joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473f44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4740b3
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x474098
mov eax, 0x200
call fcn.00402b54
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x474091
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x30]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 4], edx
push 0x200
mov eax, dword [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4db958]
push eax
call sub.crypt32.dll_CertNameToStrA
cmp eax, 1
jbe 0x473fd0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040ae70
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 4]
call fcn.0040510c
push 0x200
mov eax, dword [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4db958]
push eax
call sub.crypt32.dll_CertNameToStrA
cmp eax, 1
jbe 0x474005
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040ae70
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 8]
call fcn.0040510c
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 4], edx
push 0x200
mov eax, dword [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4db958]
push eax
call sub.crypt32.dll_CertNameToStrA
cmp eax, 1
jbe 0x474049
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0040ae70
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0xc]
call fcn.0040510c
lea eax, [ebx + 0x44]
push eax
push 0
push 3
push esi
call sub.crypt32.dll_CertGetCertificateContextProperty
test eax, eax
je 0x47407b
cmp dword [ebx + 0x44], 0x32
ja 0x47407b
lea eax, [ebx + 0x44]
push eax
lea eax, [ebx + 0x10]
push eax
push 3
push esi
call sub.crypt32.dll_CertGetCertificateContextProperty
test eax, eax
je 0x47407b
lea eax, [ebx + 0x10]
mov dword [ebx + 0x48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474098
mov eax, dword [ebp - 0xc]
call fcn.00402b84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4740ba
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004050dc
ret

Function at 0x474490
Capabilities:
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
push esi
push edi
xor eax, eax
mov esi, 0x4ded30
mov edi, eax
and edi, 0xff
mov dl, 8
test edi, 1
je 0x4744b5
shr edi, 1
xor edi, 0xedb88320
jmp 0x4744b7
shr edi, 1
dec dl
jne 0x4744a3
mov dword [esi], edi
inc eax
add esi, 4
test al, al
jne 0x474499
pop edi
pop esi
ret
Function at 0x475998
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4183e0]
call fcn.00405bc0
xor eax, eax
push ebp
push 0x475adc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4dbaf4], 0
jne 0x4759eb
mov ecx, dword [0x4dc72c]
mov dl, 1
mov eax, dword [0x408b20]
call fcn.0040e004
call fcn.00404a48
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004037dc
mov eax, ebx
call fcn.00405974
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x475aec
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ed4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405984
test eax, eax
jle 0x475a83
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x475a7c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405340
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405328
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409a04
test eax, eax
jne 0x475a7c
mov ebx, 0x15
jmp 0x475a88
mov ebx, 0x10
jmp 0x475a88
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4dbaf4]
call fcn.004758f0
mov eax, dword [ebp - 8]
call fcn.004758f0
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475ae3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004050dc
lea eax, [ebp - 0x10]
mov edx, dword [0x4183e0]
call fcn.00405c90
ret
Function at 0x47771c
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x100c], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1008], edx
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
call fcn.00405378
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
call fcn.00405378
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
call fcn.00405578
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1014]
call fcn.00405378
push eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x1002]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1014]
mov ecx, 0x400
call fcn.00406144
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
call sub.winhttp.dll_WinHttpSendRequest
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4777ca
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
call sub.winhttp.dll_WinHttpReceiveResponse
test eax, eax
je 0x4777ca
mov bl, 1
jmp 0x477807
xor ebx, ebx
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x100c], 0x2f8f
jne 0x477807
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1008], 0
jbe 0x477807
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1008]
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x47780c
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
mov eax, dword [ebp + 8]
lea edx, [eax - 0x201a]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x2030]
mov ecx, 0x400
call fcn.00406144
push eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x1002]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x202c]
mov ecx, 0x400
call fcn.00406144
push eax
push ebx
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
call sub.winhttp.dll_WinHttpSetCredentials
mov eax, dword [ebp + 8]
push eax
