joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2670
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
test dl, dl
je 0x4b2688
add esp, 0xfffffff0
call fcn.00403378
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404078
mov eax, dword [ebp + 0x20]
call fcn.00406d00
mov eax, dword [ebp + 0x1c]
call fcn.00404078
mov eax, dword [ebp + 0x14]
call fcn.00404078
mov eax, dword [ebp + 0x10]
call fcn.00404078
mov eax, dword [ebp + 0xc]
call fcn.00404078
xor eax, eax
push ebp
push 0x4b27af
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x4a82dc]
call fcn.004a83e8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00406cb8
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebp + 0x20]
call fcn.00406cb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x64
xor eax, eax
push ebp
push 0x4b276d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4ad0ac]
call fcn.004ad378
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048c5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2774
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
ret
Function at 0x4c29c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
test dl, dl
je 0x4c29da
add esp, 0xfffffff0
call fcn.00403378
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00406d00
mov eax, dword [ebp + 0xc]
call fcn.00406d00
mov eax, dword [ebp + 8]
call fcn.00406d00
xor eax, eax
push ebp
push 0x4c2aa8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00479a84
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebp - 0xc]
call fcn.00406cb8
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
test eax, eax
jle 0x4c2a82
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x4c2a7a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x4c2a7a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x38], edx
jmp 0x4c2a82
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4c2a4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2aaf
lea eax, [ebp - 0xc]
call fcn.00406ca0
lea eax, [ebp + 8]
call fcn.00406ca0
lea eax, [ebp + 0xc]
call fcn.00406ca0
ret

Function at 0x4d5310
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d5405
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 3
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.004d5014
test al, al
je 0x4d5353
lea eax, [ebp - 0xc]
mov edx, 0x4d541c
call fcn.00403ce0
jmp 0x4d5360
lea eax, [ebp - 0xc]
mov edx, 0x4d54b8
call fcn.00403ce0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x230]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xc]
test al, al
jne 0x4d53b4
lea edx, [ebp - 0x1c]
mov eax, dword [0x52635c]
call fcn.00406c48
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x408a50]
call fcn.0040d618
call fcn.00403724
mov edx, 0x4d54f4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d540c
lea eax, [ebp - 0x1c]
call fcn.00403c48
lea eax, [ebp - 0x18]
call fcn.00406ca0
lea eax, [ebp - 0x14]
call fcn.00406ca0
lea eax, [ebp - 0x10]
call fcn.00406ca0
lea eax, [ebp - 0xc]
call fcn.00403c48
ret
Function at 0x4d8ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d9053
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x27], 0
je 0x4d8ed4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x28]
mov eax, 0x4d9060
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403dfc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov cl, 3
call fcn.004ca320
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403dfc
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x526418]
mov eax, dword [eax]
mov dl, 3
mov ebx, dword [eax]
call dword [ebx + 0x38]
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xd4]
mov edx, eax
lea eax, [ebp - 8]
call fcn.00403dfc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
mov dl, 1
mov eax, dword [0x41121c]
call fcn.00403008
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d9029
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4d90d8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00467bc4
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x4d90e4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00467bc4
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00409d1c
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4d900b
lea ecx, [ebp - 0x18]
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004ca42c
movzx eax, ax
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
jmp 0x4d9013
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x4c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9030
mov eax, dword [ebp - 0xc]
call fcn.00403038
ret
Function at 0x50e8c8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x50e963
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
test esi, esi
je 0x50e948
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0050ea24
mov eax, dword [ebp - 4]
call fcn.0050e974
test al, al
jne 0x50e948
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a214
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403fd4
je 0x50e948
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a214
mov eax, dword [ebp - 8]
call fcn.0050e8c8
test al, al
je 0x50e946
push 0
mov eax, dword [ebp - 4]
call fcn.00404088
push eax
call sub.kernel32.dll_CreateDirectoryA_1
neg eax
sbb ebx, ebx
neg ebx
jmp 0x50e948
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e96a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c6c
ret

Function at 0x50e974
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov bl, 1
test esi, esi
je 0x50e99d
mov eax, esi
call fcn.00404088
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x50e997
test al, 0x10
jne 0x50e99b
xor ebx, ebx
jmp 0x50e99d
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x512378
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404078
mov eax, dword [ebp - 8]
call fcn.00404078
xor eax, eax
push ebp
push 0x5124ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
jne 0x5123c2
lea eax, [ebp - 4]
mov edx, 0x512504
call fcn.00403ce0
cmp dword [ebp - 8], 0
jne 0x5123d5
lea eax, [ebp - 8]
mov edx, 0x512510
call fcn.00403ce0
xor eax, eax
push ebp
push 0x5124c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xd9]
call fcn.00403ec4
test eax, eax
jne 0x512416
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
lea eax, [ebx + 0xc]
call fcn.004027a0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
jmp 0x51246f
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0xd9]
mov dl, 1
call fcn.0050ea24
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xd9]
call fcn.00403c9c
mov eax, dword [ebx + 0xd9]
call fcn.00403ec4
add eax, 0xd
call fcn.004027a0
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0xd9]
call fcn.00403ec4
mov ecx, eax
inc ecx
test ecx, ecx
jns 0x512461
call fcn.00402f70
mov edx, dword [ebx + 0xd9]
mov eax, dword [ebp - 0xc]
call fcn.0040a920
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404088
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x5124ad
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403dfc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.0040a180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5124ca
mov eax, dword [ebp - 0xc]
call fcn.004027b8
ret

