joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9c84
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov dword [0x53d314], 0x7e1
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403098
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d9cfe
cmp byte [ebp - 1], 0
je 0x4d9cfc
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4d9d05
mov bl, 1
xor eax, eax
mov dword [0x53d314], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4da924
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x53d314], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4da95b
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404820
jmp 0x4da962
mov eax, ebx
call fcn.004045b8
xor eax, eax
mov dword [0x53d314], eax
add esp, 0x108
pop ebx
ret

Function at 0x4da974
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x53d314], 0x7ea
push 0
push 0x18
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4da9ab
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404820
jmp 0x4da9b2
mov eax, ebx
call fcn.004045b8
xor eax, eax
mov dword [0x53d314], eax
add esp, 0x108
pop ebx
ret
Function at 0x4dee1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4def5d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x547848], 0
je 0x4def0d
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov edi, eax
mov edx, dword [0x54783c]
mov eax, 0x4def74
call fcn.00404bc8
test eax, eax
jle 0x4dee95
push 0x4def80
push dword [0x54783c]
push 0x4def8c
push dword [0x547840]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4deec2
push 0x4def98
push dword [0x54783c]
push 0x4def74
push dword [0x547840]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4defa8
call fcn.004048d8
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x547844]
call fcn.00404a84
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a84
push eax
push 0x4defb4
mov eax, esi
call fcn.0045de20
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4def42
push 1
mov eax, dword [0x547844]
call fcn.00404a84
push eax
mov eax, dword [0x547840]
call fcn.00404a84
push eax
mov eax, dword [0x54783c]
call fcn.00404a84
push eax
push 0x4defb4
mov eax, esi
call fcn.0045de20
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4def64
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret
Function at 0x4e6c10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e6d27
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004ab720
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x54745c
mov ecx, 0x105
call fcn.00404820
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.004048d8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046e0b0
mov ebx, eax
test ebx, ebx
je 0x4e6cf0
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.004037ac
mov eax, 0xc8
call fcn.004d8720
push 1
push 0x4e6d34
push 0x4e6d40
push dword [ebp - 4]
push 0x4e6d50
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x14]
call fcn.00404a84
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004ab720
mov eax, dword [ebp - 0x18]
call fcn.00404a84
push eax
push 0x4e6d54
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6d2e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x10]
call fcn.00404cf0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret

Function at 0x4e73f8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e74f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x80d
call sub.user32.dll_GetForegroundWindow
mov dword [ebx], eax
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4e749a
lea edx, [ebp - 4]
lea eax, [ebp - 0x88]
call fcn.00409f50
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e7475
lea edx, [ebp - 8]
lea eax, [ebp - 0x88]
call fcn.00409f50
jmp 0x4e747d
lea eax, [ebp - 8]
call fcn.004045b8
push dword [ebp - 4]
push 0x4e7510
push dword [ebp - 8]
push 0x4e751c
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040494c
xor esi, esi
mov edi, 0x53db70
cmp esi, 3
jl 0x4e74b7
mov edx, dword [ebp - 4]
mov eax, dword [edi]
call fcn.00404bc8
test eax, eax
setg bl
jmp 0x4e74c4
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.004049d0
sete bl
test bl, bl
jne 0x4e74da
inc esi
add edi, 4
cmp esi, 4
jne 0x4e74a1
xor ebx, ebx
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e74fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4e97c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9927
