joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46aeab
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae721
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x46affe
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xb82
mov dword [ebp - 0x38], str.qfzdxbnd_adxbtmw_vrljc_afc_gbgjefwlv_qwwz_xaxshnpf_nxgnphe_wmnbn_phvbu_fqxtvgfpm_uqye_wrqsyyf_mnvzpz
cmp dword [ebp - 0x28], 0xc9a
jle 0x46af91
and dword [ebp - 0x20], 0
jmp 0x46af0d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa62
jge 0x46af8b
and dword [ebp - 0x1c], 0
jmp 0x46af23
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x241a
jge 0x46af86
and dword [ebp - 0x14], 0
jmp 0x46af39
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x298c
jge 0x46af84
and dword [ebp - 0x18], 0
jmp 0x46af4f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6254
jge 0x46af82
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
sar eax, cl
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x46af48
jmp 0x46af32
jmp 0x46af1c
jmp 0x46af06
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46afb4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x46afbc
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x7a0
jge 0x46afd6
mov edx, dword [ebp - 0x38]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x46aff2
or dword [ebp - 4], 0xffffffff
jmp 0x46affc
jmp 0x46b02c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
call fcn.00470b30
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cb1b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae767
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46cb66
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.0046ccc1
add esp, 0xc
jmp 0x46ccb0
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46cc9b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0xf0d
mov dword [ebp - 0x40], str.xnqgcjeb_movvzdlow_ysgwsnrd_mrtei_bgczhl_ipvmt_edvivsbx_trxewiz_qoz_agumcu_hpcyzlww
cmp dword [ebp - 0x20], 0x1062
jle 0x46cc24
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x18], 0
jmp 0x46cbcc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6951
jge 0x46cc24
and dword [ebp - 0x1c], 0
jmp 0x46cbe2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x337d
jge 0x46cc22
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x70]
call fcn.0042fa15
jmp 0x46cbdb
jmp 0x46cbc5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc7e
jge 0x46cc40
push dword [ebp - 0x40]
call fcn.00498447
pop ecx
jmp 0x46cc5c
or dword [ebp - 4], 0xffffffff
jmp 0x46cc66
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x46cc7c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x46cc99
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.0042fc2d
mov dword [eax], 0x993d
jmp 0x46cc71
jmp 0x46ccb0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [eax], 0xb35d5697
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46da4d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae7a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x46db93
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46db81
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x4ba2
mov dword [ebp - 0x34], str.xhp_tjbfxpunu_yofzfty_frjcgjecf_fownq_fjbicc_wytlxfj_oro_vakuj_dezjyo_pgxocns_efq_cnlh
cmp dword [ebp - 0x1c], 0x4e98
jle 0x46db13
and dword [ebp - 0x14], 0
jmp 0x46dad1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4937
jge 0x46db13
and dword [ebp - 0x18], 0
jmp 0x46dae7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x622a
jge 0x46db11
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x46dae0
jmp 0x46daca
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x49f3
jge 0x46db33
mov edx, dword [ebp - 0x34]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x46db4f
or dword [ebp - 4], 0xffffffff
jmp 0x46db59
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x46db91
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x46dbb0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
push 0xdfc
push dword [ebp - 0x4c]
push 0xbef
push 1
call fcn.0046d320
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46df9a
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae7b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x46e0ae
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0xa71
mov dword [ebp - 0x38], str.ofytx_qzuli_oaooch_xkzesm_qilbsm_whyzhw_utcyp_mgnzpewjw
cmp dword [ebp - 0x2c], 0xc19
jle 0x46e04d
and dword [ebp - 0x14], 0
jmp 0x46dff2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1ba7
jge 0x46e04d
and dword [ebp - 0x18], 0
jmp 0x46e008
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1998
jge 0x46e04b
and dword [ebp - 0x1c], 0
jmp 0x46e01e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x51a
jge 0x46e049
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x46e017
jmp 0x46e001
jmp 0x46dfeb
push 1
push 0x6d86
push dword [ebp - 0x34]
push 0x2f35
push 0x79f5
call fcn.0046e1d6
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x725
jge 0x46e083
mov edx, dword [ebp - 0x38]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x46e09f
or dword [ebp - 4], 0xffffffff
jmp 0x46e0a9
jmp 0x46e1c5
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x46e0d0
push 0
push 0x115e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x46e1c5
mov dword [ebp - 0x30], 0x5ed0
mov dword [ebp - 0x40], str.obpdbj_afrmfhya_fnl_bujcqlom_eanfpgrqa_pqfdrxgfb_xvwjwod_ilgf_mgdiyspn_wdjr_epp
cmp dword [ebp - 0x30], 0x618c
jle 0x46e17b
and dword [ebp - 0x28], 0
jmp 0x46e0f8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3d2d
jge 0x46e16b
and dword [ebp - 0x20], 0
jmp 0x46e10e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5912
jge 0x46e169
and dword [ebp - 0x24], 0
jmp 0x46e124
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4e6a
jge 0x46e167
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar eax, cl
or eax, dword [ebp - 0x28]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x68]
call fcn.0042fa15
jmp 0x46e11d
jmp 0x46e107
jmp 0x46e0f1
push 0x1f1a
push 0x4a2
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0x247a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e8d3
Capabilities:
Clear file content
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae7d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x46e914
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
call fcn.0046eeb4
pop ecx
pop ecx
jmp 0x46ea32
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46ea2a
mov dword [ebp - 0x24], 0x68dc
mov dword [ebp - 0x34], str.dpmme_pdtmd_qhbi_vhd_ptyxlnsrk_zznr_yyvpyvwyz_ditlzlpri_zysvja
cmp dword [ebp - 0x24], 0x6a44
jle 0x46e9cc
and dword [ebp - 0x20], 0
jmp 0x46e956
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5da2