Function at 0x512b9c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x512c44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xd9]
mov edx, esi
call fcn.00403fd4
je 0x512c29
test esi, esi
je 0x512c1c
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040a248
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x512c5c
call fcn.00403f10
mov eax, dword [ebp - 4]
call fcn.00404088
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
jns 0x512bfb
call fcn.00402f70
cmp eax, 3
je 0x512c1c
cmp eax, 6
je 0x512c1c
push esi
mov ecx, 0x2b2b
mov dl, 1
mov eax, dword [0x510440]
call fcn.00510710
call fcn.00403724
lea eax, [ebx + 0xd9]
mov edx, esi
call fcn.00403c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512c4b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c6c
ret
Function at 0x513a04
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404078
xor eax, eax
push ebp
push 0x513d25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
test eax, eax
jbe 0x513a46
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
call fcn.00513460
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x513bf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404088
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xf1], ebx
cmp ebx, 0x20
jbe 0x513b69
push 0x513d34
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x109], esi
test esi, esi
je 0x513abf
push 0x513d40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x111], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x111], 0
je 0x513ae8
push 0x513d4c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x10d], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10d], 0
je 0x513b11
push 0x513d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x101], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x101], 0
je 0x513b3a
push 0x513d68
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0xe0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0
je 0x513be0
push 0x513d74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf1]
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0xf9], eax
jmp 0x513be0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xdf], 0
jne 0x513b81
mov eax, dword [ebp - 4]
cmp byte [eax + 0xdd], 0
je 0x513be0
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
test ebx, ebx
jns 0x513b91
call fcn.00402f70
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0040ce2c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x2c]
mov ecx, 2
mov eax, 0x513d84
call fcn.0040afec
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
xor ecx, ecx
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.00512518
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513bfe
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x514cfc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
push 0x514e3c
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
test ebx, ebx
je 0x514d88
push 0x514e48
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x514d82
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi + 0x140]
call fcn.00404088
push eax
call dword [ebp - 4]
test eax, eax
jne 0x514d82
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
push ebx
call sub.kernel32.dll_FreeLibrary_1
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x514dff
cmp dword [ebp - 0x20], 0xffffffff
jne 0x514dff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x140]
call fcn.00404088
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x514dff
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00407520
call fcn.00407520
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00407520
call fcn.00407520
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
test edi, 1
je 0x514e19
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x15f], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x163], eax
test edi, 2
je 0x514e33
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x1b8], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5163d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x118], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5165a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0xff
mov dword [esi + 0x1b8], 0
mov dword [esi + 0x1bc], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
lea eax, [esi + 0x1d7]
call fcn.00403c48
mov byte [ebp - 0x114], 0
mov byte [ebp - 1], 0
lea edx, [ebp - 0x118]
mov eax, dword [esi + 0x140]
call fcn.004095cc
mov eax, dword [ebp - 0x118]
mov edx, 1
dec edx
cmp edx, dword [eax - 4]
jb 0x51646b
call fcn.00402f70
inc edx
mov bl, byte [eax + edx - 1]
cmp bl, 0x5c
je 0x5164da
cmp bl, 0x41
jb 0x51647f
cmp bl, 0x5a
jbe 0x51649c
mov eax, dword [esi + 0x140]
push eax
mov ecx, 0x2afb
mov dl, 1
mov eax, dword [0x510440]
call fcn.00510710
call fcn.00403724
call sub.kernel32.dll_GetLogicalDrives
test eax, eax
jns 0x5164aa
call fcn.00402f70
mov edi, eax
xor eax, eax
mov al, bl
sub eax, 0x41
cmp eax, 0x1f
ja 0x5164bb
bt edi, eax
jb 0x5164da
mov eax, dword [esi + 0x140]
push eax
mov ecx, 0x2afc
mov dl, 1
mov eax, dword [0x510440]
call fcn.00510710
call fcn.00403724
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [esi + 0x140]
call fcn.00404088
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x516532
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x1f
jne 0x51652a
test byte [esi + 0x11f], 2
je 0x51652a
mov byte [ebp - 1], 1
push edi
call sub.kernel32.dll_SetErrorMode
jmp 0x516587
lea eax, [esi + 0x1d7]
lea edx, [ebp - 0x114]
mov ecx, pe_nt_image_headers32
call fcn.00403e74
test byte [ebp - 6], 8
setne al
mov byte [esi + 0x1db], al
mov edx, 3
mov eax, esi
call fcn.00514cfc
push edi
call sub.kernel32.dll_SetErrorMode
cmp bl, 0x5c
je 0x516583
cmp bl, 0x5c
je 0x516587
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x516581
cmp dword [esi + 0x1b8], 0xffffffff
je 0x516587
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5165a7
lea eax, [ebp - 0x118]
call fcn.00403c48
ret
Function at 0x51cf18
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404078
xor eax, eax
push ebp
push 0x51cfb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00409f20
test al, al
je 0x51cf9d
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409de8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51cf89
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51cf90
mov eax, dword [ebp - 0xc]
call fcn.00409eb0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51cfba
lea eax, [ebp - 4]
call fcn.00403c48
ret

Function at 0x51d090
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404078
mov eax, dword [ebp - 8]
call fcn.00404078
lea ebx, [ebp - 0x1c]
xor eax, eax
push ebp
push 0x51d1de
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x4000000
push 0
push 0
push 0
push 0x51d1f0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x51d1c3
xor eax, eax
push ebp
push 0x51d1bc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404088
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x51d125
call fcn.004037c4
jmp 0x51d1c3
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4113ec]
call fcn.00415090
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x51d195
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x51d161
cmp dword [ebx], 0
je 0x51d17b
lea edx, [ebp - 0x81c]
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
call fcn.00414eb4
push ebx
push 0x800
lea eax, [ebp - 0x81c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x51d14c
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d19c
mov eax, dword [ebp - 0x18]
call fcn.00403038
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d1e5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c6c
ret