joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b8a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b985
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0045b9a0
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45b960
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
mov edx, 0x105
call fcn.0040732c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45b915
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00407214
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407214
push eax
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b967
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x45bea0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00406610
lea eax, [ebp - 0x2c0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404cb8
push 0x200
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x45bf04
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x2b4]
mov ecx, 0x104
call fcn.004072c0
mov esp, ebp
pop ebp
ret
Function at 0x45bf70
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c0bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
je 0x45c08f
lea eax, [ebp - 0x14]
call fcn.00428990
xor eax, eax
push ebp
push 0x45c033
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.004288e0
mov eax, dword [ebp - 0x18]
call fcn.00407214
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
push 0x45c0d0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c03a
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
call fcn.00406a1c
mov eax, dword [ebp - 0x20]
call fcn.00407214
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x21], al
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c0c6
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00406670
lea eax, [ebp - 0x20]
call fcn.00406610
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406670
ret

Function at 0x45c2e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x45c348]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45c301
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45c311
or byte [ebp - 5], 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45c321
or byte [ebp - 5], 2
push 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45c331
or byte [ebp - 5], 8
push 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45c341
or byte [ebp - 5], 8
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x45c550
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x45c583
push 0x45c5fc
call sub.kernel32.dll_GetLastError_2
mov ecx, eax
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov dl, 2
call fcn.0043fb10
jmp 0x45c5ec
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45c5e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45c5bb
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040726c
jmp 0x45c5c3
mov eax, dword [ebp - 8]
call fcn.00406610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c5ec
call sub.user32.dll_CloseClipboard
cmp dword [ebp - 0xc], 0
je 0x45c5e4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov esp, ebp
pop ebp
ret
Function at 0x463690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4637aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 0xad]
mov byte [ebp - 0x11], al
xor eax, eax
push ebp
push 0x463788
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov byte [eax + 0xad], 1
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004635c0
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x46376b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00463620
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jne 0x463763
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404fac
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov ecx, 0x4637c4
call fcn.0042ba20
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4637d4
call fcn.00407404
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41a6c8]
call fcn.00422b78
call fcn.00405d08
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jl 0x463702
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46378f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dl, byte [ebp - 0x11]
mov byte [eax + 0xad], dl
ret

Function at 0x4780c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0x4780cf
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4780f0
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x4780d8
pop esi
pop ebx
ret
Function at 0x484690
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
mov edx, 0x158
call fcn.0042b0a0
lea eax, [ebp - 0x46]
mov edx, 0x40
call fcn.0042b0a0
cmp dword [ebp - 4], 0
je 0x48474e
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x48470a
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.00484640
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00404860
jmp 0x48471a
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00404860
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x484734
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x48472b
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 4]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x484780
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x484801
movzx edx, word [eax]
mov word [ebp - 6], dx
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 8]
movzx edx, word [ebp - 6]
dec edx
test edx, edx
jl 0x4847bf
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x4847b8
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 4]
mov esi, dword [ebx + 0x154]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0xc]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 2]
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 8]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4848a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push esi
push edi
push ebx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [esi], eax
add esi, 4
add edx, 4
dec ecx
jne 0x4848ba
mov ecx, 0x30
mov edi, dword [esi - 0x1c]
mov eax, dword [esi - 8]
mov ebx, eax
mov edx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x4848d3
pop ebx
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret
Function at 0x492780
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x492878
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0042c100
mov eax, dword [ebp - 0x1c]
call fcn.0042c330
push 9
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileWithProgressW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 0
je 0x49280f
cmp word [ebp + 0xa], 0
je 0x49285d
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00492d30
test al, al
je 0x49285d
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
jmp 0x49285d
cmp byte [ebp - 9], 0
je 0x492838
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00492520
test al, al
je 0x492838
mov eax, dword [ebp - 4]
call fcn.00428410
mov byte [ebp - 0xa], 1
jmp 0x49285d
push 0x492898
push dword [ebp - 4]
push 0x4928d0
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040748c
mov eax, dword [ebp - 0x20]
call fcn.004924d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49287f
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406670
ret
Function at 0x4947e0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_ResetEvent
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ConnectNamedPipe
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x15], 0
je 0x494853
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, 0x4948fc
mov edx, 0x494920
call fcn.0043f710
push 0x4948fc
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0043fb10
mov eax, dword [ebp - 0x14]
sub eax, 0x217
je 0x494866
sub eax, 0x1ce
je 0x4948ac
jmp 0x4948b2
mov eax, dword [ebp - 0xc]
mov byte [ebp - 0x16], 1
jmp 0x4948e0
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, 0x4948fc
mov edx, 0x494920
call fcn.0043f710
push 0x4948fc
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0043fb10
jmp 0x4948e6

Function at 0x494be0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494cbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
push 0x1388
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
push 0xff
push 6
push 0x40000003
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00407214
push eax
call sub.kernel32.dll_CreateNamedPipeW
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jne 0x494c92
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x40]
mov edx, 0x494cd8
call fcn.00407404
mov edx, dword [ebp - 0x18]
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, 0x494d1c
call fcn.0043f790
push 0x494d1c
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dl, 2
call fcn.0043fb10
jmp 0x494ca5
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004947e0
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494cc2
lea eax, [ebp - 0x18]
call fcn.00406610
ret
Function at 0x498710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x498a99
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x498757
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407214
push eax
call sub.kernel32.dll_LoadLibraryExW_1
mov dword [ebp - 0x28], eax
jmp 0x498760
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x498a7b
xor eax, eax
push ebp
push 0x498890
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
push 1
push 0x10
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FindResourceExW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4987a0
call fcn.00405dfc
jmp 0x498a7b
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4987c0
call fcn.00405dfc
jmp 0x498a7b
xor eax, eax
push ebp
push 0x498869
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x10
xor ecx, ecx
call fcn.00407034
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406af0
test eax, eax
jle 0x498852
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x49884b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406af0
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406bb4
mov edx, eax
mov eax, dword [ebp - 0x34]
pop ecx
call fcn.00404860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498852
mov eax, dword [ebp - 0x30]
call fcn.0040bc3c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498870
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498aa0
lea eax, [ebp - 0x14]
call fcn.00406610
lea eax, [ebp - 0xc]
call fcn.00406610
ret
Function at 0x4c5360
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c5487
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
mov edx, 0x24
call fcn.0042b0a0
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo_1
xor eax, eax
push ebp
push 0x4c545b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5dca0c]
cmp dword [eax], 0
je 0x4c5451
push 1
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4c532c]
call fcn.00408510
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x5dca0c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x18
xor edx, edx
div ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4c532c]
call fcn.00408510
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x5dca0c]
mov eax, dword [eax]
call eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jb 0x4c544b
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 4]
sub eax, 1
jae 0x4c5443
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x4c542e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5465
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c548e
lea eax, [ebp - 8]
mov edx, dword [0x4c532c]
call fcn.0040851c
ret
Function at 0x4c6840
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c69b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004508e0
mov eax, dword [ebp - 8]
call fcn.00408364
test eax, eax
jl 0x4c698c
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + ecx*4]
call fcn.00406a1c
cmp dword [ebp - 0xc], 0
je 0x4c6980
mov eax, dword [ebp - 0xc]
call fcn.00407214
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x4c6980
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407214
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x4c6980
mov eax, dword [0x5e7ac0]
call fcn.0040835c
inc eax
push eax
mov eax, 0x5e7ac0
mov ecx, 1
mov edx, dword [0x4c3a14]
call fcn.00408510
add esp, 4
mov eax, dword [0x5e7ac0]
call fcn.00408364
lea eax, [eax + eax*2]
mov edx, dword [0x5e7ac0]
mov ecx, dword [ebp - 0xc]
mov cx, word [ecx]
mov word [edx + eax*8], cx
mov eax, dword [0x5e7ac0]
call fcn.00408364
lea eax, [eax + eax*2]
mov edx, dword [0x5e7ac0]
mov ecx, dword [ebp - 0x18]
mov dword [edx + eax*8 + 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [edx + eax*8 + 0x14], ecx
mov eax, dword [0x5e7ac0]
call fcn.00408364
lea eax, [eax + eax*2]
mov edx, dword [0x5e7ac0]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*8 + 8], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 + 0xc], ecx
inc dword [ebp - 4]
dec dword [ebp - 0x2c]
jne 0x4c687f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c69b7
lea eax, [ebp - 0xc]
call fcn.00406610
lea eax, [ebp - 8]
mov edx, dword [0x427aec]
call fcn.0040851c
ret
Function at 0x4d1270
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4d12c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call dword [0x5e7ae0]
pop ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406f64
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov eax, dword [ebp - 4]
add eax, 8
call fcn.00406610
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406634
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406634
pop ecx
pop ebp
ret

Function at 0x4d1b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d1c48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x4d1ba6
or dword [ebp - 4], 0x8000
call fcn.004d1730
test al, al
je 0x4d1bd5
test byte [ebp - 3], 0x80
je 0x4d1bd5
lea eax, [ebp - 0x218]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
and eax, 0xffff7fff
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov dword [ebp - 0x10], eax
jmp 0x4d1bdc
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], 0
je 0x4d1bfb
lea eax, [ebp - 0x218]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d1c27
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.004072c0
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0xc]
call fcn.00428160
jmp 0x4d1c2f
mov eax, dword [ebp - 0xc]
call fcn.00406610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1c4f
lea eax, [ebp - 0x21c]
call fcn.00406610
ret