joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a36fc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416064]
call fcn.00405254
xor eax, eax
push ebp
push 0x4a3840
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bef88], 0
jne 0x4a374f
mov ecx, dword [0x4bf5e8]
mov dl, 1
mov eax, dword [0x408114]
call fcn.0040cea8
call fcn.004042d0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403224
mov eax, ebx
call fcn.00405124
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a3850
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406304
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405134
test eax, eax
jle 0x4a37e7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a37e0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404b1c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404b04
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408f6c
test eax, eax
jne 0x4a37e0
mov ebx, 0x15
jmp 0x4a37ec
mov ebx, 0x10
jmp 0x4a37ec
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4bef88]
call fcn.004a3654
mov eax, dword [ebp - 8]
call fcn.004a3654
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040631c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3847
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004048b8
lea eax, [ebp - 0x10]
mov edx, dword [0x416064]
call fcn.00405324
ret

Function at 0x4ab05c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d54
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ab075
test al, 0x10
jne 0x4ab079
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4ab618
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4ab6e2
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404d54
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4ab6c1
push 0
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4ab6aa
mov edi, dword [ebp - 0xc]
test edi, edi
jbe 0x4ab6af
lea ebx, [ebp - 0x100c]
mov edx, esi
mov al, byte [ebx]
call fcn.004ab5f8
add esi, eax
inc ebx
dec edi
jne 0x4ab699
jmp 0x4ab6af
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1000
je 0x4ab66d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
call fcn.004ab614
mov esi, eax
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab6e9
lea eax, [ebp - 4]
call fcn.00404894
ret

Function at 0x4ad71c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d54
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ad735
test al, 0x10
jne 0x4ad739
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4addfc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4adebf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.00409ccc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4adea9
mov eax, ebx
call fcn.004027ac
mov edi, eax
push edi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4aded0
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4adea2
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x4adea2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], eax
mov eax, edi
call fcn.004027cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adec6
lea eax, [ebp - 4]
call fcn.00404894
ret

Function at 0x4ae5e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4ae651
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404d54
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
test ebx, ebx
jbe 0x4ae63b
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae658
lea eax, [ebp - 4]
call fcn.00404894
ret

Function at 0x4ae660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4ae710
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404d54
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
test esi, esi
jbe 0x4ae6fa
push 0
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4ae6e6
mov edx, dword [ebp - 8]
test edx, edx
jbe 0x4ae6eb
lea eax, [ebp - 0x1008]
xor ecx, ecx
mov cl, byte [eax]
add ebx, ecx
inc eax
dec edx
jne 0x4ae6da
jmp 0x4ae6eb
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1000
je 0x4ae6b1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae717
lea eax, [ebp - 4]
call fcn.00404894
ret
Function at 0x4ae9c0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4aea59
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d54
mov ebx, eax
push ebx
call sub.LZ32.DLL_LZOpenFileA
mov esi, eax
lea eax, [ebp - 0x191]
push eax
push ebx
call sub.LZ32.DLL_GetExpandedNameA
dec eax
jne 0x4aea37
push 0x1000
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x191]
push eax
call sub.LZ32.DLL_LZOpenFileA
mov edi, eax
push edi
push esi
call sub.LZ32.DLL_LZCopy
push edi
call sub.LZ32.DLL_LZClose
push esi
call sub.LZ32.DLL_LZClose
push ebx
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea60
lea eax, [ebp - 4]
call fcn.00404894
ret

