joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4889de
Capabilities:
Create thread

Disassembly:
push 0x25c
mov eax, 0x4c5aa5
call fcn.004ac3e5
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 0x261], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004aa5ed
mov byte [ebp - 0x30], bl
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004aa5ff
push 0xa
push 0x20
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.004a8473
add esp, 0x14
push 0xffffffffffffffff
push ebx
mov edi, 0x4f2c78
push esi
mov ecx, edi
call fcn.0040a00c
lea eax, [ebp - 0x30]
push eax
call fcn.004a5ed0
pop ecx
push eax
lea eax, [ebp - 0x30]
mov esi, 0x4f2c94
push eax
mov ecx, esi
call fcn.00409c19
push ebx
push ebx
push ebx
push 0x488586
push ebx
push ebx
mov byte [0x4f2cb0], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x268], eax
cmp eax, ebx
je 0x488b50
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x488b44
cmp byte [0x4f2cb0], bl
je 0x488b44
lea eax, [ebp - 0x254]
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], 0x200
mov dword [ebp - 0x258], eax
push 0x5f
lea eax, [ebp - 0x260]
push 0x5f
push eax
mov eax, edi
mov dword [ebp - 4], ebx
call fcn.00412a1f
pop ecx
call fcn.00412ee6
push eax
mov eax, esi
call fcn.00412a1f
pop ecx
pop ecx
call fcn.00412ee6
push eax
mov eax, str.sogoufaxian
call fcn.00412af6
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x54], bl
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x258]
push eax
mov byte [ecx + eax], bl
push dword [ebp - 0x258]
lea edi, [ebp - 0x54]
call fcn.004987d0
mov eax, edi
push eax
mov esi, 0x4f2cb4
call fcn.0049bbdc
mov byte [ebp - 0x261], al
lea eax, [ebp - 0x254]
add esp, 0x14
cmp dword [ebp - 0x258], eax
je 0x488b44
push dword [ebp - 0x258]
call fcn.004a5f5b
pop ecx
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x261]
call fcn.004ac468
ret
Function at 0x488eb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x488ebf
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x488f73
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d11b8]
add ecx, 8
sub edi, 8
dec esi
jne 0x488ed6
pop ebx
test edi, edi
je 0x488f8c
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x4d11b8]
inc ecx
dec edi
jne 0x488f77
pop esi
not eax
pop edi
ret

Function at 0x48a712
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
call fcn.0048a764
mov dword [esi], ebx
cmp ebx, 0xffffffff
je 0x48a759
and dword [ebp - 8], 0
push edi
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
mov byte [esi + 8], 1
pop edi
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
leave
ret
Function at 0x48ae25
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x410]
push eax
mov ebx, ecx
push 0x1ff
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48af96
mov esi, 0x4dfe48
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp - 0x410]
test ebx, ebx
je 0x48ae80
lea eax, [ebx + 0x10]
jmp 0x48ae82
xor eax, eax
mov edi, 0x4def44
push edi
push ecx
push 0x4dfd28
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
pop ecx
pop ecx
mov ax, word [esi]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
mov ebx, eax
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
mov eax, dword [ebp - 0x414]
je 0x48aeea
mov ecx, dword [ebp - 0x418]
shrd ecx, eax, 0x1e
shr eax, 0x1e
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x48aef9
add ecx, 0x10
jmp 0x48aefb
xor ecx, ecx
push edi
push ecx
push 0x4cd734
push ecx
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0xc]
push str.FreeSpaceM_
push ecx
push 0x4dfe68
push ecx
push ebx
push ecx
push str.Type_
push ecx
push 0x4dfe7c
push ecx
push eax
push ecx
push str.Disk_Info_
push ecx
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.0047f808
pop ecx
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
pop ecx
pop ecx
push eax
call fcn.0048b62e
pop ecx
push eax
call fcn.00408b2f
add esp, 0xc
push eax
call fcn.00408b2f
pop ecx
pop ecx
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x48af82
cmp word [esi], ax
jne 0x48ae9f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004a545d
leave
ret
Function at 0x48d051
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c2e2a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4f06b4]
xor eax, esp
push eax
lea eax, [esp + 0x2e8]
mov dword fs:[0], eax
xor ebx, ebx
push 0x24c
lea eax, [esp + 0x94]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x98], ebx
call fcn.004a63e0
lea eax, [esi + 0xf4]
add esp, 0xc
push eax
lea esi, [esp + 0x3c]
mov dword [esp + 0x18], eax
call fcn.00409de0
mov esi, str..
push esi
mov dword [esp + 0x2f4], ebx
call fcn.004a5eb4
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x3c]
call fcn.004085f7
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x48d0f4
lea eax, [esp + 0x38]
lea ecx, [esp + 0x8c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
setne al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
cmp al, bl
je 0x48d245
test byte [esp + 0x8c], 0x10
je 0x48d22b
lea eax, [esp + 0xb8]
push 0x4cdb48
push eax
call fcn.004a88ad
pop ecx
pop ecx
test eax, eax
je 0x48d22b
lea eax, [esp + 0xb8]
push 0x4cdb44
push eax
call fcn.004a88ad
pop ecx
pop ecx
test eax, eax
je 0x48d22b
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.004088ee
xor eax, eax
mov ecx, dword [esp + eax + 0x18]
cmp ecx, dword [esp + eax + 0x28]
jne 0x48d1a5
add eax, 4
cmp eax, 0x10
jl 0x48d18e
jmp 0x48d22b
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
xor edx, edx
sub esi, eax
mov eax, dword [esp + edx*4 + 0x18]
lea ecx, [esi + edx*4]
mov ecx, dword [esp + ecx + 0x18]
cmp eax, ecx
jb 0x48d1c9
ja 0x48d22b
inc edx
cmp edx, 4
jl 0x48d1b0
jmp 0x48d22b
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x70]
push 0x4cb648
push eax
call fcn.00408817
lea ecx, [esp + 0xc0]
push ecx
push eax
lea eax, [esp + 0x64]
mov byte [esp + 0x300], 1
call fcn.004088bd
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x74]
mov byte [esp + 0x2f4], 3
call fcn.0040a3ed
lea eax, [esp + 0x54]
push eax
call fcn.0047a5a1
pop ecx
push 1
lea esi, [esp + 0x58]
mov byte [esp + 0x2f4], bl
call fcn.0040a3ed
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48d125
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
xor edi, edi
lea esi, [esp + 0x3c]
call fcn.0040a3ed
mov al, 1
mov ecx, dword [esp + 0x2e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret 4
Function at 0x48d284
Capabilities:
Check if file exists
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c5a6c
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4f06b4]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x24c
mov dword [esp + 0x20], eax
lea eax, [esp + 0x84]
push ebx
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x88], ebx
call fcn.004a63e0
add esp, 0xc
push esi
lea esi, [esp + 0x48]
call fcn.00409de0
mov esi, str..