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x547570], 0
jbe 0x4e983a
mov ax, word [0x53d364]
cmp ax, word [0x547570]
jb 0x4e983a
mov eax, dword [0x53d32c]
mov dword [0x53d354], eax
mov eax, dword [0x53d330]
mov dword [0x53d358], eax
mov word [0x53d364], 0
mov eax, dword [ebx + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004ece90
mov dl, 1
mov ax, 2
call fcn.004d8dac
jmp 0x4e9911
cmp word [0x547572], 0
jbe 0x4e98a8
mov ax, word [0x53d364]
cmp ax, word [0x547572]
jb 0x4e98a8
mov eax, dword [0x53d32c]
mov dword [0x53d354], eax
mov eax, dword [0x53d330]
mov dword [0x53d358], eax
mov word [0x53d364], 0
cmp dword [0x547574], 0
je 0x4e98a8
lea eax, [ebp - 4]
mov ecx, dword [0x547574]
mov edx, 0x4e993c
call fcn.004048d8
lea eax, [ebp - 4]
call fcn.004da9c4
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
cmp word [0x547578], 0
jbe 0x4e9911
mov ax, word [0x53d364]
cmp ax, word [0x547578]
jb 0x4e9911
mov eax, dword [0x53d32c]
mov dword [0x53d354], eax
mov eax, dword [0x53d330]
mov dword [0x53d358], eax
mov word [0x53d364], 0
cmp dword [0x54757c], 0
je 0x4e9911
lea eax, [ebp - 4]
mov edx, dword [0x54757c]
call fcn.00404650
lea eax, [ebp - 4]
call fcn.004da9c4
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e992e
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4ef7fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4ef9b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x82d
cmp byte [0x53d3b8], 0
jne 0x4ef85e
cmp byte [0x53d3bc], 0
jne 0x4ef85e
mov eax, dword [0x5475b0]
call fcn.0046dd20
test al, al
je 0x4ef85e
push 1
push 0x4ef9c0
push 0x4ef9c4
mov eax, dword [0x5475b0]
call fcn.00404a84
push eax
push 0x4ef9c8
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5475a4]
call fcn.0046dd20
test al, al
je 0x4ef990
mov cl, 1
mov dl, 1
mov eax, dword [0x4b13f8]
call fcn.004b17fc
mov dword [0x53d3e0], eax
mov eax, dword [0x53d3e0]
mov edx, dword [0x4b13f8]
call fcn.0040395c
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, 0x10e
call fcn.004ab720
mov edx, dword [ebp - 4]
pop eax
call fcn.0040460c
mov eax, dword [0x53d3e0]
mov edx, dword [0x4b13f8]
call fcn.0040395c
mov byte [eax + 0x34], 0
mov eax, dword [0x53d3e0]
call fcn.0041f614
cmp dword [0x547590], 0
jne 0x4ef8e9
lea eax, [ebp - 8]
call fcn.00471374
mov edx, dword [ebp - 8]
mov eax, 0x547590
call fcn.0040460c
cmp dword [0x547590], 0
je 0x4ef941
mov cl, 1
mov dl, 1
mov eax, dword [0x4b13f8]
call fcn.004b17fc
mov dword [0x53d3e4], eax
mov eax, dword [0x53d3e4]
mov edx, dword [0x4b13f8]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x547590]
call fcn.0040460c
mov eax, dword [0x53d3e4]
mov edx, dword [0x4b13f8]
call fcn.0040395c
mov byte [eax + 0x34], 1
mov eax, dword [0x53d3e4]
call fcn.0041f614
mov cl, 1
mov dl, 1
mov eax, dword [0x4b13f8]
call fcn.004b17fc
mov dword [0x53d3e8], eax
mov eax, dword [0x53d3e8]
mov edx, dword [0x4b13f8]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x547588]
call fcn.0040460c
mov eax, dword [0x53d3e8]
mov edx, dword [0x4b13f8]
call fcn.0040395c
mov byte [eax + 0x34], 2
mov eax, dword [0x53d3e8]
call fcn.0041f614
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef9b9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4f00e0
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4f01d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov edi, eax
push edi
push 0x4efc40
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4f01b6
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416e60
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4f01ae
lea eax, [ebp - 4]
call fcn.00404adc
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409e14
test eax, eax
jne 0x4f01ae
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416e60
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f0192
cmp eax, 0xffffffff
je 0x4f01ae
cmp dword [ebp - 0xc], 0
je 0x4f01ae
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4f012d
mov eax, edi
call fcn.004037ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f01da
lea eax, [ebp - 4]
call fcn.004045b8
ret

Function at 0x4f01e4
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f01fd
cmp eax, 0xffffffff
je 0x4f0211
test ebx, ebx
je 0x4f0211
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4f14c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov dword [0x53d314], 0x834
