joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddc18
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059e0
lea eax, [ebp - 0x280]
mov edx, dword [0x40a000]
call fcn.004063b0
xor eax, eax
push ebp
push 0x4ddde7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cbb4
test al, al
je 0x4ddd9b
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405a4c
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0xc]
call fcn.00405c74
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x284]
mov edx, 1
call fcn.00409e40
mov eax, dword [ebp - 0x284]
mov edx, 0x4dddfc
call fcn.00405910
je 0x4ddcca
lea eax, [ebp - 0xc]
mov edx, 0x4dde0c
call fcn.00405d4c
lea eax, [ebp - 0x28c]
mov ecx, 0x4dde1c
mov edx, dword [ebp - 0xc]
call fcn.00405dcc
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.0040cd70
test eax, eax
jne 0x4ddd88
mov eax, dword [ebp - 0x26c]
mov edx, 0x4dde2c
call fcn.00406044
je 0x4ddd75
mov eax, dword [ebp - 0x26c]
mov edx, 0x4dde3c
call fcn.00406044
je 0x4ddd75
test byte [ebp - 0x270], 0x10
je 0x4ddd49
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405dcc
mov eax, dword [ebp - 0x290]
call fcn.004ddc18
jmp 0x4ddd75
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405dcc
mov eax, 0x4f8490
mov edx, dword [ebp - 8]
call fcn.004059f8
mov eax, dword [ebp - 8]
call fcn.00405a84
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x280]
call fcn.0040cdc0
test eax, eax
je 0x4ddcfb
lea eax, [ebp - 0x280]
call fcn.0040cde4
mov eax, dword [ebp - 0xc]
call fcn.0040d34c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dddee
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.004059f0
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.00405680
lea eax, [ebp - 0x280]
mov edx, dword [0x40a000]
call fcn.00406488
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004059f0
ret

Function at 0x4de168
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4de22b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x26
lea eax, [ebp - 0x20e]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00405bf8
lea eax, [ebp - 0x218]
mov edx, dword [ebp - 4]
call fcn.00405c74
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov edx, 1
call fcn.00409e40
mov eax, dword [ebp - 0x214]
mov edx, 0x4de23c
call fcn.00405910
je 0x4de1fb
lea eax, [ebp - 4]
mov edx, 0x4de24c
call fcn.00405d4c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004059f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de232
lea eax, [ebp - 0x218]
mov edx, 2
call fcn.00405680
lea eax, [ebp - 4]
call fcn.004059e8
ret
Function at 0x4df770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4df778
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df9d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004e2e04
test eax, eax
jne 0x4df826
push 0x40
lea edx, [ebp - 8]
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
call fcn.0047ce58
mov eax, dword [ebp - 8]
call fcn.00405a84
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x3ac]
call fcn.0045c4d8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00405c74
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, 2
call fcn.00409e24
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xf
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4df9ec
call fcn.0040dca4
mov eax, dword [ebp - 0xc]
call fcn.00405a84
push eax
mov eax, ebx
call fcn.00464dfc
push eax
call sub.user32.dll_MessageBoxW
xor edx, edx
mov eax, ebx
call fcn.004dfaa8
jmp 0x4df989
lea edx, [ebp - 0x24]
mov eax, dword [0x4f848c]
mov eax, dword [eax + 0x3ac]
call fcn.0045c4d8
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x414]
call fcn.004059f8
mov edx, dword [ebx + 0x414]
mov eax, ebx
call fcn.004e28b8
test al, al
jne 0x4df8a0
mov eax, dword [ebx + 0x3b4]
cmp eax, esi
jne 0x4df8a0
cmp dword [ebx + 0x44c], 0
jne 0x4df8a0
push 0x24
lea edx, [ebp - 0x28]
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
call fcn.0047ce58
mov eax, dword [ebp - 0x28]
call fcn.00405a84
push eax
push 0x4dfa20
mov eax, ebx
call fcn.00464dfc
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 7
je 0x4df989
mov eax, dword [ebx + 0x414]
call fcn.0040cbb4
test al, al
jne 0x4df8ba
mov eax, dword [ebx + 0x414]
call fcn.0040cbd8
lea eax, [ebp - 0x30]
mov edx, dword [ebx + 0x414]
call fcn.00405c74
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov edx, 1
call fcn.00409e40
mov eax, dword [ebp - 0x2c]
mov edx, 0x4dfa4c
call fcn.00405910
je 0x4df8f7
lea eax, [ebx + 0x414]
mov edx, 0x4dfa5c
call fcn.00405d4c
xor edx, edx
mov eax, ebx
call fcn.004e32e4
xor edx, edx
mov eax, dword [ebx + 0x384]
call fcn.0045c420
xor edx, edx
mov eax, dword [ebx + 0x394]
call fcn.0045c420
mov dl, 1
mov eax, dword [ebx + 0x3d0]
call fcn.0045c420
mov dl, 1
mov eax, dword [ebx + 0x388]
call fcn.0045c420
mov dl, 1
mov eax, dword [ebx + 0x3cc]
call fcn.0045c420
mov eax, dword [ebx + 0x3cc]
call fcn.0045c780
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
call fcn.0047d330
mov eax, ebx
call fcn.004e1344
mov eax, ebx
call fcn.004e3788
mov eax, ebx
call fcn.004e3554
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4de294
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x400], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df9da
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00405680
lea eax, [ebp - 0x28]
call fcn.004059e8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004059f0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405680
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004059f0
ret
Function at 0x4dfd54
Capabilities:
Hide graphical window

Disassembly:
test al, al
je 0x4dfd63
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
cmp byte [eax + 0xcf], 0
je 0x4dfd98
