joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476f18
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x477089
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477064
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00403e9c
lea eax, [ebp - 0x118]
mov edx, 0x4770a0
call fcn.00403f7c
mov eax, dword [ebp - 0x118]
call fcn.00404138
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x476fd6
lea eax, [ebp - 0x111]
call fcn.004094b8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00403ddc
jmp 0x476fdd
mov eax, esi
call fcn.00403cf4
cmp bl, 0x61
jae 0x476ffe
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040cd0c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00403d48
jmp 0x477018
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040cc80
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00403d48
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4770ac
call fcn.00409c54
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00403d48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47706b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x479800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404138
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x479819
test al, 0x10
jne 0x47981d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47a180
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x42c], esi
inc esi
jne 0x47a1b2
push 0x47a210
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.0047a5dc
pop esi
pop ebx
ret
mov dl, 1
mov eax, ebx
call fcn.0047a4f4
push 0x33
push 0x401
mov eax, dword [ebx + 0x4e8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebx + 0x434]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x47a203
push 0x47a224
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.0047a5dc
pop esi
pop ebx
ret
Function at 0x47a2ec
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0x460], 0
jne 0x47a3b2
mov eax, esi
call fcn.00479fc8
test al, al
jne 0x47a3b2
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
mov dword [esi + 0x42c], edi
inc edi
jne 0x47a33c
push 0x47a3c0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.0047a5dc
jmp 0x47a3b2
push 8
push 0x401
mov eax, dword [esi + 0x4e8]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor edx, edx
mov eax, esi
call fcn.0047a4f4
push 0x10
lea eax, [esi + 0x434]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x47a38f
push 0x47a3d0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.0047a5dc
jmp 0x47a3b2
push 5
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_listen
test eax, eax
sete bl
test bl, bl
jne 0x47a3b2
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x47a52c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, 0x47a588
call fcn.00403d48
cmp dword [ebx + 0x42c], 0xffffffff
je 0x47a579
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x47a579
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403eac
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x47a594
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
or esi, 0xffffffff
cmp dword [ebx + 0x42c], 0xffffffff
je 0x47a5d2
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x47a5d2
mov ax, word [esp + 6]
push eax
call sub.wsock32.dll_ntohs
movzx esi, ax
mov eax, esi
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x47ac1c
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47ad41
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x4dc], 0
je 0x47ad16
mov eax, esi
call fcn.0047ab88
mov edi, eax
cmp edi, 0xffffffff
je 0x47ad26
mov eax, edi
call fcn.00402740
mov dword [ebp - 8], eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47acba
push 0x47ad58
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00408cec
push dword [ebp - 0x10]
push 0x47ad74
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404034
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.0047a5dc
jmp 0x47ad01
test ebx, ebx
jle 0x47ad01
push 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi + 0x4dc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x47ace2
mov eax, esi
call fcn.0047b134
jmp 0x47ad26
cmp word [esi + 0x4ca], 0
je 0x47ad01
push ebx
mov ecx, dword [esi + 0x4e0]
mov edx, esi
mov eax, dword [esi + 0x4cc]
call dword [esi + 0x4c8]
mov eax, dword [ebp - 8]
call fcn.00402758
test ebx, ebx
jle 0x47ad26
inc ebx
jne 0x47ac4a
jmp 0x47ad26
push 0x47ad80
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0047a5dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad48
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403d18
ret

Function at 0x47dd54
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x508]
call fcn.00408f90
test al, al
je 0x47ddd3
push 0x80
mov eax, dword [esi + 0x508]
call fcn.00404138
push eax
call sub.kernel32.dll_SetFileAttributesA
test bl, bl
je 0x47ddb6
mov ecx, 1
mov edx, dword [esi + 0x508]
mov eax, esi
call fcn.0047ad94
mov ebx, eax
test bl, bl
je 0x47ddd5
mov edx, dword [esi + 0x508]
mov eax, esi
call fcn.0047dbac
mov dword [esi + 0x520], eax
mov dword [esi + 0x524], edx
jmp 0x47ddd5
mov eax, dword [esi + 0x508]
call fcn.004090ec
mov eax, dword [esi + 0x508]
call fcn.00408f90
mov ebx, eax
xor bl, 1
jmp 0x47ddd5
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4803d4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov byte [ebx + 0x649], 1
cmp byte [ebx + 0x658], 7
jne 0x4803f7
mov dl, 1
mov eax, dword [ebx + 0x65c]
call fcn.0047b0f4
mov eax, dword [0x480470]
mov dword [esp], eax
mov ax, word [0x480474]
mov word [esp + 4], ax
mov al, byte [0x480476]
mov byte [esp + 6], al
push 0
push 2
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_send
mov eax, dword [0x480478]
mov dword [esp], eax
mov ax, word [0x48047c]
mov word [esp + 4], ax
mov al, byte [0x48047e]
mov byte [esp + 6], al
push 1
push 2
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_send
mov edx, 0x480488
mov eax, ebx
call fcn.0047e398
pop ecx
pop edx
pop ebx
ret

Function at 0x48552c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x485701
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x4856e8
mov eax, dword [esi + 0x24]
call fcn.00403f74
test eax, eax
jne 0x485581
mov eax, dword [esi + 0x28]
call fcn.00403f74
test eax, eax
jne 0x485581
mov eax, esi
call fcn.004857a0
jmp 0x4856e8
cmp dword [esi + 0x94], 0
jne 0x4855b8
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.004095a8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c2a94]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x4855ef
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.004095a8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c2a94]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.004857e0
mov ebx, eax
test bl, bl
jne 0x48569d
mov eax, dword [esi + 0x24]
call fcn.00403f74
test eax, eax
jne 0x485627
mov eax, dword [esi + 0xb0]
call fcn.00403f74
test eax, eax
je 0x48569d
mov eax, dword [esi + 0xb0]
call fcn.00403f74
test eax, eax
je 0x485649
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.004095a8
jmp 0x485675
push dword [esi + 0x24]
push 0x48571c
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404034
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004095a8
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x48569d
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.004857e0
mov ebx, eax
test bl, bl
jne 0x4856aa
mov eax, esi
call fcn.004857a0
jmp 0x4856e8
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4856b9
mov dword [esi + 0x9c], eax
jmp 0x4856c3
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.00485858
test al, al
je 0x4856e8
mov eax, esi
mov bx, 0xffef
call fcn.00403208
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.004859a4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485708
lea eax, [ebp - 0x108]
call fcn.00403cf4
ret
Function at 0x487e4c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00487ab0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404138
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x487eaa
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c131c]
mov dl, 1
mov eax, dword [0x4879a8]
call fcn.0040c0f8
call fcn.004037c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x487eb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404138
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x487f0c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c157c]
mov dl, 1
mov eax, dword [0x4879a8]
call fcn.0040c0f8
call fcn.004037c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00487ae0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48cf28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d0e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
je 0x48cf71
mov eax, dword [ebp - 8]
mov edx, 0x48d0fc
call fcn.00403d48
jmp 0x48d070
mov esi, 0x48d110
lea edi, [ebp - 0x110]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x150], 0
jne 0x48cfa8
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4c24dc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
jmp 0x48cfbc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x150]
lea eax, [ebp - 0x110]
call fcn.004095a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x48cfe4
mov eax, dword [ebp - 8]
mov edx, 0x48d218
call fcn.00403d48
jmp 0x48d070
lea eax, [ebx + 1]
call fcn.00409720
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48d069
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x48d023
mov eax, dword [ebp - 8]
mov edx, 0x48d238
call fcn.00403d48
jmp 0x48d053
mov eax, dword [ebp - 4]
cmp byte [eax + 0x138], 9
jne 0x48d042
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0048cb38
jmp 0x48d053
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0048ccec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d070
mov eax, dword [ebp - 0x10]
call fcn.0040976c
ret
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408b38
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.00403d48
mov eax, dword [ebp - 4]
cmp byte [eax + 0x140], 0
je 0x48d0c5
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.0048d33c
push dword [ebp - 0x118]
push 0x48d264
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00404034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d0ea
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00403d18
ret
Function at 0x48d4bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4c2b88
cmp dword [edi], 0
jne 0x48d538
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4c2b8c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4c0fa0
mov ecx, 2
call fcn.0040296c
mov edx, 0x48d49c
lea eax, [esi + 5]
call fcn.0048d494
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0048d494
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x48d50d