Function at 0x4aeb68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aebd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00409e20
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004aea68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aebd9
lea eax, [ebp - 0x10c]
call fcn.00404894
ret
Function at 0x4b00c8
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x103c], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b02d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x4b02ec
call fcn.0040492c
mov esi, dword [ebx + 0x80]
cmp dword [esi + 4], 0
je 0x4b02b5
cmp dword [esi + 8], 0
je 0x4b02b5
lea eax, [ebp - 0x35]
mov edx, 0x4b0324
call fcn.00409ccc
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x18c]
call fcn.00404d54
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
push 1
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 4]
call fcn.00404d54
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b029a
push 1
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 8]
call fcn.00404d54
push eax
push 0x4b032c
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b027d
mov eax, dword [ebx + 0x80]
add eax, 0x14
call fcn.00404894
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xc]
call fcn.00404b54
push eax
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xc]
call fcn.00404d54
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404b54
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404d54
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4b0272
mov dword [ebp - 0x14], 0x1000
cmp dword [ebp - 0x14], 0
jbe 0x4b0272
mov eax, dword [0x4bf908]
mov eax, dword [eax]
call fcn.0046f444
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x1035]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4b0272
cmp dword [ebp - 0x14], 0
jbe 0x4b026c
cmp dword [ebp - 0x14], 0x1000
ja 0x4b026c
mov edi, dword [ebp - 0x14]
dec edi
test edi, edi
jl 0x4b026c
inc edi
lea esi, [ebp - 0x1035]
lea eax, [ebp - 0x103c]
mov dl, byte [esi]
call fcn.00404a7c
mov edx, dword [ebp - 0x103c]
mov eax, dword [ebx + 0x80]
add eax, 0x14
call fcn.00404b5c
inc esi
dec edi
jne 0x4b0247
cmp dword [ebp - 0x14], 0
ja 0x4b0200
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x4b028f
push 0x11
push 5
xor ecx, ecx
mov edx, 0x3b8
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x4b02ac
push 0x10
push 5
xor ecx, ecx
mov edx, 0x3b7
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b02dd
lea eax, [ebp - 0x103c]
call fcn.00404894
lea eax, [ebp - 0x10]
call fcn.00404894
ret
Function at 0x4b2ad8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b2c64
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x179], 0
je 0x4b2b0e
mov dword [ebp - 4], 0xffffffff
jmp 0x4b2c46
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x80]
cmp byte [eax + 0x10], 0
je 0x4b2b7c
mov byte [ebp - 9], 1
cmp word [ebx + 0xea], 0
je 0x4b2b3e
lea ecx, [ebp - 9]
mov edx, ebx
mov eax, dword [ebx + 0xec]
call dword [ebx + 0xe8]
cmp byte [ebp - 9], 0
je 0x4b2b7c
mov eax, ebx
call fcn.004b00c8
mov byte [ebp - 9], 1
cmp word [ebx + 0xe2], 0
je 0x4b2b6a
lea ecx, [ebp - 9]
mov edx, ebx
mov eax, dword [ebx + 0xe4]
call dword [ebx + 0xe0]
cmp byte [ebp - 9], 0
jne 0x4b2b7c
mov dword [ebp - 4], 0xffffffff
jmp 0x4b2c46
cmp byte [ebx + 0x39], 0
je 0x4b2b95
push dword [ebx + 0x15c]
push dword [ebx + 0x158]
mov eax, ebx
call fcn.004b3324
mov ecx, dword [ebx + 0x3c]
mov dl, 1
mov eax, dword [0x432af0]
call fcn.00432ba0
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b2c80
mov edx, 0x4b2c94
mov eax, esi
mov edi, dword [eax]
call dword [edi]
cmp dword [ebp - 8], 0
je 0x4b2bde
push 3
push 0
xor ecx, ecx
mov edx, 0x3ad
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b30a4
cmp dword [ebx + 0x13c], 0
je 0x4b2bf4
cmp byte [ebx + 0x56], 0
je 0x4b2bf4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x40]
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4b2ca4
mov edx, 0x4b2c94
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov eax, ebx
call fcn.004aeeb4
cmp dword [ebp - 8], 0
je 0x4b2c2d
push 1
mov eax, dword [ebp - 8]
call fcn.00404d54
push eax
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.00403a80
push 3
push 0
xor ecx, ecx
mov edx, 0x3b4
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2c6b
lea eax, [ebp - 0x10]
call fcn.00404894
lea eax, [ebp - 8]
call fcn.00404894
ret
Function at 0x4b50d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4b50e6
mov eax, dword [0x4bf908]
mov eax, dword [eax]
call fcn.0046f444
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x15e
jb 0x4b50da
pop ebx
ret

Function at 0x4b6780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4b6828
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x4bf4c0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409e20
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebx]
call fcn.00404b54
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404db4
mov eax, dword [ebp - 0x110]
mov edx, 0x4b683c
call fcn.00404ca0
je 0x4b680f
mov eax, ebx
mov edx, 0x4b683c
call fcn.00404b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b682f
lea eax, [ebp - 0x110]
call fcn.00404894
ret

Function at 0x4b71a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4b7237
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404894
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4b71d4
bt esi, eax
jae 0x4b7216
lea eax, [ebp - 4]
lea edx, [ebx + 0x41]
call fcn.00404a7c
lea eax, [ebp - 4]
mov edx, 0x4b7250
call fcn.00404b5c
mov eax, dword [ebp - 4]
call fcn.00404d54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4b7216
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.00404a7c
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404b5c
inc ebx
cmp ebx, 0x1a
jne 0x4b71ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b723e
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret

Function at 0x4b7254
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4b72ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404894
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4b7288
bt esi, eax
jae 0x4b72ce
lea eax, [ebp - 4]
lea edx, [ebx + 0x41]
call fcn.00404a7c
lea eax, [ebp - 4]
mov edx, 0x4b7308
call fcn.00404b5c
mov eax, dword [ebp - 4]
call fcn.00404d54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4b72ce
test ebx, ebx
je 0x4b72ce
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.00404a7c
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404b5c
inc ebx
cmp ebx, 0x1a
jne 0x4b727e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b72f6
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret
Function at 0x4b83a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b844d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00409e20
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048e8
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebx]
call fcn.00404b54
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404db4
mov eax, dword [ebp - 0x108]
mov edx, 0x4b8464
call fcn.00404ca0
je 0x4b842c
mov eax, ebx
mov edx, 0x4b8464
call fcn.00404b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8454
lea eax, [ebp - 0x108]
call fcn.00404894
lea eax, [ebp - 4]
call fcn.00404894
ret

Function at 0x4b8468
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d44
xor eax, eax
push ebp
push 0x4b8563
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417084]
call fcn.00403a50
mov edi, eax
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4b84af
bt esi, eax
jae 0x4b853c
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.00404a7c
lea eax, [ebp - 8]
mov edx, 0x4b857c
call fcn.00404b5c
mov eax, dword [ebp - 8]
call fcn.00404d54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4b84e4
test ebx, ebx
jne 0x4b850f
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x41]
call fcn.00404a7c
lea eax, [ebp - 0xc]
mov edx, 0x4b857c
call fcn.00404b5c
mov eax, dword [ebp - 0xc]
call fcn.00404d54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4b853c
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x41]
call fcn.00404a7c
push dword [ebp - 0x14]
push 0x4b857c
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404c14
mov edx, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x1a
jne 0x4b84a5
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b856a
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004048b8
ret
Function at 0x4b9190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b9334
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417084]
call fcn.00403a50
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, 2
call fcn.004a30cc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x13c], 0x128
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004a30ec
mov dword [ebp - 8], eax
jmp 0x4b92ea
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b92d9
inc ebx
xor esi, esi
lea ecx, [ebp - 0x144]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408d8c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0x134]
call fcn.004a316c
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
call fcn.00404b1c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00408d8c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404e98
test eax, eax
je 0x4b92d1
push 0
mov eax, dword [ebp - 0x134]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b92d1
lea ecx, [ebp - 0x154]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4b9227
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004a310c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b9211
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b933b
lea eax, [ebp - 0x154]
call fcn.00404894
lea eax, [ebp - 0x150]
call fcn.00404fc8
lea eax, [ebp - 0x14c]
mov edx, 4
call fcn.004048b8
ret
Function at 0x4b9344
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4b934c
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4b957c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417084]
call fcn.00403a50
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, 2
call fcn.004a30cc
mov dword [ebp - 8], eax
mov dword [ebp - 0x140], 0x128
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 8]
call fcn.004a30ec
mov dword [ebp - 4], eax
jmp 0x4b9548
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b9537
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404b04
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409a58
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00408d8c
mov eax, dword [ebp - 0x144]
push eax
lea ecx, [ebp - 0x154]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408d8c
mov edx, dword [ebp - 0x150]
pop eax
call fcn.00404ca0
je 0x4b9487
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404b04
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00408d8c
mov eax, dword [ebp - 0x158]
push eax
lea ecx, [ebp - 0x164]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00408d8c
mov edx, dword [ebp - 0x160]
pop eax
call fcn.00404ca0
jne 0x4b952d
lea ecx, [ebp - 0x16c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00408d8c
mov eax, dword [ebp - 0x168]
mov edx, 0x4b9594
call fcn.00404ca0
jne 0x4b94ef
mov ecx, dword [0x4bf6e8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4b7d24]
call fcn.00467d00
mov dword [ebp - 0x18], eax
mov ecx, 0x4b95ac
mov edx, 0x4b9620
mov eax, dword [ebp - 0x18]
call fcn.004b7f98
cmp eax, 2
je 0x4b952d
mov eax, dword [ebp - 0x18]
call fcn.00403a80
push 0
mov eax, dword [ebp - 0x138]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b952d
lea ecx, [ebp - 0x170]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x4b93ba
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 8]
call fcn.004a310c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b93a4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9583
lea eax, [ebp - 0x170]
mov edx, 0xc
call fcn.004048b8
ret