push esi
mov dword [esp + 0x2e4], ebx
call fcn.004a5eb4
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x48]
call fcn.004085f7
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x48d32d
lea eax, [esp + 0x44]
lea ecx, [esp + 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
setne al
cmp al, bl
je 0x48d46a
sub esp, 0x1c
lea ecx, [esp + 0xc4]
mov eax, esp
mov dword [esp + 0x40], esp
push ecx
call fcn.00409d45
push dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
call fcn.0048ce9c
cmp al, bl
jne 0x48d453
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x60]
push 0x4cb648
push eax
call fcn.00408817
lea ecx, [esp + 0xb0]
push ecx
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x2f0], 1
call fcn.004088bd
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x64]
mov byte [esp + 0x2e4], 3
call fcn.0040a3ed
test byte [esp + 0x7c], 0x10
je 0x48d404
cmp byte [ebp + 0x10], bl
jne 0x48d43f
lea eax, [esp + 0xa8]
push 0x4cdb48
push eax
call fcn.004a88ad
pop ecx
pop ecx
test eax, eax
je 0x48d43f
lea eax, [esp + 0xa8]
push 0x4cdb44
push eax
call fcn.004a88ad
pop ecx
pop ecx
test eax, eax
je 0x48d43f
lea eax, [esp + 0x28]
push eax
call fcn.0047a5a1
pop ecx
jmp 0x48d43f
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x48d413
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48d43f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x48d43f
cmp byte [ebp + 0x14], bl
je 0x48d43f
push dword [esp + 0x18]
lea ecx, [esp + 0x2c]
call fcn.00494b28
test al, al
je 0x48d478
push 1
xor edi, edi
lea esi, [esp + 0x2c]
mov byte [esp + 0x2e4], bl
call fcn.0040a3ed
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48d34b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
jmp 0x48d485
push 1
xor edi, edi
lea esi, [esp + 0x2c]
call fcn.0040a3ed
push 1
xor edi, edi
lea esi, [esp + 0x48]
call fcn.0040a3ed
mov al, bl
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48da53
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea ecx, [esi + 0x3d4]
lea edi, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00495273
cmp dword [ebp - 4], 0x12345678
jne 0x48da88
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x9c]
cmp eax, 1
je 0x48daa1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x274]
lea eax, [esi + 0x35c]
cmp byte [eax + 0x24], bl
je 0x48dad3
lea esi, [eax + 4]
cmp dword [esi], ebx
je 0x48dad3
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48f4a1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6c59
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
push esi
push edi
mov eax, dword [0x4f06b4]
xor eax, esp
push eax
lea eax, [esp + 0x298]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x18]
push eax
lea esi, [esp + 0x50]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ecx
call fcn.00409de0
xor eax, eax
mov dword [esp + 0x2a0], eax
mov byte [esp + 0x13], 1
lea ebx, [edi + 0xc]
mov dword [esp + 0x1c], eax
cmp dword [edi + 4], eax
jbe 0x48f642
xor eax, eax
push 0x206
push eax
mov word [esp + 0x8c], ax
lea eax, [esp + 0x8e]
push eax
mov dword [esp + 0x30], ebx
call fcn.004a63e0
movzx eax, byte [ebx + 1]
add esp, 0xc
push eax
lea eax, [ebx + 2]
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.004a5470
add esp, 0xc
lea eax, [esp + 0x68]
push 0x4cb648
push eax
lea edi, [esp + 0x54]
call fcn.00408817
lea ecx, [esp + 0x8c]
push ecx
push eax
lea eax, [esp + 0x40]
mov byte [esp + 0x2b0], 1
call fcn.004088bd
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x6c]
mov byte [esp + 0x2a4], 3
call fcn.0040a3ed
movzx eax, byte [ebx + 1]
and dword [esp + 0x14], edi
lea ebx, [ebx + eax + 2]
mov eax, dword [esp + 0x24]
cmp byte [eax], 1
lea eax, [esp + 0x14]
jne 0x48f5dc
push dword [ebp + 0x1c]
mov ecx, dword [esp + 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x34]
call fcn.0048f4a1
jmp 0x48f602
cmp byte [ebp + 0x10], 0
lea ecx, [esp + 0x30]
push eax
je 0x48f5f4
push dword [esp + 0x1c]
mov edx, ebx
call fcn.0048f000
jmp 0x48f602
mov edx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x28]
