joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475f40
Capabilities:
Create process on windows
Enumerate gui resources
Get thread local storage value

Disassembly:
sub esp, 0x160
mov al, byte [0x526974]
push ebp
push esi
push edi
mov byte [esp + 0x6c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
mov ecx, dword [0x5298e0]
stosw word es:[edi], ax
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x475f83
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x160
ret
push ebx
mov ebx, dword [esp + 0x174]
mov eax, ebx
lea edx, [esi + 0xad8]
neg eax
sbb eax, eax
push edx
and al, 0xf5
lea ecx, [esp + 0x74]
add eax, 0x6e
push eax
push str.dzprog32.exe___c__z__T_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esi + 0xad4], ebp
mov dword [esi + 0xad0], ebp
mov dword [esi + 0xac8], ebp
rep stosd dword es:[edi], eax
mov eax, 1
add esp, 0x10
mov word [esp + 0x5c], ax
mov dword [esp + 0x58], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
push eax
push ebp
push ebp
push 0x20
push ebp
push ebp
lea ecx, [esp + 0x8c]
push ebp
push ecx
push ebp
mov dword [esp + 0x54], 0x44
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x47605f
mov edx, dword [esp + 0x1c]
push 0x2710
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
push edx
push 0x475f00
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x47605f
mov edi, 1
mov dword [esi + 0xad0], eax
mov dword [esi + 0xac8], edi
mov dword [esi + 0xad4], ebx
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x160
ret

Function at 0x476070
Capabilities:
Check for time delay via gettickcount
Get thread local storage value

Disassembly:
mov eax, dword [0x5298e0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x476100
mov eax, dword [esi + 0xad0]
test eax, eax
je 0x476100
push ebx
push ebp
push edi
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [esi + 0xad0]
mov ebp, eax
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4760e8
test edi, edi
jne 0x4760e8
push esi
call fcn.00476250
add esp, 4
call ebx
sub eax, ebp
cmp eax, 0x1388
jbe 0x4760d7
mov edi, 1
mov edx, dword [esi + 0xad0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4760ba
xor eax, eax
pop edi
pop ebp
mov dword [esi + 0xac8], eax
mov dword [esi + 0xad4], eax
pop ebx
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x477e50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov eax, dword [ebx + 0x4e88]
push edi
test eax, eax
jne 0x477e93
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [ebx + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x477ed6
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x477f1a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 1
jne 0x477e8c
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [ebx + 0x2c]
lea ecx, [esp + 0x14]
shr eax, 1
push 0
push ecx
lea edi, [esi + eax]
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x477ed6
mov ebp, dword [esp + 0x14]
test ebp, ebp
mov dword [esp + 0x18], ebp
je 0x477e8c
mov al, byte [edi]
cmp al, 0xa
jne 0x477eed
mov byte [esi], 0xd
inc esi
mov byte [esi], al
jmp 0x477f02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x477e8c
pop edi
pop esi
mov dword [ebx], 0xb
pop ebp
xor eax, eax
pop ebx
ret
mov byte [esi], al
mov al, byte [edi]
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x477f04
mov cl, byte [edi + 1]
mov byte [esi], cl
inc esi
inc ebp
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jne 0x477ec8
sub esi, ebp
push ebx
push ebp
push esi
call fcn.00478510
mov edx, dword [ebx + 0x38]
add esp, 0xc
add edx, ebp
mov dword [ebx + 0xc050], eax
mov eax, dword [ebx + 0xc04c]
mov dword [ebx + 0x38], edx
mov ecx, dword [ebx + 0x3c]
adc ecx, 0
test eax, eax
mov dword [ebx + 0x3c], ecx
jne 0x477f57
mov eax, dword [ebx + 0x38]
mov edx, ecx
mov ecx, dword [ebx + 0x44]
push edx
mov edx, dword [ebx + 0x40]
push eax
push ecx
push edx
jmp 0x477f5f
push 0
push 0
push 0
push 0x64
add ebx, 0xb84c
push ebx
call fcn.004745b0
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x478510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
jne 0x478520
or eax, 0xffffffff
pop esi
not eax
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, edx
dec edx
mov eax, dword [eax + 0xc050]
test esi, esi
not eax
je 0x47855a
push edi
lea esi, [edx + 1]
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x51f3bc]
xor eax, edx
inc ecx
dec esi
jne 0x47853b
pop edi
not eax
pop esi
ret
Function at 0x47d1b0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x810
test eax, eax
push esi
push edi
je 0x47d245
add al, 0x40
push 0x51f8e8
mov byte [esp + 0xc], al
lea eax, [esp + 0xd]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x828]
lea ecx, [esp + 0x18]
push 0x800
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
