joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ad30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
sub ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040524c
mov eax, dword [ebp - 8]
call fcn.0040524c
sub eax, eax
push ebp
push 0x44ae64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45e254]
mov eax, dword [eax]
call fcn.00409150
test al, al
jne 0x44ad82
lea edx, [ebp - 0xc]
mov eax, dword [0x45e254]
mov eax, dword [eax]
call fcn.00458abc
mov eax, dword [0x45e314]
cmp dword [eax], 1
jne 0x44adba
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
mov eax, dword [0x45df94]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45e06c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_UnlockFile
mov eax, dword [0x45e06c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00456ccc
push 0x1e
call sub.KERNEL32.DLL_Sleep_1
push 0
push 4
push 3
push 0
push 0
push 0x80000000
mov eax, dword [0x45e254]
mov eax, dword [eax]
call fcn.0040525c
push eax
mov eax, dword [0x45e3b4]
mov eax, dword [eax]
call eax
mov edx, dword [0x45e06c]
mov dword [edx], eax
mov eax, dword [0x45e06c]
cmp dword [eax], 0xffffffff
je 0x44ae49
push 0
mov eax, dword [0x45e06c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov edx, dword [0x45df94]
mov dword [edx], eax
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
mov eax, dword [0x45df94]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45e06c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_LockFile
mov eax, dword [0x45e314]
mov dword [eax], 1
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ae6b
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404dc0
ret
Function at 0x44ae70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040524c
mov eax, dword [ebp - 8]
call fcn.0040524c
sub eax, eax
push ebp
push 0x44afe9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x45df6c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [0x45df6c]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0xc]
call fcn.004050a8
mov eax, dword [ebp - 0xc]
call fcn.00409150
test al, al
jne 0x44aef1
mov ecx, dword [0x45df6c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [0x45df6c]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x14]
call fcn.004050a8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00458abc
mov eax, dword [0x45e314]
cmp dword [eax], 1
jne 0x44af29
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
mov eax, dword [0x45df94]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45e1b4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_UnlockFile
mov eax, dword [0x45e1b4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00456ccc
push 0x1e
call sub.KERNEL32.DLL_Sleep_1
push 0
push 4
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [0x45df6c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [0x45df6c]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x1c]
call fcn.004050a8
mov eax, dword [ebp - 0x1c]
call fcn.0040525c
push eax
mov eax, dword [0x45e3b4]
mov eax, dword [eax]
call eax
mov edx, dword [0x45e1b4]
mov dword [edx], eax
mov eax, dword [0x45e1b4]
cmp dword [eax], 0xffffffff
je 0x44afce
push 0
mov eax, dword [0x45e1b4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov edx, dword [0x45df94]
mov dword [edx], eax
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
mov eax, dword [0x45df94]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45e1b4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_LockFile
mov eax, dword [0x45e314]
mov dword [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44aff0
lea eax, [ebp - 0x1c]
push 7
pop edx
push edi
pop edi
call fcn.00404dc0
ret
Function at 0x44e110
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e196
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 0x44e1ac
call fcn.00458fb8
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov eax, dword [ebp - 4]
call fcn.0040525c
push eax
push 0x80000002
mov eax, dword [0x45e0e0]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x44e180
mov eax, dword [0x45df6c]
mov eax, dword [eax + 0x1c]
call fcn.0040525c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x45e0e8]
mov eax, dword [eax]
call eax
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e19d
lea eax, [ebp - 4]
call fcn.00404d9c
ret
Function at 0x44ffc0
Capabilities:
Read clipboard data

Disassembly:
push ebp
push esp
pop ebp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
sub eax, eax
push ebp
push 0x45017d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45dfec]
mov byte [eax], 0
cmp dword [0x45fbf0], 0
jne 0x45003e
push 0
call sub.user32.dll_GetDesktopWindow
push eax
push 0
push 0
push 0
push 0
push 0
push 0x45018c
call dword [0x45fbf4]
mov dword [0x45fbf0], eax
push 0
push 0
push 0x40a
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
dec eax
je 0x45003e
push 0
push 0
push 0x10
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
sub eax, eax
mov dword [0x45fbf0], eax
cmp dword [0x45fbf0], 0
je 0x450071
push 0
push 0
push 0x43c
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x41e
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
jmp 0x45009b
lea edx, [ebp - 4]
mov eax, 0x4501a4
call fcn.00458fb8
lea eax, [ebp - 4]
mov edx, 0x4501c8
call fcn.00405064
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x14]
call fcn.00450a24
call fcn.00456674
mov eax, dword [ebx + 4]
call fcn.004160c8
push 0
push esi
push 0x43c
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
push 0
push esi
push 0x41e
mov eax, dword [0x45fbf0]
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [0x45e0dc]
mov eax, dword [eax]
call eax
push 2
call sub.user32.dll_GetClipboardData
push eax
pop edx
mov eax, dword [ebx + 4]
call fcn.0044fb6c
call sub.user32.dll_CloseClipboard
call sub.user32.dll_EmptyClipboard
push 0
push 0
mov eax, dword [ebx + 4]
call fcn.004159c8
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, edi
mov eax, dword [ebx + 0x10]
mov byte [eax + 0x3f], dl
call fcn.004277b8
mov eax, dword [ebx + 8]
call fcn.004160c8
mov eax, dword [ebx + 4]
call fcn.004160c8
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 0
push 0
mov eax, dword [ebx + 8]
call fcn.004159c8
mov cl, 1
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
call fcn.00423454
push 0
push 0
mov eax, dword [ebx + 4]
call fcn.004159c8
push ebx
pop eax
call fcn.004501cc
mov ebx, eax
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450184
lea eax, [ebp - 4]
call fcn.00404d9c
ret
Function at 0x450720
Capabilities:
Delete service

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040524c
sub eax, eax
push ebp
push 0x4507de
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x4507be
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0xf003f
push 0
push 0x4507f0
mov eax, dword [0x45e1ac]
mov eax, dword [eax]
call eax
mov ebx, eax
or ebx, ebx
je 0x4507a6
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040525c
push eax
push ebx
mov eax, dword [0x45e2c4]
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x4507a0
push edi
call sub.advapi32.dll_DeleteService
nop
push 1
nop
pop esi
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jle 0x4507b0
mov byte [ebp - 5], 1
jmp 0x4507b4
mov byte [ebp - 5], 0
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4507c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4507e5
lea eax, [ebp - 4]
call fcn.00404d9c
ret

Function at 0x450888
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push ecx
pop esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040524c
xor eax, eax
push ebp
push 0x450940
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
pop eax
call fcn.00450950
mov eax, dword [ebp - 4]
call fcn.0040525c
mov dword [ebx + 4], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x14], eax
mov word [ebp - 0x18], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_inet_addr
push eax
pop esi
mov dword [ebp - 0x14], esi
inc esi
jne 0x45090d
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45092a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.wsock32.dll_connect
or eax, eax
jge 0x450926
mov byte [ebx + 0x10], 0
jmp 0x45092a
mov byte [ebx + 0x10], 1
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450947
lea eax, [ebp - 4]
call fcn.00404d9c
ret
Function at 0x452550
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x452558
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4526f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x452708
call fcn.00404e34
lea eax, [ebp - 0x14]
mov edx, 0x452720
call fcn.00404e34
lea eax, [ebp - 4]
push eax
push 0x452738
push 0x80000003
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4526d7
lea eax, [ebp - 8]
mov edx, 0xc8
call fcn.0040538c
xor esi, esi
jmp 0x4526aa
mov edx, dword [ebp - 8]
mov eax, 0x452744
call fcn.004524b8
cmp eax, 4
jle 0x4526a1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004087e8
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x452750
call fcn.004087e8
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00405344
test eax, eax
jne 0x4526a1
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
pop edx
lea eax, [ebp - 0x20]
call fcn.00404f94
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov ecx, 0x452760
call fcn.004050a8
test bl, bl
je 0x452665
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004050a8
mov edx, dword [ebp - 0x24]
push 1
pop ecx
pushal
popal
mov eax, 0x80000003
call fcn.004523b4
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004050a8
mov edx, dword [ebp - 0x28]
pushfd
xor ecx, ecx
inc ecx
popfd
mov eax, 0x80000003
call fcn.004523b4
jmp 0x4526ca
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004050a8
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x80000003
call fcn.004523b4
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004050a8
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, 0x80000003
call fcn.004523b4
jmp 0x4526ca
inc esi
cmp esi, 0xb4
ja 0x4526ca
push 0xc8
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x4525ba
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x45e0e8]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4526f9
lea eax, [ebp - 0x30]
nop
push 0xb
nop
pop edx
call fcn.00404dc0
ret
Function at 0x45279c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
sub eax, eax
push ebp
push 0x4528ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x4528fc
push 0x80000003
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4528d1
lea eax, [ebp - 8]
mov edx, 0xc8
call fcn.0040538c
xor ebx, ebx
jmp 0x4528a4
mov edx, dword [ebp - 8]
mov eax, 0x452908
call fcn.004524b8
cmp eax, 4
jle 0x45289b
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004087e8
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, 0x452914
call fcn.004087e8
mov eax, dword [ebp - 0x14]
pop edx
call fcn.00405344
or eax, eax
jne 0x45289b
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
pop edx
lea eax, [ebp - 0x18]
call fcn.00404f94
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x452924
call fcn.004050a8
lea eax, [ebp - 0x1c]
mov ecx, 0x45295c
mov edx, dword [ebp - 0xc]
call fcn.004050a8
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc]
mov eax, 0x80000003
call fcn.00452414
mov al, byte [0x452964]
push eax
lea eax, [ebp - 0x20]
push eax
sub ecx, ecx
mov edx, 0x452970
mov eax, dword [ebp - 0xc]
call fcn.0040dbd8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00404e34
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00409470
jmp 0x4528c4
inc ebx
cmp ebx, 0xb4
ja 0x4528c4
push 0xc8
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x4527ea
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x45e0e8]
mov eax, dword [eax]
call eax
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4528f3
lea eax, [ebp - 0x20]
nop
push 7
nop
pop edx
call fcn.00404dc0
ret