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x4f15e6
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
and al, 0xdf
mov bl, al
cmp bl, 0x41
jb 0x4f15df
cmp bl, 0x43
jb 0x4f15c1
mov esi, ebx
and esi, 0xff
cmp byte [esi + 0x547765], 3
je 0x4f15c1
xor eax, eax
push ebp
push 0x4f15b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 5
jne 0x4f1567
mov byte [esi + 0x547765], 3
jmp 0x4f1585
cmp byte [ebp - 0xd], 3
jne 0x4f1585
mov eax, ebx
call fcn.00471c84
test al, al
jne 0x4f1581
mov byte [esi + 0x547765], 3
jmp 0x4f1585
mov byte [ebp - 0xd], 2
cmp byte [ebp - 0xd], 2
jne 0x4f15ad
mov eax, ebx
sub al, 0x41
inc eax
call fcn.00409c40
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f15c1
mov eax, dword [ebp - 0xc]
call fcn.00409d14
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
and al, 0xdf
mov bl, al
cmp bl, 0x41
jae 0x4f1520
xor eax, eax
mov dword [0x53d314], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2448
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
xor eax, eax
push ebp
push 0x4f2658
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x841
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 4
push 2
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x53da40]
cmp eax, 0x7a
jne 0x4f263d
mov eax, dword [ebp - 8]
call fcn.00408d98
mov dword [ebp - 4], eax
mov eax, dword [0x5477c0]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5477c4]
mov edx, dword [eax]
call dword [edx + 8]
push 0
push 4
push 2
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x53da40]
test eax, eax
jne 0x4f255e
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x4f255e
inc ebx
xor esi, esi
lea eax, [esi + esi*2]
mov edx, dword [ebp - 4]
lea edi, [edx + eax*8 + 4]
cmp dword [edi + 0xc], 0
je 0x4f255a
cmp dword [edi + 0x14], 0
je 0x4f255a
mov eax, dword [edi]
cmp eax, 3
je 0x4f2509
cmp eax, 4
je 0x4f2509
cmp eax, 5
jne 0x4f255a
mov edx, dword [edi + 0x14]
mov eax, dword [0x5477c0]
call fcn.00416ebc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x4f253e
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5477c4]
call fcn.00416e60
mov ecx, eax
inc ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5477c4]
call fcn.00416fac
jmp 0x4f255a
mov edx, dword [edi + 0x14]
mov eax, dword [0x5477c0]
call fcn.00416d04
mov edx, 1
mov eax, dword [0x5477c4]
call fcn.00416d04
inc esi
dec ebx
jne 0x4f24e2
mov eax, dword [ebp - 4]
call fcn.004027dc
mov eax, dword [0x5477c0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4f2636
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x5477c4]
call fcn.00416e60
cmp eax, 8
jbe 0x4f262e
mov edx, esi
mov eax, dword [0x5477c0]
call fcn.00416e60
mov edi, eax
xor eax, eax
call fcn.004b4454
mov dword [0x53dc14], eax
mov eax, edi
call fcn.004efc58
test al, al
jne 0x4f262e
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.004b4954
push edi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4f25df
cmp eax, 0xffffffff
je 0x4f25df
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
cmp dword [0x53d408], 0
je 0x4f262e
cmp dword [ebp - 0x10], 0
je 0x4f262e
push 0
lea edx, [ebp - 0x14]
mov eax, 0xec
call fcn.004ab720
mov eax, dword [ebp - 0x14]
call fcn.00404a84
push eax
lea edx, [ebp - 0x18]
mov eax, 0x25
call fcn.004abfb0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404894
mov eax, dword [ebp - 0x18]
call fcn.00404a84
push eax
push 0
call sub.user32.dll_MessageBoxA_1
inc esi
dec ebx
jne 0x4f257a
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f265f
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004045dc
ret
Function at 0x4f26b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x4f284a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x845
cmp dword [0x53da54], 0
je 0x4f27c4
push 0
push 0x1388
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
call fcn.00405a30
cmp edx, 0
jne 0x4f27c4
cmp eax, 0x4b0
jne 0x4f27c4
cmp dword [0x53db90], 0
jne 0x4f2721
mov dl, 1
mov eax, dword [0x4707e0]
call fcn.0040377c
mov dword [0x53db90], eax
mov eax, dword [0x53d448]
call fcn.00404ea0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4f2749
mov eax, dword [0x53d448]
push eax
mov eax, dword [0x53da54]
push eax
call fcn.0046de44
jmp 0x4f27c4
test al, 6
je 0x4f2761
push 0x20
mov eax, dword [0x53d448]
call fcn.00404ea0
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x4f2736