mov dword [0x4c2b8c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x48f87c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc4
mov ebx, eax
mov esi, esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00402cc0
mov dword [esi], 0x3c
mov dword [esi + 4], 0x44c
call sub.user32.dll_GetDesktopWindow
mov dword [esi + 8], eax
mov eax, 0x48f8e8
mov dword [esi + 0xc], eax
mov eax, ebx
call fcn.00404138
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
push esi
call sub.shell32.dll_ShellExecuteExA
neg eax
sbb eax, eax
neg eax
add esp, 0x3c
pop esi
pop ebx
ret

Function at 0x493f4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x493fd5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040970c
mov edx, dword [ebp - 0x110]
mov ecx, esi
mov eax, ebx
call fcn.0049c8f8
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ILFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493fdc
lea eax, [ebp - 0x110]
call fcn.00403cf4
ret
Function at 0x493fe4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
xor eax, eax
push ebp
push 0x4940cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.0040970c
push dword [ebp - 0x110]
push 0x4940e4
push 0x4940f0
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.00404034
mov eax, dword [ebp - 0x10c]
call fcn.00408f90
test al, al
jne 0x4940ab
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x105]
call fcn.0040970c
push dword [ebp - 0x118]
push 0x4940e4
push 0x494108
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404034
mov eax, dword [ebp - 0x114]
call fcn.00408f90
test al, al
jne 0x4940ab
xor ebx, ebx
jmp 0x4940ad
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4940d2
lea eax, [ebp - 0x118]
mov edx, 4
call fcn.00403d18
ret

Function at 0x4948f8
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, ecx
mov esi, edx
mov ebp, eax
push 0x4949bc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
je 0x494924
push 0x4949cc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
jmp 0x494926
xor ebx, ebx
test ebx, ebx
je 0x494954
push edi
push esi
lea eax, [esp + 0x18]
push eax
push ebp
call ebx
test eax, eax
jne 0x4949b2
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [edi], 1
mov dword [edi + 4], 0
jmp 0x4949b2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebp
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x494998
mov eax, dword [esp + 0xc]
imul dword [esp]
imul dword [esp + 4]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [esp + 8]
imul dword [esp]
imul dword [esp + 4]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x4949b2
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49aa60
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x49acbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, byte [0x4c2be1]
mov byte [0x4c2be1], 0xe
mov byte [0x4c2be2], 0
mov eax, esi
call fcn.004a6cec
mov cl, 1
mov edx, dword [esi + 0x714]
mov eax, esi
call fcn.0049b3b4
mov eax, dword [0x4c1398]
mov eax, dword [eax]
mov edx, dword [0x4c2d04]
call fcn.00451ac4
lea edx, [ebp - 8]
mov eax, dword [0x4c1398]
mov eax, dword [eax]
call fcn.00451a7c
mov edx, dword [ebp - 8]
mov eax, 0x4c2d24
mov ecx, 0x3f
call fcn.004095cc
push 0x4c2d0c
push 1
call sub.shell32.dll_Shell_NotifyIconA
mov ecx, dword [0x4c2c6c]
mov edx, dword [0x4c2c64]
mov eax, esi
call fcn.004a137c
mov eax, dword [0x4c2bd4]
mov edx, dword [0x4c2ce4]
call fcn.00404084
je 0x49ab25
mov eax, 0x4c2bd4
mov edx, dword [0x4c2ce4]
call fcn.00403d48
mov eax, esi
call fcn.0049b548
jmp 0x49ab3a
cmp bl, 5
je 0x49ab33
cmp byte [esi + 0x910], 0
je 0x49ab3a
mov eax, esi
call fcn.0049b548
cmp byte [esi + 0x921], 0
je 0x49ab4c
mov dl, 1
mov eax, esi
call fcn.0049d220
cmp byte [0x4c2d84], 0
jne 0x49abe9
cmp dword [esi + 0x91c], 0
jle 0x49abe9
mov dl, 1
mov eax, esi
call fcn.004a1428
mov eax, dword [esi + 0x91c]
sub eax, 2
je 0x49ab87
dec eax
je 0x49abba
dec eax
je 0x49abc9
dec eax
jne 0x49aca2
xor ecx, ecx
mov edx, 0x49acd4
mov eax, esi
call fcn.0049cde0
xor edx, edx
mov eax, esi
call fcn.0049d220
cmp dword [esi + 0x91c], 5
jne 0x49aca2
mov eax, dword [0x4c2bcc]
call fcn.0044ecfc
jmp 0x49aca2
mov eax, dword [0x4c2bcc]
call fcn.0044ecfc
jmp 0x49aca2
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
test eax, eax
je 0x49aca2
mov eax, dword [0x4c2bcc]
call fcn.0044ecfc
jmp 0x49aca2
lea ecx, [ebp - 0xc]
mov edx, dword [0x4c2bd8]
mov eax, esi
call fcn.0049c8f8
mov eax, dword [ebp - 0xc]
mov edx, dword [0x4c2ce8]
call fcn.00404084
jne 0x49ac2e
cmp byte [ebp - 1], 0
jne 0x49ac2e
cmp bl, 6
je 0x49ac2e
cmp bl, 5
jne 0x49ac41
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
call fcn.004689e8
test eax, eax
jne 0x49ac41
mov edx, dword [0x4c2ce8]
mov eax, dword [esi + 0x724]
call fcn.0047e234
jmp 0x49aca2
mov eax, dword [0x4c2bd8]
call fcn.00403f74
dec eax
jle 0x49ac9b
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
call fcn.004689e8
test eax, eax
jle 0x49ac9b
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
xor edx, edx
call fcn.00468a18
mov eax, dword [eax + 0x24]
mov edx, 0x49acf0
call fcn.00404084
je 0x49ac9b
mov eax, dword [esi + 0x5f8]
call fcn.004726b4
mov edx, esi
mov eax, esi
call fcn.004a03b4
jmp 0x49aca2
mov eax, esi
call fcn.004a0fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49acc4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403d18
ret