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x4dfd98
push 0
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
call fcn.00464dfc
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x4f15f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4e1c58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e1e16
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4e1e34
mov edx, dword [esi + 0x414]
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e1d0c
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e1d0c
push 0x4e1e4c
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1cbf
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4e1e64
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1cda
call edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e1d06
push 0x4e1e84
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1cf3
call edi
push 0x4e1ea4
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1d06
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e1ed0
mov edx, dword [esi + 0x414]
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e1d58
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e1d58
push 0x4e1eec
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1d52
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e1f24
mov edx, dword [esi + 0x414]
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e1da4
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e1da4
push 0x4e1f44
push ebx
call fcn.00408518
mov edi, eax
test edi, edi
je 0x4e1d9e
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e1f84
mov edx, dword [esi + 0x414]
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e1dfb
push 0x4e1fb0
push dword [ebp - 4]
push 0x4e1fc8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405e9c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a84
push eax
push 0x4e1fcc
push 0x4e1fe8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1e1d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004059f0
ret
Function at 0x4e1ff4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e20b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x414]
call fcn.00405a4c
cmp dword [ebx + 0x434], 0
je 0x4e2099
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405a4c
call fcn.004ddb20
test eax, eax
je 0x4e2048
lea eax, [ebp - 8]
mov edx, 0x4e20d0
call fcn.00405d4c
jmp 0x4e2055
lea eax, [ebp - 8]
mov edx, 0x4e2104
call fcn.00405d4c
mov eax, dword [ebp - 8]
call fcn.0040cb6c
test al, al
je 0x4e2099
push 0x4e2134
push dword [ebp - 8]
push 0x4e214c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e9c
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405a84
push eax
push 0x4e2150
push 0x4e216c
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e20bd
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004059f0
ret
Function at 0x4e2178
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e234b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x414]
call fcn.00405a4c
cmp dword [ebx + 0x424], 0
je 0x4e2225
mov dl, 1
mov eax, dword [0x42dbe4]
call fcn.0042dd50
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.0042ddf0
lea eax, [ebp - 0xc]
mov ecx, dword [ebx + 0x424]
mov edx, 0x4e2368
call fcn.00405dcc
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0042e714
test al, al
jne 0x4e21f3
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0042de58
mov cl, 1
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0042df34
test al, al
je 0x4e221c
mov ecx, dword [ebx + 0x414]
mov edx, 0x4e2388
mov eax, esi
call fcn.0042e488
mov eax, esi
call fcn.0042ddc0
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, ebx
call fcn.004e1c58
lea eax, [ebp - 8]
mov ecx, 0x4e23a0
mov edx, dword [ebp - 4]
call fcn.00405dcc
mov eax, dword [ebp - 8]
call fcn.0040cb6c
test al, al
je 0x4e2319
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405a4c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405c74
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov edx, 1
call fcn.00409e40
mov eax, dword [ebp - 0x10]
mov edx, 0x4e23bc
call fcn.00405910
jne 0x4e22cd
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4e229e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4e229e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00405238
mov ebx, eax
test ebx, ebx
je 0x4e22a9
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00405c74
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, ebx
dec edx
call fcn.00409e24
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405c60
push 0x4e23cc
push dword [ebp - 0xc]
push 0x4e23cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e9c
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405a84
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x4e23a0
mov edx, dword [ebp - 4]
call fcn.00405dcc
mov eax, dword [ebp - 0x20]
call fcn.00405a84
push eax
push 0x4e23d0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2352
lea eax, [ebp - 0x20]
call fcn.004059e8
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405680
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004059f0
ret
Function at 0x4e2cc0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e2db6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x3ac]
call fcn.0045c4d8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 4]
call fcn.0040cfb4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004069bc
call fcn.004069bc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x418]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x11
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x3c]
call fcn.004e2a80
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x11
lea edx, [ebp - 0x38]
mov ecx, 1
mov eax, 0x4e2dd0
call fcn.0040dca4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0x3c4]
call fcn.0045c510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2dbd
lea eax, [ebp - 0x3c]
call fcn.004059e8
lea eax, [ebp - 0x28]
call fcn.004059e8
lea eax, [ebp - 0x24]
call fcn.004059e8
lea eax, [ebp - 4]
call fcn.004059e8
ret

Function at 0x4e2e04
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e2ee8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x3ac]
call fcn.0045c4d8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 4]
call fcn.0040cfb4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004069bc
call fcn.004069bc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406a04
call fcn.00406a04
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, 0xc8
mov eax, dword [ebx + 0x418]
call fcn.0040c6fc
mov ecx, eax
mov eax, ecx
cdq
cmp edx, dword [ebp - 0xc]
jne 0x4e2ec3
cmp eax, dword [ebp - 0x10]
setb al
jmp 0x4e2ec6
setl al
neg al
sbb ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2eef
lea eax, [ebp - 0x24]
call fcn.004059e8
lea eax, [ebp - 4]
call fcn.004059e8
ret
Function at 0x4e2ef8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059e0
xor eax, eax
push ebp
push 0x4e2fab
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040cfb4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00405a84
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004069bc
call fcn.004069bc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406a04
call fcn.00406a04
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2fb2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004059f0
ret

Function at 0x4e2fbc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4e315b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20c]
push eax
push 0x103
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00405bf8
mov eax, dword [ebp - 4]
call fcn.004e2ef8
cmp eax, 0x12c
jge 0x4e3083
mov bx, 0x43
lea eax, [ebp - 0x418]
mov edx, ebx
call fcn.00405b64
lea eax, [ebp - 0x418]
mov edx, 0x4e3174
call fcn.00405d4c
mov eax, dword [ebp - 0x418]
call fcn.004e2ef8
cmp eax, 0x12c
jle 0x4e307c
lea eax, [ebp - 0x41c]
mov edx, ebx
call fcn.00405b64
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 4]
mov ecx, 0x4e3184
call fcn.00405dcc
jmp 0x4e3083
inc ebx
cmp bx, 0x5b
jne 0x4e302b
lea eax, [ebp - 0x414]
push eax
push 0
push 0x4e318c
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x4e30c4
lea eax, [ebp - 4]
lea edx, [ebp - 0x414]
mov ecx, 0x104
call fcn.00405bf8
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x424]
mov edx, dword [ebp - 4]
call fcn.00405c74
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x420]
mov edx, 1
call fcn.00409e40
mov eax, dword [ebp - 0x420]
mov edx, 0x4e3198
call fcn.00405910
je 0x4e3107
lea eax, [ebp - 4]
mov edx, 0x4e31a8
call fcn.00405d4c
mov eax, dword [ebp - 4]
call fcn.0040cbb4
test al, al
jne 0x4e311b
mov eax, dword [ebp - 4]
call fcn.0040cbd8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004059f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3162
lea eax, [ebp - 0x424]
mov edx, 2
call fcn.00405680
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.004059f0
lea eax, [ebp - 4]
call fcn.004059e8
ret
Function at 0x4e3380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3471
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x7dc
mov eax, dword [ebx + 0x41c]
push eax
mov eax, dword [ebx + 0x420]
push eax
call fcn.004dc6b8
test eax, eax
je 0x4e3456
mov eax, dword [0x4f848c]
call fcn.00479064
lea eax, [ebp - 4]
mov ecx, 0x4e348c
mov edx, dword [0x4f84a0]
call fcn.00405dcc
lea eax, [ebp - 8]
mov edx, 0x4e34dc
call fcn.00405a4c
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e3411
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a84
push eax
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
push 0x4e34ec
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e3430
lea eax, [ebp - 4]
mov ecx, 0x4e3504
mov edx, dword [0x4f84a0]
call fcn.00405dcc
or ecx, 0xffffffff
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004dd98c
mov esi, eax
mov eax, dword [0x4f848c]
call fcn.0047906c
mov eax, ebx
call fcn.00464dfc
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3478
lea eax, [ebp - 8]
mov edx, 2
call fcn.004059f0
ret
Function at 0x4e4074
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e417d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x468], 0
je 0x4e40d8
mov edx, dword [ebx + 0x414]
lea eax, [ebp - 4]
mov ecx, 0x4e4198
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e40d8
push 0
push 0
push 0x4e41b8
mov eax, dword [ebp - 4]
call fcn.00405a84
push eax
push 0x4e41cc
push 0
call sub.shell32.dll_ShellExecuteW
mov dl, 1
mov eax, dword [0x42dbe4]
call fcn.0042dd50
mov dword [ebp - 8], eax
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0042ddf0
mov cl, 1
mov edx, 0x4e41e4
mov eax, dword [ebp - 8]
call fcn.0042df34
test al, al
je 0x4e415d
xor eax, eax
push ebp
push 0x4e414b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x468], 0
jne 0x4e412f
xor ecx, ecx
mov edx, 0x4e4224
mov eax, dword [ebp - 8]
call fcn.0042e58c
jmp 0x4e4141
mov ecx, 1
mov edx, 0x4e4224
mov eax, dword [ebp - 8]
call fcn.0042e58c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e415d
mov dl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4184
lea eax, [ebp - 4]
call fcn.004059e8
ret
Function at 0x5cd370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5cd38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x5f6074
push ecx
mov edi, eax
call fcn.005e1198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5cd3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.005e102e
push esi
call fcn.005e0fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret