joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7e7c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403c30
ret

Function at 0x4acc60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4accf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405fe8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405d58
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405b88
test eax, eax
jns 0x4acca7
call fcn.004047cc
push eax
call sub.kernel32.dll_GetTempPathA
test eax, eax
jns 0x4accb6
call fcn.004047cc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405fe8
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x4780e4]
call fcn.00477200
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4accfe
lea eax, [ebp - 0xc]
call fcn.004058c8
ret

Function at 0x4b0b00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004b0adc
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004ae0cc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.004adb28
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0b78
lea eax, [ebp - 0x14]
call fcn.004058c8
ret
Function at 0x4defe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df164
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x520470], 0
jne 0x4df13e
push 0x528d7c
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x4df137
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x520470], 0
jne 0x4df11f
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405fe8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405d58
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0040a12c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4df17c
call fcn.0040c584
mov eax, dword [ebp - 0xc]
call fcn.00405d58
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4df0a0
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405fe8
jmp 0x4df0d7
lea eax, [ebp - 4]
mov edx, 0x4df19c
call fcn.00405960
xor eax, eax
push ebp
push 0x4df0cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048fad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df0d7
mov eax, dword [ebp - 4]
call fcn.00405d58
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x520470], eax
cmp dword [0x520470], 0
jne 0x4df10a
mov ecx, dword [0x520c3c]
mov dl, 1
mov eax, dword [0x409334]
call fcn.00410120
call fcn.0040523c
push 0x4df1a8
mov eax, dword [0x520470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x528d94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df13e
push 0x528d7c
call sub.kernel32.dll_LeaveCriticalSection
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df16b
lea eax, [ebp - 0x18]
call fcn.004058c8
lea eax, [ebp - 0xc]
call fcn.004058c8
lea eax, [ebp - 4]
call fcn.004058c8
ret
Function at 0x4eb4dc
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eb69d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x87], 0
je 0x4eb52c
cmp dword [ebx + 0x5c], 0
je 0x4eb52c
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004e2e64
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4eb687
cmp dword [ebx + 0x7c], 0
jne 0x4eb552
mov dl, 1
mov eax, dword [0x41dd6c]
call fcn.004048d4
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4eb660
lea eax, [ebp - 8]
mov edx, dword [ebx + 0xc]
call fcn.00406290
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [0x4eb6ac]
push eax
movzx eax, byte [0x4eb6b0]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x520c78]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4da9c8]
call fcn.004dcb0c
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4eb659
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004e2e64
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004e2e64
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4e000c]
call fcn.004071a0
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1b
jge 0x4eb62c
mov edx, dword [0x520f80]
movzx eax, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4eb63d
cmp eax, 0x1007
jne 0x4eb639
mov byte [ebx + 0x74], 0x18
jmp 0x4eb63d
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb687
mov eax, dword [ebp - 4]
call fcn.00404904
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004e2e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb6a4
lea eax, [ebp - 8]
call fcn.004060d0
ret

Function at 0x4eeff8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405d58
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x4f0f74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0045d4b0
test al, al
je 0x4f0fd6
cmp bl, 7
jne 0x4f0fab
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x4f0fb0
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
test eax, eax
je 0x4f0fd6
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
push edi
push 0
push 0x100f
push eax
call sub.user32.dll_SendMessageA
mov byte [esi + 0x268], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4fb4b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x3ec]
mov eax, dword [eax + 8]
call fcn.004f96b8
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x20]
call fcn.004fac9c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x3c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
call fcn.0040591c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x22]
mov edx, dword [ebp - 8]
mov byte [edx + 0x34], al
mov eax, dword [ebp - 8]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x2c]
call fcn.0040591c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x34], 6
jne 0x4fb580
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4fb580
xor edx, edx
push ebp
push 0x4fb551
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
call fcn.00430844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb5de
xor eax, eax
push ebp
push 0x4fb5bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x4fb5b3
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x4fb5b3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.00430794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb5c7
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4fb5de
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004fa53c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4fb5e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x3ec]
mov eax, dword [eax + 8]
call fcn.004f96b8
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x20]
mov edx, esi
call fcn.004faeec
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x3c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
call fcn.0040591c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x22]
mov edx, dword [ebp - 8]
mov byte [edx + 0x34], al
mov eax, dword [ebp - 8]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x2c]
call fcn.0040591c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x34], 6
jne 0x4fb6b4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4fb6b4
xor edx, edx
push ebp
push 0x4fb689
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
call fcn.00430844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb712
xor eax, eax
push ebp
push 0x4fb6f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x4fb6e7
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x4fb6e7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.00430794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb6fb
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4fb712
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004fa53c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x50bb1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405d58
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x50bb35
test al, 0x10
jne 0x50bb39
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x50bb40
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405d48
xor eax, eax
push ebp
push 0x50bd2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00404060
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00403c30
cmp dword [ebp + 0x20], 0
je 0x50bbfb
cmp dword [ebp - 0x10], 0
je 0x50bbfb
mov eax, dword [ebp + 0x20]
call fcn.0040b5fc
test al, al
jne 0x50bbb1
mov eax, dword [ebp + 0x20]
call fcn.0050bb1c
test al, al
je 0x50bbd4
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405d58
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x50bbf5
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405d58
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x50bc22
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x50bd40
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x50bc41
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x50bd40
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0041ef08
test bl, bl
je 0x50bc81
cmp byte [ebp + 0x14], 0
jne 0x50bc81
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0042e584
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x50bd17
mov dl, 1
mov eax, dword [0x42c3c8]
call fcn.00432eb0
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00433484
call fcn.0042e584
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004034fc
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004034fc
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.0050ba40
mov eax, ebx
call fcn.00404904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bd34
lea eax, [ebp + 0x20]
call fcn.004058c8
ret
Function at 0x5130dc
Capabilities:
Terminate process

Disassembly:
push 0
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
ret

Function at 0x51320c
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
push edx
push 0
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_PostMessageA
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
ret