lea esi, [edi + 0xc060]
push ecx
push 0x800
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x47d245
push edi
push 0
push 0
push 0
call fcn.0047ded0
mov ecx, dword [esp + 0x830]
mov edx, dword [esp + 0x834]
add esp, 0x10
mov dword [ecx], eax
mov eax, esi
pop edi
mov dword [edx], 8
pop esi
add esp, 0x810
ret
pop edi
xor eax, eax
pop esi
add esp, 0x810
ret

Function at 0x47e180
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x24
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
call fcn.00478e80
mov ebp, dword [esp + 0x44]
add esp, 8
test eax, eax
jne 0x47e1c1
cmp word [esp + 0x18], 1
jg 0x47e1d1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x47e1c1
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x47e260
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x47e200
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x24
ret
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push ebp
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x47e230
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
mov ecx, dword [esp + 0x40]
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
push edi
call fcn.0047e380
add esp, 0x14
mov ebx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
test eax, eax
jne 0x47e26a
test ebx, ebx
jne 0x47e26a
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x47e280
cmp ebx, 0xa
mov eax, ebx
jne 0x47e262
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
add esp, 0x24
ret
Function at 0x47e380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x40000
call fcn.004adbfa
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x47e3ab
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
xor esi, esi
xor ebp, ebp
mov eax, edi
and eax, ebx
cmp eax, 0xffffffff
je 0x47e3ee
cmp ebp, ebx
jg 0x47e48a
jl 0x47e3d2
cmp esi, edi
jae 0x47e48a
mov ecx, edi
mov eax, ebx
sub ecx, esi
sbb eax, ebp
test eax, eax
jg 0x47e3ee
jl 0x47e3e8
cmp ecx, 0x40000
jae 0x47e3ee
mov eax, edi
sub eax, esi
jmp 0x47e3f3
mov eax, 0x40000
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push edx
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47e46c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47e486
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 0
push ecx
push eax
mov eax, dword [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47e4b7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jne 0x47e4b7
mov edx, dword [esp + 0x30]
push edx
call fcn.00474890
mov eax, dword [esp + 0x34]
add esp, 4
mov ecx, dword [eax + 0xa0]
test ecx, ecx
jne 0x47e49d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add esi, ecx
adc ebp, 0
jmp 0x47e3b7
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004ad74d
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call fcn.004ad74d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call fcn.004ad74d
add esp, 4
mov eax, 9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.004ad74d
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x47e4e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x2800
call fcn.004ad6f0
mov eax, dword [esp + 0x2804]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1810]
push eax
push ecx
call edi
lea edx, [esp + 0x1810]
push edx
call fcn.00478590
push 0
lea eax, [esp + 0x1018]
push 0
lea ecx, [esp + 0x201c]
push eax
lea edx, [esp + 0x1820]
push ecx
push edx
call fcn.004835b0
push 0
lea eax, [esp + 0x102c]
push 0
lea ecx, [esp + 0x2030]
push eax
lea edx, [esp + 0x834]
push ecx
push edx
call fcn.00483760
add esp, 0x2c
lea eax, [esp + 0x810]
lea ecx, [esp + 0x1010]
push eax
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0x810]
push 0x5c
push edx
call fcn.00483480
test eax, eax
je 0x47e5a4
mov byte [eax], 0
lea eax, [esp + 0x810]
push eax
call esi
cmp eax, 0xffffffff
je 0x47e570
lea ecx, [esp + 0x810]
lea edx, [esp + 0x10]
push ecx
push edx
jmp 0x47e5b1
lea eax, [esp + 0x810]
lea ecx, [esp + 0x10]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
push 0x51cdf4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1010]
lea ecx, [esp + 0x810]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x10]
push edx
call ebx
mov esi, eax
lea eax, [esp + 0x810]
push eax
call ebx
cmp esi, eax
jge 0x47e684
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
lea edi, [esp + eax + 0x10]
push edx
call ebx
lea esi, [esp + eax + 0x810]
mov al, byte [esp + eax + 0x810]
test al, al
je 0x47e645
cmp al, 0x5c
je 0x47e645
mov byte [edi], al
mov al, byte [esi]
push eax
inc edi
call ebp
test eax, eax
je 0x47e636
mov cl, byte [esi + 1]
mov byte [edi], cl
inc edi
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x47e620
lea edx, [esp + 0x10]
push 0
push edx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x47e691
lea eax, [esp + 0x10]
push 0x51cdf4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x810]
mov esi, eax
push edx
call ebx
cmp esi, eax
jl 0x47e5fc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2800
ret
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x2800
ret
Function at 0x47ec90
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
test eax, eax
mov esi, 1
jl 0x47ed0a
jg 0x47ecad
cmp ebp, 0xffffffff
jbe 0x47ed0a
xor edi, edi
xor ebx, ebx
cmp ebx, eax
jg 0x47ed3c
jl 0x47ecbf
cmp edi, ebp
jae 0x47ed3c
mov ecx, ebp
mov esi, 0x8000
sub ecx, edi
sbb eax, ebx
test eax, eax
jg 0x47ecd8
jl 0x47ecd4
cmp ecx, esi
jae 0x47ecd8
mov esi, ebp
sub esi, edi
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x24]
lea edx, [edi + ecx]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47ed2c
mov eax, dword [esp + 0x10]
cmp eax, esi
jne 0x47ed2c
add edi, eax
mov eax, dword [esp + 0x28]
adc ebx, 0
jmp 0x47ecb1
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47ed2c
cmp dword [esp + 0x10], ebp
je 0x47ed34
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x480da0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x30]
push edi
mov eax, dword [esi + 0x92c]
test eax, eax
mov eax, dword [esi + 0xa8]
je 0x480ec3
cmp eax, 0xffffffff
push esi
jne 0x480e53
mov edi, dword [esp + 0x34]
push 0
push 0x18
push edi
push 0
call fcn.00483e80
add esp, 0x14
test eax, eax
je 0x480df3
mov eax, dword [esi + 0xa0]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov eax, dword [edi]
push ecx
lea edx, [esp + 0x10]
push 0x18
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x480e48
cmp dword [esp + 0x34], 0x18
je 0x480fb9
mov eax, 0xa
pop edi
pop esi
add esp, 0x20
ret
call fcn.00484710
add esp, 4
test edx, edx
jg 0x480e7a
jl 0x480e66
cmp eax, 0x18
jae 0x480e7a
mov ecx, dword [esp + 0x30]
push esi
push ecx
push 0
call fcn.00484830
add esp, 0xc
test eax, eax
jne 0x480e4d
mov eax, dword [esp + 0x2c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x1c]
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xa8]
push eax
lea ecx, [esp + 0x10]
push 0x18
push ecx
push edx
jmp 0x480e33
cmp eax, 0xffffffff
push esi
jne 0x480f3f
mov edi, dword [esp + 0x34]
push 0
push 0x10
push edi
push 0
call fcn.00483e80
add esp, 0x14
test eax, eax
je 0x480ef5
mov eax, dword [esi + 0xa0]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov eax, dword [edi]
push ecx
lea edx, [esp + 0x10]
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x480e48
cmp dword [esp + 0x34], 0x10
jmp 0x480e42
call fcn.00484710
add esp, 4
test edx, edx
jg 0x480f6a
jl 0x480f52
cmp eax, 0x10
jae 0x480f6a
mov ecx, dword [esp + 0x30]
push esi
push ecx
push 0
call fcn.00484830
add esp, 0xc
test eax, eax
jne 0x480e4d
mov eax, dword [esp + 0x2c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x18]
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0xa8]
push eax
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x480e48
cmp dword [esp + 0x34], 0x10
jne 0x480e48
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x480fd0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], 0x8074b50
mov eax, dword [esi + 0xa8]
push esi
cmp eax, 0xffffffff
jne 0x481040
mov edi, dword [esp + 0x14]
push 0
push 4
push edi
push 0
call fcn.00483e80
add esp, 0x14
test eax, eax
je 0x481015
mov eax, dword [esi + 0xa0]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
pop ecx
ret
mov edx, dword [edi]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x10]
push 4
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x481037
cmp dword [esp + 0x14], 4
je 0x48108d
mov eax, 0xa
pop edi
pop esi
pop ecx
ret
call fcn.00484710
add esp, 4
test edx, edx
jg 0x481067
jl 0x481053
cmp eax, 4
jae 0x481067
mov eax, dword [esp + 0x10]
push esi
push eax
push 0
call fcn.00484830
add esp, 0xc
test eax, eax
jne 0x48103c
mov eax, dword [esi + 0xa8]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x10]
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x481037
cmp dword [esp + 0x14], 4
jne 0x481037
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x482250
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x818]
mov dword [esp + 0x10], 0
mov esi, dword [edi + 0x56e0]
test esi, esi
je 0x48240c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [esi + 0x5c], 0
jne 0x482291
cmp word [esi + 0x5e], 0
je 0x48230b
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x58]
mov word [esi + 0x5c], 1
cmp byte [eax + ecx - 1], 0x2f
je 0x482307
mov edx, dword [esi + 0x48]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.00478590
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [edi + 0x4e94]
test eax, eax
jne 0x48230b
mov eax, dword [esi + 0x48]
push eax
call fcn.00482230
mov ecx, dword [esi + 0x58]
push ecx
call fcn.00482230
mov eax, dword [esi + 0x58]
