joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f710
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
movzx edx, byte [esi]
cmp dl, 7
je 0x49f802
and edx, 0x7f
movzx edx, byte [edx + 0x514aac]
imul edx, edx, 0x63
mov eax, dword [eax + 4]
lea edi, [eax + edx*4]
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x49f747
cmp esi, dword [ebx + 4]
je 0x49f814
mov eax, esi
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
and eax, 0x1f
mov dword [esp], eax
mov eax, dword [esp]
mov ebx, dword [edi + eax*4 + 0xc]
test ebx, ebx
je 0x49f784
cmp esi, dword [ebx + 4]
je 0x49f814
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov eax, dword [eax]
and eax, 0xfffffffe
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
add edx, 2
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
call fcn.004927ac
test al, al
jne 0x49f7b6
mov eax, dword [esp + 4]
call fcn.00497158
mov eax, dword [esp]
mov edx, dword [edi + eax*4 + 0x8c]
test edx, edx
je 0x49f7e6
mov eax, edx
cmp esi, dword [eax]
je 0x49f7dd
add eax, 8
mov ecx, edx
sub ecx, 4
mov ecx, dword [ecx]
lea ecx, [edx + ecx*4]
cmp ecx, eax
jbe 0x49f7e2
jmp 0x49f7c6
mov eax, dword [eax + 4]
jmp 0x49f7e4
xor eax, eax
mov ebx, eax
mov eax, edi
mov edx, 2
call fcn.004927b8
test ebx, ebx
je 0x49f814
mov dword [edi + 8], ebx
mov eax, dword [esp]
mov dword [edi + eax*4 + 0xc], ebx
jmp 0x49f814
mov eax, esi
movzx edx, byte [eax + 1]
add edx, 2
add eax, edx
mov eax, dword [eax]
add eax, 0xffffffbc
mov ebx, dword [eax]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x49fa68
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
movzx eax, byte [eax + 0x514aac]
imul eax, eax, 0x63
mov edx, dword [ebx + 4]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0049719c
xor ecx, ecx
push ebp
push 0x49fb4a
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
push ebp
and eax, 0x1f
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 0x8c]
call fcn.0049fa24
pop ecx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
mov edx, eax
dec eax
test eax, eax
je 0x49fafd
mov ecx, dword [ebp - 4]
add ecx, 2
movzx ecx, byte [ecx + eax]
and cl, 0xdf
add dl, cl
jmp 0x49fae7
and dl, 0x1f
push ebp
movzx eax, dl
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 0x10c]
call fcn.0049fa24
pop ecx
lea eax, [ebx + 8]
lea edx, [ebx + 0x10]
mov ecx, edx
mov edx, dword [ebp - 8]
call fcn.0049121c
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0xc]
inc dword [ebx + eax*4 + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fb51
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.004927b8
ret
Function at 0x4c5638
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c5666
mov eax, ebx
call fcn.004c60ec
cmp dword [ebx + 0x40], 0
je 0x4c565f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c56d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c56c9
cmp dword [ebx + 8], 0
je 0x4c5688
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c569a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c56c9
cmp dword [ebx + 8], 0
je 0x4c567b
cmp eax, 3
je 0x4c56ad
dec eax
jne 0x4c567b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c567b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c567b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c56f5
cmp dword [ebx + 0x14], 0xcc
je 0x4c56f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c5700
pop ebx
ret

Function at 0x4d7e08
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7f79
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d7f54
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004053b0
lea eax, [ebp - 0x118]
mov edx, 0x4d7f90
call fcn.00405494
mov eax, dword [ebp - 0x118]
call fcn.00405658
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4d7ec6
lea eax, [ebp - 0x111]
call fcn.0040aad0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004052b8
jmp 0x4d7ecd
mov eax, esi
call fcn.004051c8
cmp bl, 0x61
jae 0x4d7eee
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f6a4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040521c
jmp 0x4d7f08
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f610
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040521c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4d7f9c
call fcn.0040b5b8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040521c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7f5b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4de494
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4de4f2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004de614
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4de4da
lea eax, [ebp - 4]
call fcn.004de614
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4de4dc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de4f9
lea eax, [ebp - 4]
call fcn.004051c8
ret

Function at 0x4de500
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4de564
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004de614
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040ad2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de56b
lea eax, [ebp - 4]
call fcn.004051c8
ret

Function at 0x4de570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4de5d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x4de5e0
lea eax, [ebp - 4]
call fcn.004de614
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004de358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de5db
lea eax, [ebp - 4]
call fcn.004051c8
ret
Function at 0x4def48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4df041
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004ddd9c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a80c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004e0188
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a6cc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004e0200
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df048
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051ec
ret
Function at 0x4df050
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4df159
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004ddd9c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4df11f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a80c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004e0188
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a6cc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004e0200
jmp 0x4df131
xor edx, edx
mov eax, ebx
call fcn.004e0188
xor edx, edx
mov eax, ebx
call fcn.004e0200
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df160
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051ec
ret

Function at 0x4e22d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004e23dc
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004e23dc
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4e300c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e31f2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4e31ae
mov eax, dword [ebp - 4]
call fcn.004e47cc
cmp ebx, eax
jge 0x4e31ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004dbd38
mov edx, dword [0x4de9e8]
call fcn.004044e8
mov esi, eax
mov eax, esi
call fcn.004e00fc
test al, al
je 0x4e31a4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4e3198
xor eax, eax
push ebp
push 0x4e3191
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e34e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041ebbc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004058e8
mov eax, dword [ebp - 8]
call fcn.004056b8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004e3388
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e31dc
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4e3190
mov eax, dword [ebp - 4]
call fcn.004e3564
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040ad2c
jmp 0x4e31dc
mov eax, dword [ebp - 8]
call fcn.004051c8
jmp 0x4e31dc
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a158
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4197b4]
call fcn.0040e814
call fcn.00404bec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e31f9
lea eax, [ebp - 0x54]
call fcn.004051c8
ret
Function at 0x4e6c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4e6c3d
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4e6cbc
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004e2294
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e6c8a
mov cx, word [esp]
sub cx, si
jmp 0x4e6c8c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e6c73
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e6cb2
mov cx, word [esp]
sub cx, si
jmp 0x4e6cb4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e6c9b
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4e6d19
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004e68e4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4e6d04
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4e6d19
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4e6c1a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e950c
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.004e93b4
test al, al
je 0x4e9539
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.004e94ac
test al, al
jne 0x4e952f
call fcn.00410414
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x4e956a
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.00405658
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
jne 0x4e9563
call fcn.00410414
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret
Function at 0x4ebb24
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ebc01
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ebbd3
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp word [eax + 0x20a], 0
je 0x4ebb9f
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov edi, dword [eax - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [edi + 0x20c]
call dword [edi + 0x208]
cmp byte [ebp - 1], 0
jne 0x4ebbcf
lea ecx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.00405658
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
inc esi
dec ebx
jne 0x4ebb5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00404338
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebc08
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051ec
ret
Function at 0x4ed70c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ed8c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1d8]
movzx eax, byte [eax + 0x21]
test al, al
je 0x4ed8a7
cmp al, 1
jne 0x4ed7f2
mov eax, dword [ebx + 0x284]
call fcn.00404338
xor eax, eax
mov dword [ebx + 0x284], eax
mov eax, ebx
call fcn.004ed634
lea ecx, [ebx + 0x2a8]
mov edx, dword [ebx + 0x12c]
add edx, 2
mov eax, ebx
call fcn.004e4888
cmp dword [ebx + 0x2a8], 0
jne 0x4ed798
lea edx, [ebp - 8]
mov eax, 0xbb
call fcn.0040a158
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4e134c]
call fcn.0040e7d8
call fcn.00404bec
inc dword [ebx + 0x12c]
mov eax, dword [ebx + 0x2a8]
call fcn.0040a2ac
test al, al
je 0x4ed7be
mov eax, dword [ebx + 0x2a8]
call fcn.00405658
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp word [ebx + 0x232], 0
je 0x4ed7dd
mov ecx, dword [ebx + 0x12c]
inc ecx
mov edx, ebx
mov eax, dword [ebx + 0x234]
call dword [ebx + 0x230]
mov eax, ebx
call fcn.004ed570
mov dword [ebx + 0x260], eax
mov dword [ebx + 0x264], edx
jmp 0x4ed85a
mov eax, dword [ebx + 0x284]
call fcn.00404338
xor eax, eax
mov dword [ebx + 0x284], eax
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2a8]
call fcn.00405260
lea eax, [ebx + 0x2a8]
mov edx, dword [ebx + 0x1a8]
call fcn.0040521c
push 1
mov ecx, dword [ebx + 0x12c]
add ecx, 2
lea edx, [ebx + 0x2a8]
mov eax, ebx
call fcn.004e4a18
inc dword [ebx + 0x12c]
mov eax, dword [ebx + 0x1d8]
mov edx, dword [eax + 8]
mov dword [ebx + 0x260], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x264], edx
push 0xffff
movzx eax, byte [ebx + 0x105]
push eax
mov eax, dword [ebx + 0x108]
push eax
mov ecx, dword [ebx + 0x2a8]
mov dl, 1
mov eax, dword [0x4dcfd8]
call fcn.004dd150
mov dword [ebx + 0x284], eax
mov dword [ebx + 0x258], 0
mov dword [ebx + 0x25c], 0
xor edx, edx
mov eax, dword [ebx + 0x2a0]
call fcn.004e0954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed8c9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051ec
ret
Function at 0x4ef5dc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1e0], 0
je 0x4ef600
mov eax, dword [ebx + 0x1e0]
call fcn.004ddfd0
test al, al
jne 0x4ef616
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.004de358
jmp 0x4ef623
mov eax, esi
mov edx, dword [ebx + 0x1e0]
call fcn.0040521c
add esp, 0x130
pop esi
pop ebx
ret
Function at 0x4f0368
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405648
mov eax, dword [ebp - 8]
call fcn.00405648
xor eax, eax
push ebp
push 0x4f040f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x22], 2
lea eax, [ebp - 0x2c]
mov ecx, 0x4f0424
mov edx, dword [ebp - 4]
call fcn.004054e0
mov eax, dword [ebp - 0x2c]
call fcn.00405658
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x30]
mov ecx, 0x4f0424
mov edx, dword [ebp - 8]
call fcn.004054e0
mov eax, dword [ebp - 0x30]
call fcn.00405658
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0416
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004051ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051ec
ret

Function at 0x4f2380
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405648
xor eax, eax
push ebp
push 0x4f2486
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403bdc
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0x36]
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], 4
lea eax, [ebx + 3]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, dword [ebx + 0xbc]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0
mov eax, dword [ebx + 0xc0]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
lea edx, [ebp - 0x80]
mov ecx, 5
mov eax, 0x4f24a0
call fcn.0040b5b8
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x36]
call fcn.0040542c
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405658
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405658
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4f2465
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f248d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051ec
ret

Function at 0x4f24b4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
xor ebx, ebx
push ebp
mov eax, dword [esi + 0xac]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4f24d6
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push edi
call sub.kernel32.dll_Sleep_1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret