joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65d7ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
call fcn.00406d48
xor eax, eax
push ebp
push 0x65d916
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 4], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0xa]
mov edx, dword [ebp - 4]
mov word [edx + 0x64], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.0065c434
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1e]
mov edx, dword [ebp - 4]
mov word [edx + 0x1e], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x20]
mov edx, dword [ebp - 4]
mov word [edx + 0x22], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x22]
mov edx, dword [ebp - 4]
mov word [edx + 0x24], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov word [edx + 0x26], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x26]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.006593a8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0065f454
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00659314
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0065f500
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.00405b98
mov eax, dword [ebp - 4]
mov byte [eax + 0x54], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d91d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004066dc
ret
Function at 0x65d924
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
call fcn.00406d48
xor eax, eax
push ebp
push 0x65da94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax + 4], 0
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 0x64], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa]
call fcn.0065c434
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1a]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x20], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x22], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x24], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x26], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ad8
je 0x65da4c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.006593a8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0065f454
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00659314
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0065f500
jmp 0x65da60
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0065f454
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0065f500
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.00405b98
mov eax, dword [ebp - 4]
mov byte [eax + 0x54], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65da9b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004066dc
ret
Function at 0x662b70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x662ce6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x662cc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00406efc
lea eax, [ebp - 0x21c]
mov edx, 0x662d00
call fcn.004071a4
mov eax, dword [ebp - 0x21c]
call fcn.00406e0c
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x662c30
lea eax, [ebp - 0x216]
call fcn.0047b2e0
mov ecx, eax
lea edx, [ebp - 0x216]
mov eax, ebx
call fcn.00406ebc
jmp 0x662c39
mov eax, ebx
xor edx, edx
call fcn.00406d80
cmp si, 0x61
jae 0x662c5b
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call fcn.00482fd0
mov edx, dword [ebp - 0x220]
mov eax, ebx
call fcn.00406d80
jmp 0x662c75
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call fcn.00482fbc
mov edx, dword [ebp - 0x224]
mov eax, ebx
call fcn.00406d80
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x662d14
call fcn.0047b9a8
mov edx, dword [ebp - 0x228]
mov eax, ebx
call fcn.00406d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662cc8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x666e69
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x6673e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x104
push dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
call fcn.00666ad8
add esp, 0xc
cmp dword [ebp - 4], 0x104
jae 0x667434
mov ecx, 0x104
sub ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
call dword [edx + 0x20c]
add esp, 8
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jb 0x66740c
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [edx + eax + 0x104]
not cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jb 0x667439
push dword [ebp + 8]
call fcn.0066732c
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
call fcn.0066732c
pop ecx
pop ecx
pop ebp
ret

Function at 0x66891a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x6689c8
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x668959
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.00666f49
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.00666ac0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x668984
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.00666e69
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.00666ead
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x6689e3
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00666ead
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x6689e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x668a07
push dword [ebp + 0x10]
push 0
push 0
call fcn.0066891a
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.00666f49
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x668a1f
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.00666e69
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.00666ead
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.00666ead
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.00666f49
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x668aa6
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x668a8b
mov esp, ebp
pop ebp
ret
Function at 0x669f4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.00668868
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0066887f
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.00666ad8
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0066891a
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x66a0e0
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.00666ac0
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.00666ad8
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x66a09a
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.0066891a
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.006689e6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x66a05d
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.00666ad8
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x66a02d
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x66a0c3
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x66a0d1
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x66a0ad
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x669fc9
mov esp, ebp
pop ebp
ret
Function at 0x6706d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x170]
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.006709e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x170], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0x174], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
shr edx, 0x18
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x178]
mov eax, dword [ebp - 4]
call fcn.006709e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x178], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x670794
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x6707ec
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x670805
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0067075c
mov edx, dword [ebp - 8]
xor byte [edx], al
mov eax, dword [ebp - 8]
mov dl, byte [eax]
mov eax, dword [ebp - 4]
call fcn.006706d8
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x6707c5
jmp 0x670805
mov eax, dword [ebp - 4]
add eax, 0x3bc
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.006672dc
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x6708b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00406348
xor eax, eax
push ebp
push 0x670940
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0067080c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.0067075c
mov edx, dword [ebp - 0x10]
xor al, byte [ebp + edx - 0x1d]
mov byte [ebp - 0x11], al
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.006706d8
mov eax, dword [ebp - 0x10]
mov dl, byte [ebp - 0x11]
mov byte [ebp + eax - 0x1d], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x6708f4
mov al, byte [ebp - 0x12]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x670947
lea eax, [ebp - 8]
call fcn.00405b98
ret
Function at 0x67acc0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
call fcn.0067ab34
test al, al
je 0x67acf1
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.0067ac54
test al, al
jne 0x67ace6
call fcn.00484010
mov eax, dword [ebp - 0x40]
imul dword [ebp - 0x3c]
mov dword [ebp - 8], eax
jmp 0x67ad21
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
jne 0x67ad18
call fcn.00484010
mov eax, dword [ebp - 0xc]
imul dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x67f880
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x67fac4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c0]
cmp byte [eax + 0x21], 0
je 0x67faa1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c0]
cmp byte [eax + 0x21], 1
jne 0x67f9bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.004044bc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x66c], edx
mov eax, dword [ebp - 4]
call fcn.0067f768
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x690]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
add edx, 2
mov eax, dword [ebp - 4]
call fcn.00673ac4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
xor edx, edx
call fcn.00406ad8
jne 0x67f933
lea edx, [ebp - 0xc]
mov eax, 0xbb
call fcn.0047a320
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x66a528]
call fcn.00481750
call fcn.00405354
mov eax, dword [ebp - 4]
inc dword [eax + 0x12c]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x690]
call fcn.00406ff8
mov eax, dword [ebp - 0x10]
call fcn.0047a474
test al, al
je 0x67f978
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x690]
call fcn.00406ff8
mov eax, dword [ebp - 0x14]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
cmp word [eax + 0x61a], 0
je 0x67f9a1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x12c]
inc ecx
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x61c]
call dword [ebx + 0x618]
mov eax, dword [ebp - 4]
call fcn.0067f694
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x648], eax
mov dword [ecx + 0x64c], edx
jmp 0x67fa43
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.004044bc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x66c], edx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x690]
call fcn.00406728
mov eax, dword [ebp - 4]
add eax, 0x690
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.00406700
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x12c]
add ecx, 2
mov eax, dword [ebp - 4]
lea edx, [eax + 0x690]
mov eax, dword [ebp - 4]
call fcn.00673c7c
mov eax, dword [ebp - 4]
inc dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c0]
mov edx, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx + 0x648], ecx
mov ecx, dword [eax + 0xc]
mov dword [edx + 0x64c], ecx
push 0xffff
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x105]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x108]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x690]
mov dl, 1
mov eax, dword [0x65b490]
call fcn.0065b614
mov edx, dword [ebp - 4]
mov dword [edx + 0x66c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x640], 0
mov dword [eax + 0x644], 0
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
call fcn.0065ff28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67facb
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406d78
lea eax, [ebp - 8]
call fcn.004066c4
ret
Function at 0x681614
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x681731
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x68166d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.004044bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x130], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x66c], edx
jmp 0x681706
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a8]
xor edx, edx
call fcn.00406ad8
jne 0x6816d0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00671564
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00406ff8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00671564
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
call fcn.0065c78c
jmp 0x6816e7
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
call fcn.0065c78c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x690]
call fcn.00406ff8
mov eax, dword [ebp - 0x1c]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x681738
lea eax, [ebp - 0x1c]
call fcn.00406d70
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004066dc
lea eax, [ebp - 0x10]
call fcn.00406d70
ret

Function at 0x681dc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x681eaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c8]
xor edx, edx
call fcn.00406ad8
je 0x681e1e
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c8]
call fcn.00406ff8
mov eax, dword [ebp - 0x270]
call fcn.00657e68
test al, al
jne 0x681e44
lea eax, [ebp - 0x26a]
push eax
push 0x12d
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x26a]
mov ecx, 0x12d
call fcn.0040687c
jmp 0x681e55
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c8]
call fcn.00406700
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x681e76
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
cmp word [eax + edx*2 - 2], 0x5c
je 0x681e96
mov eax, dword [ebp - 8]
mov edx, 0x681ec0
call fcn.00406914
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x681eb6
lea eax, [ebp - 0x270]
call fcn.00406d70
ret