push 0xa
mov eax, dword [0x53d448]
push eax
mov eax, dword [0x53db90]
push eax
call fcn.0046defc
test al, al
je 0x4f2736
mov eax, dword [0x53db90]
call fcn.004196cc
push edx
push eax
mov eax, dword [0x53da54]
call fcn.004196cc
cmp edx, dword [esp + 4]
jne 0x4f2797
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4f2736
mov eax, dword [0x53db90]
call fcn.004196cc
mov ecx, eax
mov eax, dword [0x53da54]
mov edx, dword [eax + 4]
mov eax, dword [0x53db90]
mov eax, dword [eax + 4]
call fcn.00471dbc
test eax, eax
jne 0x4f2736
cmp dword [0x53d41c], 0
jle 0x4f282d
sub dword [0x53d41c], 0xc8
cmp dword [0x53d41c], 0
jg 0x4f2834
mov dword [0x53d41c], 0x4e20
lea eax, [ebp - 4]
mov edx, dword [0x547604]
call fcn.00404650
xor ebx, ebx
call fcn.004e7520
test al, al
jne 0x4f2805
mov bl, 1
mov eax, dword [ebp - 4]
call fcn.004e76b8
cmp eax, 2
je 0x4f281b
cmp dword [0x53db80], 3
jle 0x4f2822
mov bl, 1
call fcn.004e75d8
mov dl, 1
mov eax, ebx
call fcn.004e78e0
jmp 0x4f2834
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2851
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4f28d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor edx, edx
push ebp
push 0x4f2a37
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [0x53d314], 0x847
cmp al, byte [0x53dc3c]
je 0x4f2a15
mov byte [0x53dc3c], al
cmp dword [0x54797c], 0
jne 0x4f2923
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov dword [0x54797c], eax
mov eax, dword [0x54797c]
mov eax, dword [eax + 8]
test eax, eax
jle 0x4f2959
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f294f
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x54797c]
call fcn.00416e60
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4f2939
mov eax, dword [0x54797c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x547564]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [0x53ec70]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 2], al
cmp byte [0x53dc3c], 0
je 0x4f2a15
mov bl, 0x41
cmp bl, byte [ebp - 1]
je 0x4f2a0b
cmp bl, byte [ebp - 2]
je 0x4f2a0b
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404798
lea eax, [ebp - 0xc]
mov edx, 0x4f2a4c
call fcn.00404894
mov eax, dword [ebp - 0xc]
call fcn.00404a84
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4f2a0b
lea edx, [ebp - 0x10]
mov eax, 0x7d
call fcn.004ab720
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404798
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
pop ecx
call fcn.004048d8
push 0
push 0x22
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 8]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
je 0x4f2a0b
mov edx, eax
mov eax, dword [0x54797c]
call fcn.00416d04
inc ebx
cmp bl, 0x5b
jne 0x4f297e
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2a3e
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004045dc
ret

Function at 0x4f2ed0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
mov eax, dword [ebp - 8]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4f2f7a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0046dde0
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0046dde0
cmp esi, eax
jne 0x4f2f33
mov eax, dword [ebp - 4]
call fcn.00470a94
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00470a94
cmp edx, dword [esp + 4]
jne 0x4f2f2f
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f2f5f
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.0040986c
push 0
lea eax, [ebp - 8]
call fcn.00404adc
push eax
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2f81
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4f9fe8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
mov eax, dword [ebp - 8]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4fa08c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046dde0
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0046dde0
mov ecx, eax
test ecx, ecx
jle 0x4fa06f
test ebx, ebx
jle 0x4fa04e
mov eax, ecx
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x4fa041
mov bl, 1
jmp 0x4fa071
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.0040986c
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
lea eax, [ebp - 8]
call fcn.00404adc
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4fa071
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa093
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret