joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d7cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x47d8c5
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047cecc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040af94
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047e19c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ae54
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047e214
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d8cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405404
ret
Function at 0x47d8d4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x47d9dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047cecc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47d9a3
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040af94
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047e19c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ae54
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047e214
jmp 0x47d9b5
xor edx, edx
mov eax, ebx
call fcn.0047e19c
xor edx, edx
mov eax, ebx
call fcn.0047e214
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d9e4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405404
ret

Function at 0x4842cc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00484508
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00484508
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x484340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x484366
inc esi
mov eax, edi
call fcn.00484324
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004842cc
inc ebx
dec esi
jne 0x48434f
pop edi
pop esi
pop ebx
ret
Function at 0x4843fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x484472
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0048436c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00484324
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004842cc
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x48443c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484479
lea eax, [ebp - 4]
call fcn.004053e0
ret
Function at 0x48510c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4852f2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4852ae
mov eax, dword [ebp - 4]
call fcn.00486ab4
cmp ebx, eax
jge 0x4852ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047b8b0
mov edx, dword [0x47d26c]
call fcn.00404690
mov esi, eax
mov eax, esi
call fcn.0047e130
test al, al
je 0x4852a4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x485298
xor eax, eax
push ebp
push 0x485291
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004856c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041ed1c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405b00
mov eax, dword [ebp - 8]
call fcn.004058d0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00485488
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4852dc
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x485290
mov eax, dword [ebp - 4]
call fcn.00485748
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b408
jmp 0x4852dc
mov eax, dword [ebp - 8]
call fcn.004053e0
jmp 0x4852dc
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a7dc
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.0040ec68
call fcn.00404d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4852f9
lea eax, [ebp - 0x54]
call fcn.004053e0
ret
Function at 0x48a3a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408644]
call fcn.00405f28
xor eax, eax
push ebp
push 0x48a541
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d7fb4], 0
jne 0x48a3fb
mov ecx, dword [0x4d9914]
mov dl, 1
mov eax, dword [0x408cb0]
call fcn.0040ece8
call fcn.00404d54
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ad4
mov eax, ebx
call fcn.00405d78
mov dword [ebp - 0x24], eax
mov esi, 0x48a550
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040717c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405d88
test eax, eax
jle 0x48a4e4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48a4d0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405650
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48a476
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405668
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48a48c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405668
mov eax, dword [ebp - 0x54]
call fcn.00405870
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405650
mov eax, dword [ebp - 0x58]
call fcn.00405870
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48a4d2
xor eax, eax
test al, al
je 0x48a4dd
mov ebx, 0x15
jmp 0x48a4e9
mov ebx, 0x10
jmp 0x48a4e9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4d7fb4]
call fcn.0048a220
mov eax, dword [ebp - 4]
call fcn.0048a220
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a548
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405404
lea eax, [ebp - 0xc]
mov edx, dword [0x408644]
call fcn.00405ff8
ret

Function at 0x4ae274
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ae2ce
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ae264
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004abebc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ab9d4
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae2d5
lea eax, [ebp - 4]
call fcn.004053e0
ret
Function at 0x4b91f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b9222
mov eax, ebx
call fcn.004b9ca8
cmp dword [ebx + 0x40], 0
je 0x4b921b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b9293
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b9285
cmp dword [ebx + 8], 0
je 0x4b9244
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b9256
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b9285
cmp dword [ebx + 8], 0
je 0x4b9237
cmp eax, 3
je 0x4b9269
dec eax
jne 0x4b9237
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b9237
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b9237
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b92b1
cmp dword [ebx + 0x14], 0xcc
je 0x4b92b1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b92bc
pop ebx
ret
Function at 0x4c98c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4c9a8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4c9aa0
call fcn.004c9730
lea eax, [ebp - 0x3f0]
call fcn.004053e0
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405870
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c9a4d
xor eax, eax
push ebp
push 0x4c9a46
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4c9ad8
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c99a2
push ebp
mov eax, 0x4c9af4
call fcn.004c9820
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4c9b00
call fcn.004c9730
mov eax, dword [ebp - 0x408]
call fcn.00405870
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c9a2c
push dword [ebp - 0x3f0]
push 0x4c9b24
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405650
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00405774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9a4d
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.00405434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9a93
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.00405404
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.00405404
ret
Function at 0x4ca2cc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ca434
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004909a0
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004909c0
mov ebx, eax
jmp 0x4ca406
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405650
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040af94
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409ac0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409ac0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405808
je 0x4ca3e6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405650
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409ac0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409ac0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405808
jne 0x4ca3fb
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004909e0
mov ebx, eax
test ebx, ebx
jne 0x4ca347
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca43b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405404
lea eax, [ebp - 4]
call fcn.004053e0
ret
Function at 0x4cce60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
mov eax, dword [ebp - 8]
call fcn.00405860
xor eax, eax
push ebp
push 0x4cd059
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4cd021
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41a474]
call fcn.0041f1d0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ccef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040aa00
test al, al
je 0x4cceee
mov eax, dword [ebp - 8]
call fcn.00405870
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004055d8
mov eax, dword [ebp - 0x1c]
call fcn.00405870
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ccf02
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405870
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41a474]
call fcn.0041f1d0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cd010
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041ef48
mov edx, dword [ebp - 0x14]
add edx, 8
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041ef48
mov edx, dword [ebp - 0x14]
add edx, 8
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041efb8
mov edx, dword [ebp - 0x14]
add edx, 8
add edx, dword [ebp - 0x18]
add edx, 0xc350
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
push 0xc350
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041efb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd017
mov eax, dword [ebp - 0x10]
call fcn.004044e0
mov eax, dword [ebp - 0xc]
call fcn.004044e0
ret
Function at 0x4ce638
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
lea eax, [ebp - 0x170]
mov edx, dword [0x408c90]
call fcn.00405f28
xor eax, eax
push ebp
push 0x4ce7de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x4ce68e
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jl 0x4ce7a2
mov ebx, edx
test ebx, ebx
je 0x4ce6a2
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x174]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004058d8
mov eax, dword [ebp - 0x174]
mov edx, 0x4ce7f4
call fcn.00405808
je 0x4ce6dc
lea eax, [ebp - 8]
mov ecx, 0x4ce7f4
mov edx, dword [ebp - 4]
call fcn.004056f8
jmp 0x4ce6e7
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405478
lea eax, [ebp - 0x178]
mov ecx, 0x4ce800
mov edx, dword [ebp - 8]
call fcn.004056f8
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.0040aca8
test eax, eax
jne 0x4ce79a
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x15c]
call fcn.00409e60
mov eax, dword [ebp - 0xc]
mov edx, 0x4ce80c
call fcn.00405808
je 0x4ce780
mov eax, dword [ebp - 0xc]
mov edx, 0x4ce818
call fcn.00405808
je 0x4ce780
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.004056f8
mov eax, dword [ebp - 0x160]
test al, 0x10
je 0x4ce769
mov eax, dword [ebp - 0xc]
call fcn.004ce638
jmp 0x4ce780
mov edx, eax
and edx, 0x3f
cmp eax, edx
jne 0x4ce780
mov eax, dword [ebp - 0xc]
call fcn.00405870
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x170]
call fcn.0040acf8
test eax, eax
je 0x4ce718
lea eax, [ebp - 0x170]
call fcn.0040ad1c
mov eax, dword [ebp - 8]
call fcn.0040b1b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce7e5
lea eax, [ebp - 0x178]
mov edx, 2
call fcn.00405404
lea eax, [ebp - 0x170]
mov edx, dword [0x408c90]
call fcn.00405ff8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405404
ret

Function at 0x4cea54
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x4ceae9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4ceb00
mov edx, dword [ebp - 4]
call fcn.004056f8
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.00405870
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a3f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ceaf0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405404
ret
Function at 0x4cebd0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x4cecaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4cecc0
mov edx, dword [ebp - 4]
call fcn.004056f8
mov eax, dword [ebp - 8]
call fcn.00405870
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4cec1a.0
jmp dword [eax*4 + 0x4cec21]
mov eax, ebx
mov edx, 0x4ceccc
call fcn.00405434
jmp 0x4cec8f
mov eax, ebx
mov edx, 0x4cecdc
call fcn.00405434
jmp 0x4cec8f
mov eax, ebx
mov edx, 0x4cecec
call fcn.00405434
jmp 0x4cec8f
mov eax, ebx
mov edx, 0x4cecfc
call fcn.00405434
jmp 0x4cec8f
mov eax, ebx
mov edx, 0x4ced0c
call fcn.00405434
jmp 0x4cec8f
mov eax, ebx
mov edx, 0x4ced1c
call fcn.00405434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cecb1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405404
ret

Function at 0x4d11e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405860
xor eax, eax
push ebp
push 0x4d1325
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d12f5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405870
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040aa00
test al, al
jne 0x4d1265
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403830
lea eax, [ebp - 0x1d0]
call fcn.004035cc
call fcn.004030ac
push dword [0x4e0e8c]
push 0x4d133c
push dword [0x4e0e90]
push 0x4d133c
push dword [0x4e0e94]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00405774
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004cc328
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405b90
call fcn.00403f28
call fcn.004030ac
lea eax, [ebp - 0x1d0]
call fcn.004038f8
call fcn.004030ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d12ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d132c
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405404
lea eax, [ebp - 4]
call fcn.004053e0
ret