joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8370
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x4c8479
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004c796c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4c843f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040db0c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c8c38
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040d9cc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c8cb0
jmp 0x4c8451
xor edx, edx
mov eax, ebx
call fcn.004c8c38
xor edx, edx
mov eax, ebx
call fcn.004c8cb0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8480
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405608
ret
Function at 0x4cba80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cbbf1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cbbcc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004057cc
lea eax, [ebp - 0x118]
mov edx, 0x4cbc08
call fcn.004058b0
mov eax, dword [ebp - 0x118]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4cbb3e
lea eax, [ebp - 0x111]
call fcn.0040dcc4
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004056d4
jmp 0x4cbb45
mov eax, esi
call fcn.004055e4
cmp bl, 0x61
jae 0x4cbb66
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.00412950
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405638
jmp 0x4cbb80
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.004128bc
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405638
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4cbc14
call fcn.0040e7b8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbd3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4d4888
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004d4ac4
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004d4ac4
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4d48fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4d4922
inc esi
mov eax, edi
call fcn.004d48e0
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004d4888
inc ebx
dec esi
jne 0x4d490b
pop edi
pop esi
pop ebx
ret
Function at 0x4d49b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x4d4a2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004d4928
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004d48e0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004d4888
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4d49f8
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4a35
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x4d56c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d58ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4d586a
mov eax, dword [ebp - 4]
call fcn.004d709c
cmp ebx, eax
jge 0x4d586a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c6174
mov edx, dword [0x4c7d08]
call fcn.00404854
mov esi, eax
mov eax, esi
call fcn.004c8bcc
test al, al
je 0x4d5860
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4d5854
xor eax, eax
push ebp
push 0x4d584d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d5c80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00421110
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405d04
mov eax, dword [ebp - 8]
call fcn.00405ad4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d5a44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5898
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4d584c
mov eax, dword [ebp - 4]
call fcn.004d5d04
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040df2c
jmp 0x4d5898
mov eax, dword [ebp - 8]
call fcn.004055e4
jmp 0x4d5898
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040d2f0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41b7e8]
call fcn.00411a78
call fcn.00404f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d58b5
lea eax, [ebp - 0x54]
call fcn.004055e4
ret
Function at 0x4dbea4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4dc0b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5826f8]
cmp dword [eax + 0x26c], 0
jle 0x4dc092
mov eax, dword [0x5826f8]
cmp dword [eax + 0x268], 0
jle 0x4dc092
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x4dc0c4
call fcn.0040e7b8
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x582d10]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 4]
call fcn.0040d554
test al, al
je 0x4dbf3d
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040d554
test al, al
je 0x4dbf3d
inc ebx
jmp 0x4dbee7
mov eax, dword [0x5826f8]
mov eax, dword [eax + 0x268]
cdq
push edx
push eax
mov eax, dword [0x582ad4]
mov eax, dword [eax]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c2a0]
call fcn.004215c4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4dbfb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5826f8]
mov eax, dword [eax + 0x26c]
cdq
push edx
push eax
mov eax, dword [0x582ad4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.004dbd9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbfb8
mov eax, dword [ebp - 8]
call fcn.004046a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc0b7
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x4dc32c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x57b390
mov ecx, 0x48
call fcn.004035b8
lea edx, [ebp + 0x48]
mov eax, 0x57b3d8
mov ecx, 0x1000
call fcn.004035b8
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x4dc386
xor edi, edi
dec eax
jne 0x4dc374
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x4dc36d
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004dc408
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x4dc3a4
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004dc408
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x4dc3cf
add ebx, 0x400
dec edi
jne 0x4dc3cd
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dc408
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.004035b8
cmp byte [esp], 0
je 0x4dc4ac
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4dc436
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4dc529
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4dc4b7
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4dcd0c
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.004035b8
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.004035b8
add esp, 0x58
pop ebx
ret