call fcn.0047771c
pop ecx
mov eax, dword [ebp + 8]
add eax, 0xffffdfd8
push eax
mov eax, dword [ebp + 8]
add eax, 0xffffdfdc
push eax
mov eax, dword [ebp + 8]
add eax, 0xffffdfe0
push eax
push 0
push 0x20000013
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
pop ebx
pop ebp
ret
Function at 0x47d06c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x47d0f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4df204
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x47d0df
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040d700
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x47d10c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4dcd64]
mov dl, 1
mov eax, dword [0x47c3cc]
call fcn.0040e040
call fcn.00404a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d0fc
lea eax, [ebp - 0x1c]
call fcn.004050b8
ret

Function at 0x47d7bc
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0047d6e4
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004044b0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x47d820
call fcn.0047cfb4
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x47d812
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004044b0
pop esi
pop ebx
ret

Function at 0x47d8ec
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, edx
mov eax, ebx
call fcn.00405578
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp + 4], eax
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 4
call fcn.004037dc
cmp dword [esp + 4], 0
je 0x47d93e
mov eax, dword [esp + 4]
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 8], cl
mov cl, byte [edx + 1]
mov byte [esp + 9], cl
mov cl, byte [edx + 2]
mov byte [esp + 0xa], cl
mov al, byte [edx + 3]
mov byte [esp + 0xb], al
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop ebx
ret
Function at 0x47da24
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47da55
mov ecx, dword [0x4dcf08]
mov dl, 1
mov eax, dword [0x47c3cc]
call fcn.0040e004
call fcn.00404a48
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x47da82
mov ecx, dword [0x4dcb30]
mov dl, 1
mov eax, dword [0x47c3cc]
call fcn.0040e004
call fcn.00404a48
xor eax, eax
push ebp
push 0x47db03
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004044b0
cmp byte [ebp + 8], 0
je 0x47dadd
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047d98c
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047d740
jmp 0x47daf9
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047d2a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47db20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47dd04
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0047d568
xor eax, eax
push ebp
push 0x47de76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x47de60
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47dd50
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47dd5a
call fcn.00404af4
jmp 0x47de7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041d974
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x47de55
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x47de08
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x47ddf5
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004044b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0047dcbc
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x47de88]
cmp dl, byte [eax + 0x28]
je 0x47de5c
call fcn.0040df1c
jmp 0x47de5c
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041d994
jmp 0x47de5c
cmp edi, ebx
jge 0x47de24
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041d994
jmp 0x47dd5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041d974
cmp edx, dword [esp + 4]
jne 0x47de44
cmp eax, dword [esp]
pop edx
pop eax
jne 0x47dd5a
push ebp
call fcn.0047dcbc
pop ecx
jmp 0x47de5c
push ebp
call fcn.0047dcbc
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47de7d
mov eax, dword [ebp - 4]
call fcn.0047d574
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47de8c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47dfae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047d568
xor eax, eax
push ebp
push 0x47df91
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47dedc
call fcn.00404af4
jmp 0x47df98
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47df7b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47df7b
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004044b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47df7b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d700
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47dfc8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4dcd64]
mov dl, 1
mov eax, dword [0x47c3cc]
call fcn.0040e040
call fcn.00404a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47df98
mov eax, dword [ebp - 4]
call fcn.0047d574
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dfb5
lea eax, [ebp - 0x28]
call fcn.004050b8
ret
Function at 0x47e014
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47e15e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047d568
xor eax, eax
push ebp
push 0x47e141
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x47e079
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47e079
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x47e12b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47e08c
