joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463d5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x463edb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00464078
mov eax, esi
call fcn.00463fe0
test al, al
je 0x463ec2
cmp byte [ebp - 1], 0
jne 0x463db1
mov dl, 1
mov eax, esi
call fcn.004641a0
test al, al
jne 0x463ec2
mov eax, esi
call fcn.00463f6c
test al, al
jne 0x463ec2
push dword [esi + 0x38]
push 0x463ef4
push dword [esi + 0x3c]
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.00403f20
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x202]
call fcn.004083ec
lea eax, [esi + 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d10
lea eax, [esi + 0x4c]
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
xor edx, edx
mov dl, byte [esi + 0x48]
mov dx, word [edx*2 + 0x532e7c]
mov word [eax + 0x30], dx
lea eax, [esi + 0x90]
push eax
lea eax, [esi + 0x4c]
push eax
mov eax, dword [esi + 0xcc]
push eax
push 0
xor eax, eax
mov al, byte [esi + 0x4a]
mov ax, word [eax*2 + 0x532e88]
or ax, 0x10
movzx eax, ax
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x202]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x463e8c
cmp byte [ebp - 1], 1
jne 0x463e8c
mov eax, dword [0x532fe4]
push eax
mov eax, dword [esi + 0x90]
push eax
call sub.user32.dll_WaitForInputIdle
test eax, eax
je 0x463e8a
cmp eax, 0x102
je 0x463e8a
xor ebx, ebx
jmp 0x463e8c
mov bl, 1
test bl, bl
je 0x463e9c
mov dl, byte [ebp - 1]
mov eax, esi
call fcn.00463cf0
jmp 0x463ec2
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x208]
call fcn.0040a728
mov eax, dword [ebp - 0x208]
push eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
mov eax, esi
pop ecx
call fcn.00463ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463ee2
lea eax, [ebp - 0x208]
call fcn.00403be4
ret

Function at 0x463fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46406a
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [esi + 0xcc], eax
cmp dword [esi + 0x44], 0
je 0x464054
mov eax, dword [esi + 0x44]
call fcn.00404024
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46401e
test al, 0x10
jne 0x464022
xor ebx, ebx
jmp 0x464024
mov bl, 1
test bl, bl
je 0x464038
mov eax, dword [esi + 0x44]
call fcn.00404024
mov dword [esi + 0xcc], eax
jmp 0x464054
lea eax, [ebp - 4]
mov edx, 0x532f70
call fcn.00403e04
mov ecx, dword [ebp - 4]
mov edx, 0xfffffffc
mov eax, esi
call fcn.00463ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464071
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x47476c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4747bd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4747a4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x474794
jmp 0x4747bd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4747a5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48191c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
call fcn.0040fbc4
mov esi, eax
xor eax, eax
push ebp
push 0x481996
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x48197a
mov edx, ebx
mov eax, esi
call fcn.0040f6f8
test byte [eax + 0x40], 1
je 0x481974
push 0
mov edx, ebx
mov eax, esi
call fcn.0040f6f8
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.0040f61c
dec ebx
cmp ebx, 0xffffffff
jne 0x481948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48199d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
call fcn.0040fc28
ret

Function at 0x484b0c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x484b3a
mov eax, ebx
call fcn.004855b0
cmp dword [ebx + 0x3c], 0
je 0x484b33
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x484bab
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x484b9d
cmp dword [ebx + 8], 0
je 0x484b5c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x484b6e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x484b9d
cmp dword [ebx + 8], 0
je 0x484b4f
cmp eax, 3
je 0x484b81
dec eax
jne 0x484b4f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x484b4f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x484b4f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x484bc9
cmp dword [ebx + 0x10], 0xcc
je 0x484bc9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00484bd4
pop ebx
ret
Function at 0x49710c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4971cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
call fcn.00404024
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
je 0x497146
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x34]
call fcn.00403c38
jmp 0x49719a
mov eax, dword [ebx + 0x34]
call fcn.00404024
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x497186
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x6c], eax
cmp word [ebx + 0x56], 0
je 0x4971b9
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x34]
mov edx, 0x4971e4
call fcn.00403eac
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x58]
call dword [ebx + 0x54]
jmp 0x4971b9
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x38]
mov edx, dword [esi]
call fcn.00403d98
push dword [ebx + 0x40]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 4]
call fcn.00408534
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x3c]
call fcn.00403c38
mov byte [ebx + 0x70], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4971d6
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x4981d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x498358
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [0x421b48]
call fcn.004030ec
test al, al
je 0x498218
mov eax, esi
call fcn.004278d8
mov dword [ebp - 0x34], eax
jmp 0x498225
mov eax, dword [0x534f4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
mov al, byte [ebx + 0x38]
mov eax, dword [eax*4 + 0x533bb4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x49833a
xor eax, eax
push ebp
push 0x498333
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 0x10]
mov ecx, 0x104
xor edx, edx
call fcn.00403cc8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
call fcn.00404024
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x28]
call fcn.00404024
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
cmp byte [ebx + 0x30], 0
je 0x49829a
or dword [ebp - 0x24], 4
mov eax, 0x498060
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x34]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebx + 0x24], eax
cmp dword [ebp - 8], 0
je 0x498318
xor eax, eax
push ebp
push 0x498311
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00404024
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4982f6
mov eax, dword [ebp - 0x10]
call fcn.00404024
mov edx, eax
lea eax, [ebx + 0x2c]
call fcn.00403d98
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498318
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49833a
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49835f
lea eax, [ebp - 0x14]
call fcn.00404fc0
lea eax, [ebp - 0x10]
call fcn.00403be4
ret
Function at 0x498744
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4987ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x49877c
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x498804
call fcn.00408b18
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x3c]
call fcn.00403c38
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x4987b0
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x498804
call fcn.00408b18
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x40]
call fcn.00403c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4987f5
lea eax, [ebp - 0x24]
call fcn.00403be4
ret

Function at 0x498814
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4988ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4988bc
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
xor eax, eax
push ebp
push 0x498891
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004026e0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408534
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x24]
call fcn.00403c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498898
mov eax, dword [ebp - 4]
call fcn.004026f8
ret

Function at 0x4988c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49895a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x498968
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x32
xor eax, eax
push ebp
push 0x49893d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004026e0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408534
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x28]
call fcn.00403c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498944
mov eax, dword [ebp - 4]
call fcn.004026f8
ret
Function at 0x4a7398
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7444
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x118]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a7424
inc eax
mov dword [ebp - 8], eax
xor esi, esi
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a741e
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebx + 0x118]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ax, word [eax + 4]
call fcn.0042e354
test al, al
je 0x4a741e
mov edx, esi
mov eax, ebx
call fcn.00469108
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
mov eax, ebx
mov bx, 0xffda
call fcn.00403150
jmp 0x4a742e
inc esi
dec dword [ebp - 8]
jne 0x4a73cf
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00426d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a744b
lea eax, [ebp - 0xc]
call fcn.00403be4
ret
Function at 0x4b39d8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b3a29
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b3a10
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b3a00
jmp 0x4b3a29
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b3a11
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6fd8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x114]
mov edx, dword [ebp + 8]
add eax, dword [edx - 0x118]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x11c]
jl 0x4b70b5
mov eax, dword [ebp + 8]
cmp byte [eax - 0x11d], 0
je 0x4b701a
mov dword [ebp - 4], 0xffffffff
jmp 0x4b713a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x124]
mov edx, dword [ebp + 8]
mov al, byte [edx + eax - 0x110]
mov edx, dword [ebp + 8]
mov byte [edx - 0x10e], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x124]
mov edx, dword [ebp + 8]
mov al, byte [edx + eax - 0x10f]
mov edx, dword [ebp + 8]
mov byte [edx - 0x10d], al
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffef4
call fcn.004b6f64
pop ecx
xor al, 1
mov edx, dword [ebp + 8]
mov byte [edx - 0x11d], al
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 5]
add eax, 2
mov edx, dword [ebp + 8]
mov dword [edx - 0x124], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x114]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 0x11c]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx - 0x114], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x124]
shl eax, 3
mov edx, dword [ebp + 8]
mov dword [edx - 0x11c], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x114]
mov edx, eax
shr edx, 3
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx - 0x10e]
mov dword [ebp - 8], edx
and eax, 7
movzx edx, word [eax*2 + 0x533f44]
mov ebx, 1
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 0x118]
dec ecx
test ecx, ecx
jl 0x4b7128
inc ecx
test dword [ebp - 8], edx
jle 0x4b7100
or dword [ebp - 4], ebx
add edx, edx
add ebx, ebx
inc eax
cmp eax, 8
jl 0x4b7125
xor eax, eax
mov edx, 1
inc dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
movzx esi, byte [esi + edi - 0x10e]
mov dword [ebp - 8], esi
dec ecx
jne 0x4b70f8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x118]
mov edx, dword [ebp + 8]
add dword [edx - 0x114], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eda78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4edc0f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004ed724
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040bb28
cmp al, 2
jne 0x4edabe
dec esi
mov eax, ebx
call fcn.004ed9e8
test al, al
je 0x4edbaf
test esi, esi
jge 0x4edad3
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004ed724
mov eax, dword [ebp - 0x204]
call fcn.00403e60
cmp edi, eax
jge 0x4edb1a
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004ed724
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x5350e8]
and eax, 0xff
bt dword [edx], eax
jae 0x4edb1a
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x4edb28
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.004eda54
cmp edi, esi
je 0x4edba7
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x4edb4e
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.004278d8
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.004278d8
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x4edbf6
test esi, esi
jge 0x4edbb5
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004ed724
mov eax, dword [ebp - 0x204]
call fcn.00403e60
cmp esi, eax
jl 0x4edbeb
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004ed724
mov eax, dword [ebp - 0x204]
call fcn.00403e60
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.004eda54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edc16
lea eax, [ebp - 0x204]
call fcn.00403be4
ret