Function at 0x513254
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x513421
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x528e58], 0
je 0x5133f6
call sub.user32.dll_GetForegroundWindow
mov esi, eax
mov eax, dword [0x528e2c]
call fcn.0045d110
push eax
call sub.user32.dll_SetForegroundWindow
lea eax, [ebp - 4]
call fcn.004079d8
push eax
lea ecx, [ebp - 8]
mov eax, dword [0x528e2c]
mov eax, dword [eax + 0x368]
mov edx, 0xcb
call fcn.004936ac
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1b0]
call fcn.00407ae8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xec]
call fcn.00407ae8
push 0x513438
lea edx, [ebp - 0x10]
mov eax, dword [0x528e2c]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0x44]
call fcn.0040aef4
push dword [ebp - 0x10]
push 0x513448
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c5c
mov eax, dword [ebp - 0xc]
call fcn.00405d58
xor edx, edx
call fcn.004a7278
mov dl, 1
mov eax, dword [0x446558]
call fcn.004048d4
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004467dc
mov edx, dword [ebp - 0x14]
mov eax, 0x528e70
call fcn.0040591c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [0x528e58]
mov eax, ebx
call fcn.0044685c
mov eax, 0x51344c
xor edx, edx
call fcn.004a7278
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, ebx
call fcn.00404904
push 0x513438
lea edx, [ebp - 0x1c]
mov eax, dword [0x528e2c]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0x48]
call fcn.0040aef4
push dword [ebp - 0x1c]
push 0x513448
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405c5c
mov eax, dword [ebp - 0x18]
call fcn.00405d58
xor edx, edx
call fcn.004a7278
mov al, 0x20
call fcn.00513234
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x5133e0
cmp eax, 0x3e8
jbe 0x5133e2
jmp 0x5133f0
jg 0x5133f0
mov eax, dword [0x520dc4]
mov eax, dword [eax]
call fcn.00473efc
jmp 0x5133bd
push esi
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513428
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004058ec
lea eax, [ebp - 8]
call fcn.004079d8
lea eax, [ebp - 4]
call fcn.004079d8
ret
Function at 0x5150a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x51525a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x520bf4]
mov eax, dword [eax]
call fcn.0040b5fc
test al, al
je 0x5150fa
mov ebx, dword [0x520bf4]
mov ebx, dword [ebx]
mov dword [ebp - 0x1d4], ebx
mov eax, dword [ebp - 0x1d4]
call fcn.00405d58
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x520bf4]
mov edx, dword [edx]
lea eax, [ebp - 0x1d0]
call fcn.0040381c
lea eax, [ebp - 0x1d0]
call fcn.004035ac
call fcn.00403138
push 0x515270
mov eax, dword [0x520b58]
push dword [eax]
push 0x5152b8
push 0x5152c8
push 0x5152d4
push 0x5152e0
push 0x5152c8
push 0x5152d4
push 0x5152fc
push 0x5152c8
push 0x5152d4
push 0x515314
push 0x5152c8
push 0x5152d4
push 0x515334
push 0x5152c8
push 0x5152d4
push 0x515350
push 0x5152c8
push 0x5152d4
push 0x515370
push 0x5152c8
push 0x5152d4
push 0x51538c
push 0x5152c8
push 0x5152d4
push 0x5153ac
push 0x5152c8
push 0x5152d4
push 0x5153cc
push 0x5152c8
push 0x5152d4
push 0x5153ec
push 0x5152c8
push 0x5152d4
push 0x515410
push 0x5152c8
push 0x5152d4
push 0x51542c
push 0x5152c8
push 0x5152d4
push 0x51544c
push 0x5152c8
push 0x5152d4
push 0x515460
push 0x5152c8
push 0x5152d4
push 0x5154b4
lea eax, [ebp - 4]
mov edx, 0x30
call fcn.00405c5c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00406078
call fcn.00404248
call fcn.00403138
lea eax, [ebp - 0x1d0]
call fcn.0040399c
call fcn.00403138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515261
lea eax, [ebp - 4]
call fcn.004058c8
ret
Function at 0x515548
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x515550
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405d48
mov esi, 0x528e48
xor eax, eax
push ebp
push 0x515785
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [0x5208a8]
cmp byte [eax], 6
je 0x51558e
mov eax, dword [0x5208a8]
cmp byte [eax], 7
jne 0x5155af
lea edx, [ebp - 0x10]
mov eax, dword [0x5208c4]
mov eax, dword [eax]
call fcn.0040b874
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x5157a0
call fcn.00405be0
jmp 0x5155d1
lea eax, [ebp - 0x14]
call fcn.00476748
push dword [ebp - 0x14]
push 0x5157b4
push 0x5157a0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405c5c
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41e51c]
call fcn.00423374
mov dword [ebp - 0xc], eax
cmp dword [esi], 0
je 0x5155f4
mov eax, dword [esi]
call fcn.00404904
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b61ec]
call fcn.0047a490
mov dword [esi], eax
xor eax, eax
push ebp
push 0x515629
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [esi]
call fcn.004b6770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515655
mov eax, dword [esi]
call fcn.0048f0e4
mov eax, dword [esi]
call fcn.00404904
xor eax, eax
mov dword [esi], eax
mov esi, dword [0x52088c]
mov esi, dword [esi]
mov edx, dword [0x52088c]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x5157e8
call fcn.00405be0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
call fcn.00405d58
push eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.00405d58
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x52088c]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.005154c4
test al, al
je 0x5156ef
mov edx, dword [0x52088c]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x5157e8
call fcn.00405be0
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.00405d58
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x515732
mov edx, dword [0x52088c]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, 0x5157e8
call fcn.00405be0
mov esi, dword [ebp - 0x28]
mov edi, dword [0x52088c]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
call fcn.00405d58
push eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.00405d58
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0xc]
call fcn.00404904
mov eax, dword [ebp - 8]
call fcn.00405d58
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51578c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004058ec
lea eax, [ebp - 0x18]
call fcn.004058c8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004058ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058ec
ret
Function at 0x516d8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x516e4e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405ab0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x516e68
call fcn.00405be0
mov eax, dword [ebp - 4]
call fcn.00405d58
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x516e2b
lea eax, [ebp - 8]
mov edx, 0x40
call fcn.00405fe8
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x516df3
sub ebx, 4
mov ebx, dword [ebx]
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00405d58
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
push 0x516e6c
mov eax, dword [ebp - 8]
call fcn.00405d58
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x516e2b
or edi, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516e55
lea eax, [ebp - 0x14]
call fcn.004058c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058ec
ret