call fcn.0048f426
and byte [esp + 0x13], al
xor edi, edi
cmp byte [esp + 0x13], 0
push 1
lea esi, [esp + 0x34]
je 0x48f63d
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x2a4], 0
call fcn.0040a3ed
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [eax + 4]
jb 0x48f525
jmp 0x48f642
call fcn.0040a3ed
mov eax, dword [esp + 0x2c]
push 1
xor edi, edi
lea esi, [esp + 0x50]
mov dword [eax], ebx
call fcn.0040a3ed
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x298]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x280]
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret 0x18
Function at 0x48f71d
Capabilities:
Create directory
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c63b2
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x4f06b4]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
dec ecx
je 0x48f904
mov esi, dword [eax + 0x14]
push 8
pop edi
cmp esi, edi
jb 0x48f773
mov edx, dword [eax]
jmp 0x48f775
mov edx, eax
cmp word [edx + ecx*2], 0x5c
je 0x48f795
cmp esi, edi
jb 0x48f784
mov edx, dword [eax]
jmp 0x48f786
mov edx, eax
cmp word [edx + ecx*2], 0x2f
je 0x48f795
dec ecx
jne 0x48f768
jmp 0x48f904
cmp ecx, 0xffffffff
je 0x48f904
push ecx
push 0
push eax
lea esi, [esp + 0x28]
call fcn.0040f240
and dword [esp + 0x70], 0
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x30], edi
jae 0x48f7be
lea esi, [esp + 0x1c]
push esi
call fcn.00479c77
pop ecx
test al, al
jne 0x48f8f7
push esi
lea eax, [esp + 0x3c]
call fcn.00409d45
mov byte [esp + 0x70], 1
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x48f7f7
push 1
xor edi, edi
lea esi, [esp + 0x3c]
mov byte [esp + 0x74], al
call fcn.0040a3ed
jmp 0x48f849
cmp word [esi + eax*2 - 2], 0x5c
je 0x48f80a
push 0x5c
lea eax, [esp + 0x3c]
call fcn.0047ab50
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], edi
jae 0x48f818
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x48f82d
cmp eax, 2
je 0x48f82d
xor bl, bl
jmp 0x48f82f
mov bl, 1
push 1
xor edi, edi
lea esi, [esp + 0x3c]
mov byte [esp + 0x74], 0
call fcn.0040a3ed
test bl, bl
jne 0x48f8f7
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.0048f71d
test al, al
jne 0x48f86f
push 1
xor edi, edi
lea esi, [esp + 0x20]
call fcn.0040a3ed
xor al, al
jmp 0x48f906
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x48f87e
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48f8f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x30], 8
mov esi, eax
mov eax, dword [esp + 0x1c]
jae 0x48f8a2
lea eax, [esp + 0x1c]
mov ecx, dword [0x4f546c]
push eax
push 0x4e06ec
push 3
call fcn.0047b708
add esp, 0xc
push 3
push esi
sub esp, 0x1c
lea eax, [esp + 0x40]
mov esi, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00409de0
lea ebx, [esp + 0x5c]
call fcn.004899c5
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x74], 2
mov edx, dword [ecx]
push 3
call dword [edx + 0x24c]
mov ecx, ebx
call fcn.00489a41
jmp 0x48f85b
push 1
xor edi, edi
lea esi, [esp + 0x20]
call fcn.0040a3ed
mov al, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret 4
Function at 0x48fc9b
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
fldz
cmp dword [eax + 0x14], 8
fstp dword [ebp - 0x10]
jb 0x48fcbb
mov eax, dword [eax]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push 3
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.004a8dc4
add esp, 0x24
test eax, eax
jne 0x48fd1c
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x48fd1c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
and eax, 0x7fffffff
and dword [ebp - 8], 0x80000000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
mov dword [ebp - 0xc], esi
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4e36f8]
fstp dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
fld dword [ebp - 0x10]
xor ecx, ebp
pop esi
call fcn.004a545d
leave
ret 4

Function at 0x48fe0d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x48fe2d
mov ecx, dword [eax]
jmp 0x48fe2f
mov ecx, eax
push esi