Function at 0x4fdc4c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fdd21
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4fdd01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xff
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00403d88
lea eax, [ebp - 0x118]
mov edx, 0x4fdd38
call fcn.00403e68
mov eax, dword [ebp - 0x118]
call fcn.00404024
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4fdcea
mov eax, esi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00403e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdd08
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4fdd3c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fddc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor esi, esi
mov ebx, esi
add bl, 0x41
mov eax, esi
cmp eax, 0x1f
ja 0x4fdd7e
bt edi, eax
jae 0x4fdda9
mov eax, ebx
call fcn.004fdbe0
cmp al, 7
ja 0x4fdd92
and eax, 0x7f
bt dword [ebp - 5], eax
jae 0x4fdda9
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403d88
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
cmp esi, 0x1a
jne 0x4fdd6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fddcc
lea eax, [ebp - 0xc]
call fcn.00403be4
ret

Function at 0x4fddd4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404014
xor eax, eax
push ebp
push 0x4fde83
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x160
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, ebx
call fcn.00402d10
push 0x101
push ebx
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404024
push eax
call sub.shell32.dll_SHGetFileInfoA
mov al, byte [ebp + 8]
sub al, 1
jb 0x4fde39
je 0x4fde54
jmp 0x4fde6d
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x160]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [0x53708c]
call fcn.00428fa0
jmp 0x4fde6d
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x160]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [0x537088]
call fcn.00428fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fde8a
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x4fde94
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
lea edi, [ebp - 0x20]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404014
xor eax, eax
push ebp
push 0x4fe0b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4fe0cc
mov edx, dword [ebp - 4]
call fcn.00403eac
lea eax, [ebp - 0xc]
mov ecx, 0x4fe0d8
mov edx, dword [ebp - 4]
call fcn.00403eac
cmp byte [ebp + 0x18], 0
jne 0x4fdfa1
cmp byte [ebp + 0x1c], 0
je 0x4fdf57
mov eax, dword [ebp - 8]
mov al, byte [eax]
call fcn.004fdbe0
cmp al, 2
je 0x4fdf57
cmp byte [ebp + 0x14], 0
je 0x4fdf26
lea eax, [ebp - 8]
mov edx, 0x4fe0e4
call fcn.00403e68
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 8]
mov al, byte [eax]
call fcn.004fdc4c
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 8]
call fcn.00403e68
cmp byte [ebp + 0x14], 0
je 0x4fdf57
lea eax, [ebp - 8]
mov edx, 0x4fe0f0
call fcn.00403e68
mov al, byte [ebp + 0xc]
sub al, 1
jb 0x4fdf65
je 0x4fdf83
jmp 0x4fdfe5
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 8]
call fcn.00407858
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 8]
call fcn.00403c7c
jmp 0x4fdfe5
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 8]
call fcn.0040781c
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 8]
call fcn.00403c7c
jmp 0x4fdfe5
mov edi, 0x160
lea eax, [ebp - 0x180]
xor ecx, ecx
mov edx, edi
call fcn.00402d10
push 0x200
push edi
lea eax, [ebp - 0x180]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404024
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 8]
lea edx, [ebp - 0x174]
mov ecx, 0x104
call fcn.00403e10
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00419078
inc dword [ebp - 0x1c]
dec dword [ebp - 0x14]
add dword [ebp - 0x20], 2
cmp byte [ebp + 0x10], 0
je 0x4fe05b
mov al, byte [ebp + 8]
sub al, 1
jb 0x4fe00a
je 0x4fe028
jmp 0x4fe044
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edx, eax
sub edx, 0x10
sar edx, 1
jns 0x4fe01c
adc edx, 0
add edx, eax
mov dword [ebp - 0x10], edx
mov esi, 0x14
jmp 0x4fe044
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edx, eax
sub edx, 0x20
sar edx, 1
jns 0x4fe03a
adc edx, 0
add edx, eax
mov dword [ebp - 0x10], edx
mov esi, 0x24
mov eax, dword [ebp - 0x10]
push eax
mov al, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004fddd4
jmp 0x4fe060
mov esi, 2
add dword [ebp - 0x20], esi
push 0x824
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e60
push eax
mov eax, dword [ebp - 8]
call fcn.00404024
push eax
mov eax, ebx
call fcn.004195e4
push eax
call sub.user32.dll_DrawTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe0b8
lea eax, [ebp - 0x184]
call fcn.00403be4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c08
ret