Function at 0x452a50
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ebx
push esi
push edi
mov ebx, eax
sub eax, eax
mov dword [ebp - 4], eax
sub eax, eax
push ebp
push 0x452aa3
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push ebx
pop esi
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
or eax, eax
jne 0x452a99
cmp word [esi], 0x5a4d
jne 0x452a99
lea eax, [ebx + 0x3c]
add ebx, dword [eax]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x452a99
sub eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x452ab2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x452ba8
Capabilities:
Read file via mapping

Disassembly:
push ebp
push esp
pop ebp
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0xc]
mov dword [edx], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp dword [eax], 0
setne al
pop ebp
ret

Function at 0x452c80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov edx, dword [ebp + 8]
add eax, dword [edx - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
pop ebp
ret

Function at 0x453078
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
lea esi, [ebp - 4]
sub eax, eax
push ebp
push 0x45310e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4530f3
mov eax, dword [ebx]
add eax, 8
call fcn.00453078
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx], eax
mov eax, dword [esi]
cmp byte [eax + 0x14], 0
jne 0x4530e6
mov eax, dword [esi]
cmp dword [eax + 0x1d], 0
je 0x4530e6
mov eax, dword [esi]
mov eax, dword [eax + 0x1d]
push eax
mov eax, dword [0x45e484]
mov eax, dword [eax]
call eax
lea edx, [ebp - 8]
mov eax, dword [esi]
call fcn.00452f54
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov edx, dword [0x452b44]
mov eax, dword [esi]
call fcn.00405b3c
cmp dword [ebx], 0
jne 0x45309a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453115
lea eax, [ebp - 8]
call fcn.00404d9c
ret
Function at 0x4533f0
Capabilities:
Delete file

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
sub eax, eax
push ebp
push 0x45354d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
lea edi, [esi + ebx]
mov eax, edi
nop
push 4
nop
pop edx
call fcn.00452b6c
mov dword [ebp - 0x10], eax
mov eax, edi
add eax, dword [ebp + 8]
or eax, eax
jbe 0x453532
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.00452f54
mov eax, dword [ebp - 0x2c]
call fcn.0040525c
push eax
mov eax, dword [0x45e3b4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x453524
push 0
push 0
mov eax, edi
nop
push 4
nop
pop edx
call fcn.00452b6c
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x453517
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x45350a
push edi
pop eax
mov edx, 4
call fcn.00452b6c
push eax
pop edx
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004076d8
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004531b4
pop ecx
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [0x45e484]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x45e484]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x28]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_DeleteFileA
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453554
lea eax, [ebp - 0x2c]
push ecx
pop ecx
push 2
pop edx
call fcn.00404dc0
ret
Function at 0x454020
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
sub ecx, ecx
mov dword [ebp - 8], ecx
xor ecx, ecx
push ebp
push 0x4540f7
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea esi, [edx + 1]
sub esi, 2
test esi, esi
jl 0x4540e1
inc esi
push eax
pop ebx
mov eax, dword [ebx]
mov eax, dword [eax]
mov eax, dword [eax + 4]
xor edx, edx
call fcn.004055d4
jne 0x454067
mov eax, dword [ebx + 4]
mov eax, dword [eax]
dec dword [eax + 0x25]
jmp 0x45406f
mov eax, dword [ebx + 4]
mov eax, dword [eax]
dec dword [eax + 0x21]
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14], 0
jne 0x4540ba
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d], 0
je 0x4540ba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d]
push eax
mov eax, dword [0x45e484]
mov eax, dword [eax]
call eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00452f54
mov eax, dword [ebp - 8]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov edx, dword [0x452b44]
mov eax, dword [ebp - 4]
call fcn.00405b3c
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [eax + 0x25]
add edx, dword [eax + 0x21]
or edx, edx
ja 0x4540e1
add ebx, 4
dec esi
jne 0x45404d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4540fe
lea eax, [ebp - 8]
call fcn.00404d9c
ret
Function at 0x454870
Capabilities:
Get disk information

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffdbc
push ebx
push esi
push edi
sub ecx, ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
push edx
pop edi
mov esi, eax
sub eax, eax
push ebp
push 0x454adc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, 0x200
call fcn.00402a50
push eax
pop ebx
push ebx
push 0x200
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 1
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x454ab5
lea eax, [ebp - 0x11d]
sub ecx, ecx
mov edx, 0x105
call fcn.00403500
lea eax, [ebp - 0x222]
sub ecx, ecx
mov edx, 0x105
call fcn.00403500
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x105
lea eax, [ebp - 0x222]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x105
lea eax, [ebp - 0x11d]
push eax
push ebx
call sub.KERNEL32.DLL_GetVolumeInformationA
lea eax, [ebp - 0x228]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.0040500c
cmp dword [ebp - 0x228], 0
jne 0x45498e
push esi
push edi
mov esi, 0x454aec
lea edi, [ebp - 0x11d]
push 0x41
pop ecx
nop
nop
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [0x45e184]
mov eax, dword [eax]
call eax
mov eax, dword [esi]
mov edx, dword [esi + 4]
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], edx
lea edx, [ebp - 0x22c]
mov eax, 0x454bfc
call fcn.00459098
mov eax, dword [ebp - 0x22c]
call fcn.0040525c
push eax
mov eax, dword [0x45e008]
mov eax, dword [eax]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_LoadLibraryA
push eax
call fcn.00456fc4
mov edx, dword [0x45e35c]
mov dword [edx], eax
push dword [edi]
lea eax, [ebp - 0x230]
push ebx
pop edx
call fcn.00404f94
push dword [ebp - 0x230]
push 0x454c3c
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.0040500c
push dword [ebp - 0x234]
push 0x454c3c
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x238]
call fcn.00408d10
push dword [ebp - 0x238]
push 0x454c3c
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x23c]
call fcn.00408d10
push dword [ebp - 0x23c]
push 0x454c3c
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x222]
mov ecx, 0x105
call fcn.0040500c
push dword [ebp - 0x240]
push 0x454c3c
push ebx
mov eax, dword [0x45e35c]
mov eax, dword [eax]
call eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x244]
call fcn.00408d10
push dword [ebp - 0x244]
push 0x454c3c
mov eax, edi
mov edx, 0xd
call fcn.0040511c
add ebx, 4
cmp byte [ebx], 0
jne 0x4548f0
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454ae3
lea eax, [ebp - 0x244]
nop
nop
push 8
pop edx
call fcn.00404dc0
ret