mov eax, 0x100
push eax
lea edx, [ebp - 0x20c]
push edx
push eax
lea edx, [ebp - 0x60c]
push edx
push eax
lea eax, [ebp - 0x40c]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push ecx
xor esi, esi
call fcn.004a8dc4
add esp, 0x24
test eax, eax
jne 0x48fe99
push esi
push esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x610], esi
mov dword [ebp - 0x614], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x48fe99
mov esi, dword [ebp - 0x614]
imul esi, dword [ebp - 0x610]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a545d
leave
ret 4
Function at 0x4902e2
Capabilities:
Get disk information

Disassembly:
push 0x648
mov eax, 0x4c2cfc
call fcn.004ac3e5
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x634]
call fcn.00409de0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x624]
cmp ecx, ebx
jbe 0x490353
cmp dword [ebp - 0x620], 8
mov eax, dword [ebp - 0x634]
jae 0x490320
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x490345
cmp dword [ebp - 0x620], 8
mov eax, dword [ebp - 0x634]
jae 0x49033d
lea eax, [ebp - 0x634]
cmp word [eax + ecx*2 - 2], 0x2f
jne 0x490353
lea eax, [ecx - 1]
lea ecx, [ebp - 0x634]
call fcn.0040f73c
xor eax, eax
mov word [ebp - 0x18], ax
mov esi, 0x1fe
lea edi, [ebp - 0x16]
push esi
stosd dword es:[edi], eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.004a63e0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004a63e0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push ebx
push eax
call fcn.004a63e0
mov ecx, dword [ebp - 0x634]
add esp, 0xc
cmp dword [ebp - 0x620], 8
jae 0x4903c3
lea ecx, [ebp - 0x634]
mov eax, 0x100
push eax
lea edx, [ebp - 0x618]
push edx
push eax
lea edx, [ebp - 0x218]
push edx
push eax
lea eax, [ebp - 0x418]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push ecx
call fcn.004a8dc4
add esp, 0x24
cmp eax, ebx
jne 0x490409
cmp word [ebp - 0x18], bx
je 0x490409
mov byte [ebp - 0x651], 1
cmp word [ebp - 0x218], bx
jne 0x49040f
mov byte [ebp - 0x651], bl
lea eax, [ebp - 0x18]
push eax
call fcn.00479c77
pop ecx
test al, al
je 0x490421
mov bl, 1
jmp 0x49048a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x650]
call fcn.00409d45
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x640]
cmp eax, ebx
je 0x49047b
cmp word [ebp + eax*2 - 0x1a], 0x5c
je 0x490453
push 0x5c
lea eax, [ebp - 0x650]
call fcn.0047ab50
cmp dword [ebp - 0x63c], 8
mov eax, dword [ebp - 0x650]
jae 0x490468
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x490479
cmp eax, 2
jne 0x49047b
mov bl, 1
push 1
xor edi, edi
lea esi, [ebp - 0x650]
call fcn.0040a3ed
push 1
xor edi, edi
lea esi, [ebp - 0x634]
call fcn.0040a3ed
mov al, bl
and al, byte [ebp - 0x651]
call fcn.004ac468
ret 4
Function at 0x4921ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49220d
mov eax, dword [eax]
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x492266
push 2
push esi
push esi
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x49224b
mov eax, dword [eax]
push esi
lea edx, [ebp + 8]
push edx
add ecx, ecx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x492268
xor al, al
pop edi
pop esi
pop ebp
ret 8
Function at 0x493494
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x20]
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ecx
jb 0x4934ac
mov eax, dword [eax]
lea ecx, [edi + 4]
cmp dword [ecx + 0x14], 8
jb 0x4934b7
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
push 4
lea esi, [ebp + 8]
push esi
push 4
push eax
mov dword [ebp + 8], edx
mov edx, dword [edi]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x49351c
cmp byte [ebp + 0x10], 0
je 0x49351c
push 0x40
call fcn.004a59a9
pop ecx
test eax, eax
je 0x4934f6
call fcn.004a2df4
mov dword [ebp + 0x10], eax
jmp 0x4934fa
and dword [ebp + 0x10], 0
mov esi, dword [ebp + 0x10]
add esi, 4
call fcn.00490544
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov dword [ebp + 0x10], eax
add esi, 0x3b4
lea eax, [ebp + 0x10]
call fcn.0049554b
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0xc