Function at 0x4dd7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x57c418
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call sub.kernel32.dll_GetLocalTime
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
movzx eax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
movzx edx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x4dd7d0
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e0768
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4e089f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x4e07c7
lea edx, [ebp - 0x100c]
mov eax, dword [0x582450]
call fcn.00407974
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x40b754]
call fcn.00411a3c
call fcn.00404f18
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x4e081f
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x4e07f4
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x4e081a
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x4e0807
inc esi
add ecx, esi
jmp 0x4e0829
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x4e085f
lea edx, [ebp - 0x1010]
mov eax, dword [0x582450]
call fcn.00407974
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x40b754]
call fcn.00411a3c
call fcn.00404f18
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004035b8
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.004035b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e08a6
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405608
ret

Function at 0x4e2780
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e282b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004055e4
mov esi, 3
lea ebx, [esi + 0x41]
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403d1c
mov edx, 0x4e283c
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4e2807
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004057cc
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004058b0
inc esi
cmp esi, 0x1a
jne 0x4e27ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2832
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x4e2e0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4e2e9c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405854
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 4]
call fcn.004127e8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2ea3
lea eax, [ebp - 0x114]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x4f1dac
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x57e7b0], 0
mov eax, dword [0x58316c]
cmp dword [eax], 2
jne 0x4f1f85
mov eax, dword [0x5827f0]
cmp dword [eax], 5
jl 0x4f1f85
call fcn.004e9a04
test al, al
jne 0x4f1ddd
call fcn.004e9a10
call fcn.004e99fc
mov dword [0x57e7b8], eax
push 0x4f1f88
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e77c], eax
cmp dword [0x57e77c], 0
jne 0x4f1e38
mov edx, 0x8000
mov eax, 0x4f1f9c
call fcn.00413938
mov dword [0x57e7b4], eax
mov eax, dword [0x57e7b4]
mov dword [0x57e7b8], eax
push 0x4f1f88
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e77c], eax
cmp dword [0x57e77c], 0
je 0x4f1f80
push 0x4f1fa8
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e780], eax
cmp dword [0x57e780], 0
je 0x4f1f80
push 0x4f1fb4
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e784], eax
cmp dword [0x57e784], 0
je 0x4f1f80
mov byte [0x57e7b0], 1
push 0x4f1fc4
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e788], eax
push 0x4f1fd0
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e78c], eax
push 0x4f1fdc
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e790], eax
push 0x4f1fec
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e794], eax
push 0x4f1ffc
mov eax, dword [0x57e7b8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e798], eax
mov edx, 0x8000
mov eax, 0x4f2014
call fcn.00413938
mov dword [0x57e7bc], eax
cmp dword [0x57e7bc], 0
je 0x4f1f85
push 0x4f2024
mov eax, dword [0x57e7bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e79c], eax
push 0x4f2040
mov eax, dword [0x57e7bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e7a0], eax
push 0x4f2060
mov eax, dword [0x57e7bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e7a4], eax
push 0x4f207c
mov eax, dword [0x57e7bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e7a8], eax
push 0x4f2094
mov eax, dword [0x57e7bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e7ac], eax
ret
call fcn.004f1d2c
ret
Function at 0x4f467c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f47a4
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004f4568
mov eax, dword [esi]
call fcn.00406a2c
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4e4b9c]
call fcn.00406be8
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004035b8
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004035b8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00406a2c
mov dword [ebp - 0xc], eax
mov eax, dword [0x582fb4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004e683c
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403e38
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00406a2c
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004e6758
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.004e656c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004e6834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f47ab
lea eax, [ebp - 4]
mov edx, dword [0x4e4b9c]
call fcn.00406ce8
ret

Function at 0x50a588
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00405d04
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x50a5ad
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x50a5cc
mov eax, ebx
mov edx, dword [esp]
call fcn.00405d04
pop ecx
pop edx
pop ebx
ret

Function at 0x50e8f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x50e94e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0050e8e8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0050d114
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0050cd2c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e955
lea eax, [ebp - 4]
call fcn.004055e4
ret