joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499530
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp dword [0x5ecdd8], 0
jne 0x4996ff
push 0x56c440
call fcn.0049e8c0
add esp, 4
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
push eax
call fcn.0049e8b0
add esp, 4
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.004e6ed0
add esp, 8
mov edx, dword [ebp - 0x80c]
push edx
call fcn.0049e910
add esp, 4
push 0x56d188
call fcn.0049e8c0
add esp, 4
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
push eax
call fcn.0049e8b0
add esp, 4
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.004e6ed0
add esp, 8
mov edx, dword [ebp - 0x80c]
push edx
call fcn.0049e910
add esp, 4
lea eax, [ebp - 0x808]
push eax
push 0x400
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x499607
cmp dword [0x525af0], 0
je 0x499601
push 0x572468
push 0x20
call fcn.00499750
add esp, 8
xor ecx, ecx
test ecx, ecx
jne 0x4995e9
push 0x5c
lea edx, [ebp - 0x404]
push edx
call fcn.004e87e0
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49964f
cmp dword [0x525af0], 0
je 0x499649
push 0x5724e0
push 0x20
call fcn.00499750
add esp, 8
xor ecx, ecx
test ecx, ecx
jne 0x499631
push 0
call fcn.004a9f80
add esp, 4
mov dword [ebp - 0x408], eax
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x499693
cmp dword [0x525af0], 0
je 0x49968d
push 0x572578
push 0x20
call fcn.00499750
add esp, 8
xor eax, eax
test eax, eax
jne 0x499675
cmp dword [ebp - 0x408], 0
jge 0x4996cf
cmp dword [0x525af0], 0
je 0x4996cd
mov ecx, dword [ebp - 0x408]
push ecx
push 0x5725f0
push 0x5f6e00
call fcn.004e6fc0
add esp, 0xc
push 0x5f6e00
push 0x20
call fcn.00499750
add esp, 8
jmp 0x4996f7
mov dword [0x5ecdd8], 1
cmp dword [0x525af0], 0
je 0x4996f1
push 0x57264c
push 0
call fcn.00499750
add esp, 8
xor edx, edx
test edx, edx
jne 0x4996d9
mov eax, dword [ebp - 0x408]
jmp 0x499701
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4997c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0x5726a8
call fcn.0049e8c0
add esp, 4
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
push eax
call fcn.0049e8b0
add esp, 4
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.004e6ed0
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call fcn.0049e910
add esp, 4
push 0x5ecde0
push 0x5ecdf0
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
cmp eax, 1
jne 0x49983d
mov dword [ebp - 4], 1
jmp 0x499844
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49ac00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
xor eax, eax
mov al, byte [0x5ed05d]
test eax, eax
je 0x49ac3c
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5ece40
call fcn.004a0d80
add esp, 0x18
mov dword [ebp - 4], eax
jmp 0x49ac64
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 1
push 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00488230
add esp, 0x10
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ccf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.004e7020
add esp, 4
add eax, 0x14
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e808b
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x49cdbb
cmp dword [ebp + 8], 0x30
je 0x49cd59
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10010]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10010]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10010], ecx
jmp 0x49cd62
mov eax, dword [ebp - 8]
mov dword [eax], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call fcn.004e6ed0
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0xc]
call fcn.0049d190
mov byte [ebp - 4], al
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004e8080
add esp, 4
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49ce70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 4
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x20], eax
push 0x59647c
call fcn.0049be80
add esp, 4
push eax
push 0x1388
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x24], eax
push 0x59648c
call fcn.0049be80
add esp, 4
push eax
push 0x1388
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x28], eax
mov dword [ebp - 0x108], 0
jmp 0x49cf0f
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
cmp dword [ebp - 0x108], 4
jge 0x49cf63
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x5964a4
call fcn.0049be80
add esp, 4
push eax
lea edx, [ebp - 0x100]
push edx
call fcn.004e6fc0
add esp, 0x10
lea eax, [ebp - 0x100]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x114]
mov dword [edx + ecx*4 + 8], eax
jmp 0x49cf00
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov edx, dword [ebp - 0x114]
mov dword [edx + 4], eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x104], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x18], eax
cmp dword [ebp - 0x104], 0xb7
je 0x49cff8
push 8
mov ecx, dword [ebp - 0x114]
call fcn.0049ce30
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
push 8
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp - 0x114]
call fcn.0049d0e0
mov ecx, dword [ebp - 0x114]
mov esi, dword [ecx + 0x1c]
sub esi, 4
mov ecx, dword [ebp - 0x114]
call fcn.0049ce50
sub esi, eax
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x20], esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x49d6d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x4a19c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 4], 0
push 0x140
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.004e6e70
add esp, 0xc
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a1a04
xor eax, eax
jmp 0x4a1a78
cmp dword [ebp + 0x10], 0xffffffff
je 0x4a1a32
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jne 0x4a1a32
cmp dword [ebp + 0xc], 0
je 0x4a1a32
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004e6ed0
add esp, 8
mov eax, 1
jmp 0x4a1a78
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_FindNextFileA]
cmp eax, 1
je 0x4a1a04
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp + 0x14], 0
je 0x4a1a69
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
cmp dword [ebp + 0x10], 0xffffffff
jne 0x4a1a76
mov eax, 1
jmp 0x4a1a78
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4a1b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
and eax, 0xff
test eax, eax
je 0x4a1be5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x4a1bdf
mov eax, dword [ebp + 8]
push eax
call fcn.004e7020
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
jne 0x4a1bb3
mov eax, dword [ebp + 8]
push eax
call fcn.004e7020
add esp, 4
mov ecx, dword [ebp + 8]
mov byte [ecx + eax - 1], 0
cmp dword [ebp + 0x14], 0
je 0x4a1bcc
push 0x5c9fd8
mov edx, dword [ebp + 8]
push edx
call fcn.004e6ee0
add esp, 8
jmp 0x4a1bdd
push 0x5c9fec
mov eax, dword [ebp + 8]
push eax
call fcn.004e6ee0
add esp, 8
jmp 0x4a1be3
mov byte [ebp - 4], 0
jmp 0x4a1c2a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
jbe 0x4a1c26
mov eax, dword [ebp + 8]
push eax
call fcn.004e7020
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
jne 0x4a1c24
mov eax, dword [ebp + 8]
push eax
call fcn.004e7020
add esp, 4
mov ecx, dword [ebp + 8]
mov byte [ecx + eax - 1], 0
jmp 0x4a1c2a
mov byte [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a1df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push 0x5ca040
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e6ee0
add esp, 8
push 0x140
push 0
lea edx, [ebp - 0x244]
push edx
call fcn.004e6e70
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4a1e59
xor al, al
jmp 0x4a1f05
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
call fcn.004e7504
add esp, 4
lea edx, [ebp - 0x240]
push edx
call fcn.004a1d10
add esp, 4
lea eax, [ebp - 0x238]
push eax
call fcn.004a1d10
add esp, 4
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x230], ecx
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_FindClose]
push 0
push 0
push 3
push 0
push 0
push 0x10000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x4a1ed4
xor al, al
jmp 0x4a1f05
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.kernel32.dll_SetFileTime]
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4a1f10
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x5ca050
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4a1f7a
mov edx, dword [ebp + 0x10]
push edx
call fcn.004e7020
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a1f70
mov byte [ebp - 4], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a1f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2b38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb28
cmp dword [ebp + 8], 0
jne 0x4a1fbb
xor al, al
jmp 0x4a213f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004a3690
mov dword [ebp - 4], 0
mov ecx, dword [0x5ca080]
mov dword [ebp - 0x14], ecx
mov dx, word [0x5ca084]
mov word [ebp - 0x10], dx
mov al, byte [0x5ca086]
mov byte [ebp - 0xe], al
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004a1a80
add esp, 8
test eax, eax
jne 0x4a2018
push 0x100
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
jmp 0x4a2033
lea ecx, [ebp - 0x620]
push ecx
push 0x5ca088
lea edx, [ebp - 0x520]
push edx
call fcn.004e6fc0
add esp, 0xc
push 1
push 0
push 0x100
lea eax, [ebp - 0x320]
push eax
call fcn.004a43b0
add esp, 0x10
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4a207e
mov byte [ebp - 0x624], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.004a36d0
mov al, byte [ebp - 0x624]
jmp 0x4a213f
lea ecx, [ebp - 0x320]
push ecx
lea edx, [ebp - 0x520]
push edx
push 0x5ca090
lea eax, [ebp - 0xb28]
push eax
call fcn.00497b40
add esp, 0x10
mov dword [ebp - 0xb30], eax
mov ecx, dword [ebp - 0xb30]
mov dword [ebp - 0xb34], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xb34]
call fcn.00497b80
push eax
lea edx, [ebp - 0x420]
push edx
call fcn.004e6ed0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb28]
call fcn.00497b90
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004a3440
test eax, eax
je 0x4a2120
lea ecx, [ebp - 0x420]
push ecx
call fcn.004a1df0
add esp, 4
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x320]
push eax
push 0x80000002
call fcn.004a1f10
add esp, 0xc
mov byte [ebp - 0xb2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.004a36d0
mov al, byte [ebp - 0xb2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a2150
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x5ca0a0
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
cmp dword [ebp - 4], 0
je 0x4a222d
mov dword [ebp - 8], 0
mov ecx, 1
test ecx, ecx
je 0x4a2223
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0xc], 0x100
push 0x100
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.004e6e70
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_RegEnumValueA]
test eax, eax
je 0x4a21ea
jmp 0x4a2223
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.004a4270
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a2215
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x4a2185
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4a2240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x4a2336
lea ecx, [ebp - 0x100]
push ecx
call fcn.004e7020
add esp, 4
movsx edx, byte [ebp + eax - 0x101]
cmp edx, 0x5c
jne 0x4a2296
lea eax, [ebp - 0x100]
push eax
call fcn.004e7020
add esp, 4
mov byte [ebp + eax - 0x101], 0
cmp dword [ebp + 0xc], 0
je 0x4a22b2
push 0x5ca0d0
lea ecx, [ebp - 0x100]
push ecx
call fcn.004e6ee0
add esp, 8
jmp 0x4a22c6
push 0x5ca0e4
lea edx, [ebp - 0x100]
push edx
call fcn.004e6ee0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004e6ed0
add esp, 8
push 0x5c
lea edx, [ebp - 0x204]
push edx
call fcn.004e87e0
add esp, 8
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x4a2302
mov eax, dword [ebp - 0x104]
mov byte [eax], 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.004f265d
add esp, 4
push eax
lea edx, [ebp - 0x204]
push edx
call fcn.004f265d
add esp, 4
push eax
call fcn.004e8000
add esp, 8
test eax, eax
je 0x4a2332
mov al, 1
jmp 0x4a2338
xor al, al
jmp 0x4a2338
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4a3440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x204]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4a34b0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4a3481
xor eax, eax
jmp 0x4a34b2
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
jmp 0x4a34b2
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4a34c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x204], ecx
push 0xff
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x204]
add ecx, 4
push ecx
lea edx, [ebp - 0x100]
push edx
push 0x5ca6dc
lea eax, [ebp - 0x200]
push eax
call fcn.004e6fc0
add esp, 0x10
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [ebp - 0x204]
add edx, 0x103
push edx
call fcn.004e6ed0
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x204]
call fcn.004a3440
test eax, eax
je 0x4a3545
mov eax, dword [ebp - 0x204]
add eax, 0x103
jmp 0x4a3550
mov eax, dword [ebp - 0x204]
add eax, 0x103
mov esp, ebp
pop ebp
ret

Function at 0x4a3560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x204], ecx
lea eax, [ebp - 0x100]
push eax
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x204]
add ecx, 4
push ecx
lea edx, [ebp - 0x100]
push edx
push 0x5ca6e4
lea eax, [ebp - 0x200]
push eax
call fcn.004e6fc0
add esp, 0x10
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [ebp - 0x204]
add edx, 0x103
push edx
call fcn.004e6ed0
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x204]
call fcn.004a3440
test eax, eax
je 0x4a35e5
mov eax, dword [ebp - 0x204]
add eax, 0x103
jmp 0x4a35f0
mov eax, dword [ebp - 0x204]
add eax, 0x103
mov esp, ebp
pop ebp
ret

Function at 0x4a3e00
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
cmp dword [ebp + 8], 0
jne 0x4a3e16
mov eax, 4
jmp 0x4a3e8d
push 0x100
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.004e6e70
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.004e6e70
add esp, 0xc
push 0x100
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov byte [ebp - 0xfd], 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x100
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4a3e8b
mov eax, 3
jmp 0x4a3e8d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4a4980
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x5ca9f4
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x4a49bf
mov eax, 2
jmp 0x4a4a6a
mov dword [ebp - 4], 0
mov dword [ebp - 0x110], 0xffffffff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004e6ed0
add esp, 8
lea edx, [ebp - 0x10c]
push edx
call fcn.004e7020
add esp, 4
add eax, 5
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x110]
push edx
push 2
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a4a2c
mov eax, 3
jmp 0x4a4a6a
mov ecx, dword [ebp + 8]
push ecx
push 0x5caa00
lea edx, [ebp - 0x214]
push edx
call fcn.004e6fc0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
xor eax, eax
mov esp, ebp
pop ebp
ret