joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485054
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_PostQueuedCompletionStatus
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0x42000000
push 3
push 0
push 7
push 0xc0000000
mov eax, dword [esi + 0x68]
call fcn.004058cc
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
mov eax, esi
call fcn.00485048
mov dword [esi + 0x44], edi
mov eax, esi
call fcn.004851dc
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4850c3
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
jne 0x4850dd
mov eax, esi
call fcn.00485048
xor eax, eax
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x70], eax
mov eax, esi
call fcn.004851dc
jmp 0x485152
push 0
mov eax, dword [esi + 4]
push eax
push 0
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CreateIoCompletionPort
mov ebx, eax
mov eax, esi
call fcn.00485048
mov dword [esi + 0x70], ebx
mov eax, esi
call fcn.004851dc
xor eax, eax
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x90]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403b50
push 0
lea eax, [esi + 0x74]
push eax
lea eax, [esi + 0x8c]
push eax
mov eax, dword [esi + 0x88]
push eax
cmp byte [esi + 0x6c], 1
cmc
sbb eax, eax
push eax
push 0x1000
lea eax, [esi + 0x90]
push eax
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_ReadDirectoryChangesW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4874fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x48755a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004875d8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x487542
lea eax, [ebp - 4]
call fcn.004875d8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x487544
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487561
lea eax, [ebp - 4]
call fcn.0040543c
ret

Function at 0x487568
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x4875cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004875d8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b28c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4875d3
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x487b8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x487c85
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0048728c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ae18
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0048855c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040acd8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004885d4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487c8c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405460
ret
Function at 0x487c94
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x487d9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0048728c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x487d63
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ae18
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0048855c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040acd8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004885d4
jmp 0x487d75
xor edx, edx
mov eax, ebx
call fcn.0048855c
xor edx, edx
mov eax, ebx
call fcn.004885d4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487da4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405460
ret

Function at 0x48e68c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0048e8c8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0048e8c8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x48e700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x48e726
inc esi
mov eax, edi
call fcn.0048e6e4
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.0048e68c
inc ebx
dec esi
jne 0x48e70f
pop edi
pop esi
pop ebx
ret
Function at 0x48e7bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x48e832
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0048e72c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0048e6e4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0048e68c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x48e7fc
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e839
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x48f4cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48f6b2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x48f66e
mov eax, dword [ebp - 4]
call fcn.00490e74
cmp ebx, eax
jge 0x48f66e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00485ac0
mov edx, dword [0x48762c]
call fcn.0040470c
mov esi, eax
mov eax, esi
call fcn.004884f0
test al, al
je 0x48f664
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x48f658
xor eax, eax
push ebp
push 0x48f651
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048fa84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041d570
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.0040592c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0048f848
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f69c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x48f650
mov eax, dword [ebp - 4]
call fcn.0048fb08
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b28c
jmp 0x48f69c
mov eax, dword [ebp - 8]
call fcn.0040543c
jmp 0x48f69c
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a660
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4181f8]
call fcn.0040e9a0
call fcn.00404dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f6b9
lea eax, [ebp - 0x54]
call fcn.0040543c
ret
Function at 0x4b1ae8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b1b42
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b1ad8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004af730
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004af248
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1b49
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x4ba4f8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b50
ret

Function at 0x4ba8e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4bab5b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4bab70
call fcn.004ba74c
lea eax, [ebp - 0x3f0]
call fcn.0040543c
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004058cc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4bab1c
xor eax, eax
push ebp
push 0x4bab15
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4babb0
call fcn.004ba74c
mov eax, dword [ebp - 0x408]
call fcn.004058cc
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ba9e7
push ebp
mov eax, 0x4babdc
call fcn.004ba83c
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x4babe8
call fcn.004ba74c
mov eax, dword [ebp - 0x40c]
call fcn.004058cc
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4baa71
push dword [ebp - 0x3f0]
push 0x4bac10
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004056ac
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004057d0
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x4bac1c
call fcn.004ba74c
mov eax, dword [ebp - 0x414]
call fcn.004058cc
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4baafb
push dword [ebp - 0x3f0]
push 0x4bac10
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004056ac
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004057d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bab1c
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.00405490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bab62
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.00405460
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.00405460
ret
Function at 0x4beef4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x4bf035
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bf005
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004058cc
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a884
test al, al
jne 0x4bef75
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.004038ac
lea eax, [ebp - 0x1d0]
call fcn.00403648
call fcn.004030e4
push dword [0x558d94]
push 0x4bf04c
push dword [0x558d98]
push 0x4bf04c
push dword [0x558d9c]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004057d0
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004c307c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405bec
call fcn.00403fa4
call fcn.004030e4
lea eax, [ebp - 0x1d0]
call fcn.00403974
call fcn.004030e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf00f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf03c
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405460
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x4c04fc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4c0664
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004bfd6c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004bfd8c
mov ebx, eax
jmp 0x4c0636
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004056ac
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ae18
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409994
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409994
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405864
je 0x4c0616
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004056ac
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409994
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409994
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405864
jne 0x4c062b
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004bfdac
mov ebx, eax
test ebx, ebx
jne 0x4c0577
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c066b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405460
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x4c0a13
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4c0a6d
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x4c0a68
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x4c0a67
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4c0a34
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c18f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x4c19ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4c19e0
mov edx, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.004058cc
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4c193a.0
jmp dword [eax*4 + 0x4c1941]
mov eax, ebx
mov edx, 0x4c19ec
call fcn.00405490
jmp 0x4c19af
mov eax, ebx
mov edx, 0x4c1a00
call fcn.00405490
jmp 0x4c19af
mov eax, ebx
mov edx, 0x4c1a10
call fcn.00405490
jmp 0x4c19af
mov eax, ebx
mov edx, 0x4c1a24
call fcn.00405490
jmp 0x4c19af
mov eax, ebx
mov edx, 0x4c1a34
call fcn.00405490
jmp 0x4c19af
mov eax, ebx
mov edx, 0x4c1a48
call fcn.00405490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c19d1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405460
ret
Function at 0x4c1c88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
xor edx, edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
lea eax, [ebp - 0x168]
mov edx, dword [0x408b40]
call fcn.00405ef4
xor eax, eax
push ebp
push 0x4c1e50
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x4c1e14
mov eax, dword [ebp - 4]
call fcn.0040a8a8
test al, al
je 0x4c1e14
mov eax, dword [ebp - 4]
test eax, eax
je 0x4c1cfb
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4c1d12
lea eax, [ebp - 4]
mov edx, 0x4c1e68
call fcn.00405708
lea eax, [ebp - 8]
mov ecx, 0x4c1e74
mov edx, dword [ebp - 4]
call fcn.00405754
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040ab2c
test eax, eax
jne 0x4c1df8
mov eax, dword [ebp - 0x154]
mov edx, 0x4c1e80
call fcn.00405864
je 0x4c1dda
mov eax, dword [ebp - 0x154]
mov edx, 0x4c1e8c
call fcn.00405864
je 0x4c1dda
test byte [ebp - 0x158], 0x10
je 0x4c1d91
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 0x16c]
call fcn.004c1c88
test al, al
jmp 0x4c1dda
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 0x170]
mov edx, 0x80
call fcn.0040aa80
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 0x174]
call fcn.004058cc
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040ab7c
test eax, eax
je 0x4c1d3d
lea eax, [ebp - 0x168]
call fcn.0040aba0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040aa80
mov eax, dword [ebp - 4]
call fcn.0040b034
test al, al
je 0x4c1e12
mov bl, 1
jmp 0x4c1e14
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1e57
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00405460
lea eax, [ebp - 0x168]
mov edx, dword [0x408b40]
call fcn.00405fc4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405460
ret