call fcn.00404af4
jmp 0x47e148
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47e12b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47e12b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004044b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47e12b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d700
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47e178
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4dcd64]
mov dl, 1
mov eax, dword [0x47c3cc]
call fcn.0040e040
call fcn.00404a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e148
mov eax, dword [ebp - 4]
call fcn.0047d574
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e165
lea eax, [ebp - 0x28]
call fcn.004050b8
ret

Function at 0x486bc4
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, eax
mov eax, 0xff
call fcn.00402b54
mov ebx, eax
push 0xfe
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
jne 0x486bff
mov ecx, 0x486c74
mov dl, 1
mov eax, dword [0x408b20]
call fcn.0040df48
call fcn.00404a48
push esp
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.00402b54
mov edi, eax
xor ebp, ebp
push edi
push esi
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x486c52
mov dword [esp], 0x34
push esp
lea eax, [esp + 8]
push eax
push 0x486c98
push edi
call sub.version.dll_VerQueryValueA
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x10]
call fcn.004084f0
mov ebp, eax
shl ebp, 8
mov eax, dword [esp + 4]
add bp, word [eax + 0x10]
mov edx, esi
mov eax, edi
call fcn.00402b84
mov eax, ebx
call fcn.00402b84
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x488b80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x488c96
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x488bf4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405150
cmp dword [ebp - 0x14], 0
je 0x488be5
mov eax, dword [ebp - 0x14]
call fcn.00405378
mov edx, dword [ebp - 0x14]
cmp byte [edx + eax - 1], 0x5c
jne 0x488be5
mov eax, dword [ebp - 0x14]
call fcn.00405378
mov edx, eax
dec edx
lea eax, [ebp - 0x14]
call fcn.00405704
push 0
mov ecx, dword [ebp + 8]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0047129c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00488aec
mov esi, dword [0x4dbf3c]
test esi, esi
jle 0x488c7b
mov edi, 1
xor ebx, ebx
cmp dword [0x4dbf38], 0
je 0x488c2d
mov ecx, 0x493e0
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4dbf44]
call fcn.004887c4
mov ebx, eax
cmp edi, 1
jle 0x488c3d
mov eax, dword [0x4dbf40]
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x488c71
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4dbf44]
call fcn.004888a0
cmp byte [ebp - 0xd], 0
jne 0x488c7b
inc edi
dec esi
jne 0x488c0e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488c9d
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004050dc
ret
Function at 0x48a50c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 3], cl
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48a783
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004050b8
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
and eax, dword [ebp - 8]
je 0x48a739
lea eax, [ebp - 0xb8]
mov edx, ebx
add dl, 0x41
call fcn.004052a0
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 0xc]
mov ecx, 0x48a79c
call fcn.004053c4
mov eax, dword [ebp - 0xc]
call fcn.00405578
push eax
call sub.kernel32.dll_GetDriveTypeA
mov edi, eax
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00405380
cmp byte [ebp - 1], 0
je 0x48a65b
mov eax, edi
cmp eax, 6
ja case.default.0x48a5ca
jmp dword [eax*4 + 0x48a5d1]
mov eax, esi
mov edx, 0x48a7a8
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7c0
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7d8
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7ec
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a800
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a814
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a828
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7a8
call fcn.00405380
mov al, byte [ebp - 3]
or al, byte [ebp - 2]
je 0x48a72d
test edi, edi
je 0x48a72d
cmp edi, 2
je 0x48a72d
push 0x50
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x50
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xbc]
mov edx, ebx
add dl, 0x41
call fcn.004052a0
lea eax, [ebp - 0xbc]
mov edx, 0x48a79c
call fcn.00405380
mov eax, dword [ebp - 0xbc]
call fcn.00405578
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48a72d
cmp byte [ebp - 2], 0
je 0x48a6f6
push dword [esi]
push 0x48a83c
lea eax, [ebp - 0xc0]
lea edx, [ebp - 0xb4]
call fcn.004052b0
push dword [ebp - 0xc0]
mov eax, esi
mov edx, 3
call fcn.00405438
cmp byte [ebp - 3], 0
je 0x48a72d
push dword [esi]
push 0x48a83c
push 0x48a848
lea eax, [ebp - 0xc4]
lea edx, [ebp - 0x64]
call fcn.004052b0
push dword [ebp - 0xc4]
push 0x48a854
mov eax, esi
mov edx, 5
call fcn.00405438
mov eax, esi
mov edx, 0x48a860
call fcn.00405380
inc ebx
cmp ebx, 0x20
jne 0x48a566
lea edx, [ebp - 0xc8]
mov eax, dword [esi]
call fcn.00409aa8
mov edx, dword [ebp - 0xc8]
mov eax, esi
call fcn.0040510c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a78a
lea eax, [ebp - 0xc8]
mov edx, 5
call fcn.004050dc
lea eax, [ebp - 0xc]
call fcn.004050b8
ret