi
lea eax, [ebp - 0x212]
push esi
push eax
mov edi, ecx
call fcn.00402394
add esp, 0xc
push edi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x4e49bc
mov edi, 0x104
push edi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x4e49bc
push edi
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x4e49bc
mov word [ebp - 0x214], ax
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
push eax
call fcn.0040beca
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4edcc8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [edi + 0xb8]
push 0x6d09e0
call fcn.00461e95
cmp eax, esi
jne 0x4ede2b
lea eax, [ebp - 0x20]
push eax
xor ebx, ebx
push str.IsShowSkinTip
mov dword [ebp - 0x20], ebx
call fcn.004f7c49
pop ecx
lea eax, [edi + 0x1440]
pop ecx
mov dword [ebp - 0x20], eax
call fcn.00480ed9
push ecx
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
mov eax, esp
lea esi, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [eax], str.SKIN
call fcn.0043affa
mov eax, dword [edi + 0x3c]
mov dword [ebp - 0x1c], ebx
cmp eax, ebx
je 0x4ede1d
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x64fea0
push 0x637ed0
push eax
call dword [ecx + 0xf4]
test eax, eax
js 0x4ede10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x170]
mov eax, dword [eax + 4]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x138]
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
sar esi, 1
push 0xd
add esi, eax
lea eax, [edi + 0x14a8]
push 0x66e758
add ebx, 0xfffffffb
call fcn.0040aa40
push dword [ebp - 0x24]
push dword [0x6d08a8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp + 8], 0
push ebx
push esi
push 0x3a98
push 6
push dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
je 0x4ede01
push 0x66e774
jmp 0x4ede06
push 0x66e794
push dword [edi + 4]
call fcn.004e2142
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4ede1d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x28], ebx
je 0x4ede2b
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 4
Function at 0x4ef3b6
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
test ebx, ebx
je 0x4ef4d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp eax, ebx
je 0x4ef4d1
test eax, eax
je 0x4ef4d1
mov esi, 0x63e360
push esi
push str.WorkerW
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, ebx
je 0x4ef4d1
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x4ef4d1
mov esi, dword [sym.imp.USER32.dll_MonitorFromWindow]
push 2
push ebx
call esi
push 2
push dword [edi + 4]
mov dword [ebp - 0x40], eax
call esi
test eax, eax
je 0x4ef4d1
cmp dword [ebp - 0x40], eax
jne 0x4ef4d1
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x3c], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x4ef4d1
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x4ef4d1
mov ecx, 0xc00000
mov edx, eax
and edx, ecx
cmp edx, ecx
je 0x4ef4d1
test eax, 0x40000
jne 0x4ef4d1
test eax, 0x10000000
je 0x4ef4d1
and dword [ebp - 0x14], 0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4ef4d1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jne 0x4ef4d1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x34]
jne 0x4ef4d1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x30]
jne 0x4ef4d1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x2c]
jne 0x4ef4d1
xor eax, eax
inc eax
jmp 0x4ef4d3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4f3dd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push ebx
push esi
push 0x60
push eax
call dword [ecx + 0x24]
push ecx
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
xor ebx, ebx
mov eax, esp
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [eax], str.SKIN
call fcn.0043affa
push dword [ebp - 0x18]
mov dword [ebp - 4], ebx
push dword [0x6d08a8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x6d200c]
lea edx, [ebp - 4]
push edx
mov esi, 0x64fea0
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [ecx]
push 0x66f8e8
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push dword [edi + 0x30]
push 0x1450
push eax
call dword [ecx + 0x44]
mov eax, dword [edi + 0x24]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4f3e98
mov ecx, dword [eax]
push 0x25d
push 0x391
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0x177
push 0x392
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
lea ecx, [edi + 0x28]
push ecx
push esi
push str.root
push eax
call dword [edx + 0xb4]
test eax, eax
js 0x4f3f60
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x1c]
lea ecx, [edi + 4]
call fcn.004a513c
mov eax, dword [edi + 0x28]
lea edx, [ebp - 0xc]
push edx
push esi
push str.restore
mov dword [ebp - 0xc], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x4f3efd
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
xor edx, edx
cmp dword [edi + 0xbc], ebx
sete dl
push edx
push 0x3ff
push eax
call dword [ecx + 0x78]
mov eax, dword [edi + 0x28]
lea edx, [ebp - 8]
push edx
push esi
push str.backup
mov dword [ebp - 8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x4f3f34
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
xor edx, edx
cmp dword [edi + 0xbc], ebx
sete dl
push edx
push 0x3ff
push eax
call dword [ecx + 0x78]
mov ecx, dword [0x6d1ed0]
mov eax, dword [ecx]
push ebx
push ebx
push 0x518
call dword [eax + 4]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x4f3f53
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4f3f60
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4f3f6d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x1c], ebx
je 0x4f3f7b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4f7da8
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x4f7edc
cmp word [esi], di
je 0x4f7edc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4f7edc
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00402394
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4f7e05
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x4f7e2b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push 0x6654bc
jmp 0x4f7e38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push str._s_d.tmp
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00413801
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
push 2
push edi
push 3
mov edi, 0x40000000
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4f7edc
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push eax
push eax
push 4
push eax
push 3
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4f7edc
and dword [ebp - 0x214], 0
push 0
lea eax, [ebp - 0x214]
push eax
push 1
lea eax, [ebp - 0x20d]
push eax
push esi
mov byte [ebp - 0x20d], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
jmp 0x4f7ede
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4f990c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x22c], eax
xor eax, eax
mov esi, ecx
push edi
mov dword [ebx + 0x1b0], eax
mov dword [ebx + 0x1b4], eax
cmp esi, eax
je 0x4f9b2f
cmp word [esi], ax
je 0x4f9b2f
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x4f9b2f
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
push 3
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x20]
push 4
push eax
call fcn.004190f0
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x4f9b2f
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4f9b2f
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x238]
mov ecx, eax
and ecx, 0x3fffffff
mov dword [ebp - 0x230], ecx
mov ecx, dword [ebp - 0x234]
shrd eax, ecx, 0x1e
fild dword [ebp - 0x230]
fmul qword [0x68bf48]
mov dword [ebp - 0x230], eax
shr ecx, 0x1e
push ecx
fild dword [ebp - 0x230]
push ecx
faddp st(1)
fld qword [0x618ad8]
fcomp st(1)
fnstsw ax
test ah, 5
lea eax, [ebp - 0x18]
jp 0x4f9a4e
fstp qword [esp]
push str._.2f
push eax
call fcn.004fbd3f
add esp, 0x10
push 0x20
pop eax
push 0x47
jmp 0x4f9a6a
fmul qword [0x68bf40]
fstp qword [esp]
push str._.2f
push eax
call fcn.004fbd3f
add esp, 0x10
push 0x20
pop eax
push 0x4d
cmp word [ebp - 0x12], 0x2e
jne 0x4f9a89
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0x10], ax
push 0x42
pop eax
mov word [ebp - 0xe], ax
xor eax, eax
mov word [ebp - 0xc], ax
jmp 0x4f9a9f
mov word [ebp - 0x10], ax
pop eax
mov word [ebp - 0xe], ax
push 0x42
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push eax
call fcn.00402394
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x238]
mov dword [ebx + 0x1b0], ecx
mov dword [ebx + 0x1b4], eax
mov dx, word [esi]
add esp, 0xc
mov word [ebx + 0x1b8], dx
cmp eax, dword [ebx + 0x1ac]
jb 0x4f9afc
ja 0x4f9af1
cmp ecx, dword [ebx + 0x1a8]
jbe 0x4f9afc
lea eax, [ebp - 0x18]
push eax
push 0x670358
jmp 0x4f9b06
push 0x670360
push 0x64f918
lea eax, [ebp - 0x228]
push eax
call fcn.004bb1dd
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x22c]
call fcn.004243de
mov eax, dword [ebp - 0x22c]
jmp 0x4f9b41
mov esi, dword [ebp - 0x22c]
mov ecx, 0x6d0fd0
call fcn.00408141
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 8