jge 0x46e9cc
and dword [ebp - 0x1c], 0
jmp 0x46e96c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6b36
jge 0x46e9ca
and dword [ebp - 0x14], 0
jmp 0x46e982
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4048
jge 0x46e9c8
and dword [ebp - 0x18], 0
jmp 0x46e998
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4e14
jge 0x46e9c6
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x46e991
jmp 0x46e97b
jmp 0x46e965
jmp 0x46e94f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x66b8
jge 0x46e9ec
mov edx, dword [ebp - 0x34]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x46ea08
or dword [ebp - 4], 0xffffffff
jmp 0x46ea12
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x46ea28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x46ea32
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46edc5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x46ee01
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46edf2
push 0
push 0x115e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x46edff
push 0
push 0x13aa
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x46ee1d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.0046ab9a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x46ee21
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46ee3f
push 0
push 0x88c
call fcn.0048970e
pop ecx
pop ecx
jmp 0x46eeb0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x46eea8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x46ee89
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x46eea6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.0042fc2d
mov dword [eax], 0x64276038
jmp 0x46ee7e
jmp 0x46eeb0
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x46f13e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x46f190
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46f184
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x46f182
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x46f18e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x46f1e5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x5c3e
push dword [ebp - 0x20]
push 0x3938
push 0x1a09
push 0x4d9f
push dword [ebp - 0x24]
push 0x525f
push 1
push 0x29ea
call fcn.0046b394
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x4879fe
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae93d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x487b4d
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x487b37
mov dword [ebp - 0x24], 0x75ba
mov dword [ebp - 0x2c], str.amhqcrp_sdx_vvt_joj_aqs_krwxm_cpptb_twxxc_rxdtypjps_uhpzihgja_yqb
cmp dword [ebp - 0x24], 0x7897
jle 0x487aef
and dword [ebp - 0x14], 0
jmp 0x487a68
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x34ff
jge 0x487ae7
and dword [ebp - 0x18], 0
jmp 0x487a7e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3212
jge 0x487ae2
and dword [ebp - 0x1c], 0
jmp 0x487a94
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6718
jge 0x487ae0
and dword [ebp - 0x20], 0
jmp 0x487aaa
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x40b4
jge 0x487ade
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
add ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x487aa3
jmp 0x487a8d
jmp 0x487a77
jmp 0x487a61
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x72e5
jge 0x487b0f
mov edx, dword [ebp - 0x2c]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x487b2b
or dword [ebp - 4], 0xffffffff
jmp 0x487b35
jmp 0x487b4b
push 0x121c
push 0
push 0
push 0x149e
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x487bb2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x4074
push 1
push 0x70f5
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0046c77c
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487c7f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae947
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x64d2
mov dword [ebp - 0x28], str.llw_pubgsrbi_nijlnzm
cmp dword [ebp - 0x24], 0x6602
jle 0x487d70
push 0x491
push 0
push 0x1120
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 0x14], 0
jmp 0x487cdb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xace
jge 0x487d70
and dword [ebp - 0x18], 0
jmp 0x487cf5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4689
jge 0x487d6b
and dword [ebp - 0x1c], 0
jmp 0x487d0b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1a06
jge 0x487d69
and dword [ebp - 0x20], 0
jmp 0x487d21
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x40f4
jge 0x487d67
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0042fa15
jmp 0x487d1a
jmp 0x487d04
jmp 0x487cee
jmp 0x487cd4
push 1
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 8]
push dword [ebp + 0x20]
push dword [ebp + 0xc]
call fcn.00487dde
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x61f2
jge 0x487da5
push dword [ebp - 0x28]
call fcn.00498447
pop ecx
jmp 0x487dc1
or dword [ebp - 4], 0xffffffff
jmp 0x487dcb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48810d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae95b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x488144
push 1
call fcn.00488296
pop ecx
jmp 0x488285
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x48816b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x488285
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x1c66
mov dword [ebp - 0x3c], str.oyljmhj_shvrheuq_qullxkfz
cmp dword [ebp - 0x24], 0x1e51
jle 0x488213
and dword [ebp - 0x20], 0
jmp 0x4881a1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4973
jge 0x488213
and dword [ebp - 0x18], 0
jmp 0x4881b7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd86
jge 0x488211
and dword [ebp - 0x1c], 0
jmp 0x4881cd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x670c
jge 0x48820f
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0042fa15
jmp 0x4881c6
jmp 0x4881b0
jmp 0x48819a
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1b32
jge 0x48822f
push dword [ebp - 0x3c]
call fcn.00498447
pop ecx
jmp 0x48824b
or dword [ebp - 4], 0xffffffff
jmp 0x488255
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x48826b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x488285
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.0042fc2d
and dword [eax], 0
jmp 0x488260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489723
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x489784
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x48976d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x48976b
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x489782
push 0
push 0x1fb9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x489798
push 0x5a75
push 0x5de3
push 1
call fcn.0046c7b6
add esp, 0xc
mov esp, ebp
pop ebp
ret