add esp, 8
cmp byte [eax], 0
je 0x4822f6
push 0x51f934
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esi + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov dword [esi + 0x20], eax
jbe 0x48230b
inc dword [esp + 0x10]
mov esi, dword [esi + 0x68]
test esi, esi
jne 0x482283
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48240c
shl eax, 2
push eax
call fcn.004adbfa
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x482348
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x804
ret
mov esi, dword [edi + 0x56e0]
xor ebx, ebx
test esi, esi
je 0x482391
mov edi, ebp
cmp word [esi + 0x5c], 0
je 0x48238a
mov ecx, dword [esi + 0x20]
test ecx, ecx
jbe 0x48238a
mov eax, dword [esi + 0x58]
cmp byte [ecx + eax - 1], 0x2f
jne 0x48238a
test ebx, ebx
je 0x482384
mov ecx, dword [edi - 4]
mov edx, dword [ecx + 0x58]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x48238a
mov dword [edi], esi
inc ebx
add edi, 4
mov esi, dword [esi + 0x68]
test esi, esi
jne 0x482356
push 0x47e840
push 4
push ebx
push ebp
call fcn.004b7360
add esp, 0x10
xor ebp, ebp
test ebx, ebx
jbe 0x4823ff
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 0x48]
cmp byte [esi], 0
je 0x4823f7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x2f
jne 0x4823d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi - 1], 0
test ebp, ebp
je 0x4823eb
mov ecx, dword [edi - 4]
mov eax, dword [edi]
mov edx, dword [ecx + 0x58]
mov ecx, dword [eax + 0x58]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4823f7
mov edx, dword [edi]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc ebp
add edi, 4
cmp ebp, ebx
jb 0x4823ac
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004ad74d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x804
ret
Function at 0x482830
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x800
lea ecx, [esp]
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push 0x2e
push edx
call fcn.00483480
mov edi, eax
test edi, edi
je 0x4828a2
mov esi, dword [esp + 0x810]
inc edi
cmp esi, 0x3e8
jge 0x4828a2
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0x64
push esi
jge 0x482885
push str.z_02d
jmp 0x48288a
push str._03d
push edi
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call ebp
inc esi
cmp esi, 0x3e8
jl 0x482878
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x800
ret

Function at 0x4828b0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x800
lea ecx, [esp]
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push str..z00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push 0x2e
push eax
call fcn.00483480
mov edi, eax
test edi, edi
je 0x482932
mov esi, dword [esp + 0x810]
inc edi
cmp esi, 0x3e8
jge 0x482932
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0x64
push esi
jge 0x482915
push str.z_02d
jmp 0x48291a
push str._03d
push edi
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call ebp
inc esi
cmp esi, 0x3e8
jl 0x482908
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x800
ret

Function at 0x482a40
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x800
mov ecx, dword [eax + 0x914]
test ecx, ecx
jne 0x482ac9
test byte [eax + 0x5735], 0x40
jne 0x482ac9
mov eax, dword [esp + 0x804]
test eax, eax
jl 0x482ac0
cmp eax, 0x1a
jg 0x482ac0
test eax, eax
jne 0x482a76
call fcn.00483bc0
lea ecx, [esp]
push esi
push ecx
push eax
xor esi, esi
call fcn.00483ce0
add esp, 8
test eax, eax
je 0x482ab6
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.0x482a9e.3
jmp dword [eax*4 + 0x482ad8]
mov esi, 1
mov eax, esi
pop esi
add esp, 0x800
ret
xor esi, esi
mov eax, esi
pop esi
add esp, 0x800
ret
xor eax, eax
add esp, 0x800
ret
mov eax, 1
add esp, 0x800
ret
Function at 0x482af0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x828
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [esp + 0x28]
cmp al, 0x5c
mov al, byte [esp + 0x29]
jne 0x482b39
cmp al, 0x5c
jne 0x482b39
lea edx, [esp + 0x2a]
push 0x5c
push edx
call fcn.00483440
test eax, eax
je 0x482b47
inc eax
push 0x5c
push eax
call fcn.00483440
test eax, eax
je 0x482b47
mov byte [eax + 1], 0
jmp 0x482b47
cmp al, 0x3a
jne 0x482b47
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x482b92
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
push edx
call eax
test eax, eax
je 0x482b92
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp ecx, 0xffffffff
mov edx, ecx
jg 0x482be5
jl 0x482b92
cmp eax, 0xffffffff
ja 0x482be5
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x482bc4
or eax, 0xffffffff
mov edx, SysReAllocString
add esp, 0x828
ret
mov edx, dword [esp + 8]
mov eax, dword [esp]
push 0
push edx
push 0
push eax
call fcn.004b56d0
mov ecx, dword [esp + 4]
push 0
push ecx
push edx
push eax
call fcn.004b56d0
add esp, 0x828
ret