joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce120
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push esi
mov esi, ecx
push edi
mov ecx, dword [0x67a8cc]
push 0
push eax
push ecx
call ebx
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
lea eax, [esp + 0x24]
push 4
push eax
call edi
mov eax, dword [esp + 0x2c]
mov word [esi], ax
and eax, 0xffff
shl eax, 1
push eax
call fcn.00478e60
mov dword [esi + 4], eax
mov ecx, dword [0x67a8cc]
xor edx, edx
push ecx
mov dx, word [esi]
push edx
push 2
push eax
call edi
mov eax, dword [0x67a8e4]
mov ecx, dword [esp + 0x44]
add esp, 0x30
test eax, ecx
je 0x4ce1af
xor ecx, ecx
push 1
mov cx, word [esi]
and ecx, 0x80000001
jns 0x4ce1a0
dec ecx
or ecx, 0xfffffffe
inc ecx
mov edx, dword [0x67a8cc]
shl ecx, 1
push ecx
push edx
call ebx
add esp, 0xc
mov ecx, dword [esi + 4]
xor eax, eax
mov ax, word [esi]
push eax
push ecx
call fcn.004ce2c0
add esp, 8
mov byte [esi + 3], al
pop edi
pop esi
pop ebx
ret 8

Function at 0x4ce1d0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push esi
mov esi, ecx
push edi
mov ecx, dword [0x67a8cc]
push 0
push eax
push ecx
call ebx
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
lea eax, [esp + 0x28]
push 4
push eax
call edi
mov cx, word [esp + 0x30]
lea eax, [esp + 0x28]
mov word [esi], cx
mov edx, dword [0x67a8cc]
push edx
push 1
push 4
push eax
call edi
xor ecx, ecx
mov cx, word [esi]
shl ecx, 1
push ecx
call fcn.00478e60
mov edx, dword [esp + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call ebx
mov ecx, dword [0x67a8cc]
mov eax, dword [esi + 4]
xor edx, edx
push ecx
mov dx, word [esi]
push edx
push 2
push eax
call edi
mov edx, dword [esi + 4]
xor ecx, ecx
mov cx, word [esi]
add esp, 0x4c
push ecx
push edx
call fcn.004ce2c0
add esp, 8
mov byte [esi + 3], al
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4cee10
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
or eax, 0xffffffff
push 0
lea esi, [edi + 4]
lea ebx, [edi + 0xc]
mov word [esi + 2], 0
mov word [esi], 0
mov word [esi + 6], ax
mov word [esi + 4], ax
mov eax, dword [esp + 0x14]
mov dword [ebx], 0
mov dword [edi], 0x556090
mov ecx, dword [0x67a8cc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
push edx
push 1
push 8
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fread]
call esi
mov eax, dword [0x67a8cc]
push eax
push 1
push 8
push ebx
call esi
add esp, 0x2c
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x4cf860
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x547fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.004cee10
lea edi, [esi + 0x18]
xor ebp, ebp
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x14], ebp
mov dword [edi], ebp
mov dword [esi], 0x563664
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x24]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x2c], ebp
call ebx
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
jle 0x4cf91d
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x67a8cc]
push 0
push ecx
push edx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x67a8cc]
push eax
push 1
push 4
push edi
call ebx
mov ecx, dword [edi]
push ecx
call fcn.00478e60
mov ecx, dword [edi]
mov dword [esi + 0x14], eax
mov edx, dword [0x67a8cc]
push edx
push ecx
push 1
push eax
call ebx
mov edx, dword [0x67a8cc]
push 0
push ebp
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x40
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4cfb10
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x548023
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0x14], edi
call fcn.004cef30
lea esi, [edi + 0x14]
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 4], ebx
mov word [esi], bx
mov byte [esi + 3], bl
mov byte [esi + 2], 1
mov dword [edi], 0x54cb54
mov ecx, dword [0x67a8cc]
push ecx
mov byte [esp + 0x28], 1
call dword [sym.imp.MSVCRT.dll_ftell]
mov edx, dword [esp + 0x34]
add esp, 4
mov ecx, esi
push edx
push eax
call fcn.004ce120
lea ebp, [edi + 0x20]
xor eax, eax
mov dword [esp + 0x15], eax
lea edx, [esp + 0x14]
mov dword [ebp], ebx
mov ecx, dword [0x67a8cc]
push ecx
push 4
mov word [esp + 0x21], ax
push 1
push edx
mov byte [esp + 0x24], bl
mov byte [esp + 0x2b], al
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov esi, str.tflg
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4cfbd9
cmp cl, bl
je 0x4cfbd5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4cfbd9
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4cfbb5
xor eax, eax
jmp 0x4cfbde
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4cfc1a
mov eax, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push eax
lea esi, [edi + 0x1c]
push 1
push 4
push esi
call ebx
mov ecx, dword [0x67a8e4]
mov eax, dword [esi]
add esp, 0x10
test eax, ecx
je 0x4cfc2d
mov edx, dword [0x67a8cc]
push edx
push 1
push 4
push ebp
call ebx
add esp, 0x10
jmp 0x4cfc2d
mov eax, dword [0x67a8cc]
push 1
push 0xfffffffffffffffc
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x4d01b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x548078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
xor eax, eax
or ecx, 0xffffffff
push esi
mov word [ebx + 6], ax
mov word [ebx + 4], ax
mov word [ebx + 0xa], cx
mov word [ebx + 8], cx
push edi
mov dword [esp + 0xc], ebx
mov dword [ebx + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], eax
mov dword [ebx], 0x56369c
movsx eax, word [0x6969de]
shl eax, 3
push eax
call fcn.00478e60
mov dword [ebx + 0x18], eax
movsx ecx, word [0x6969de]
shl ecx, 2
push ecx
call fcn.00478e60
mov edi, eax
xor eax, eax
mov dword [ebx + 0x20], edi
mov esi, dword [esp + 0x30]
movsx ecx, word [0x6969de]
shl ecx, 2
mov edx, ecx
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movsx ecx, word [0x6969de]
mov edi, dword [ebx + 0x18]
shl ecx, 3
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x24]
mov ecx, ebx
push eax
mov dword [ebx + 8], edx
call fcn.004d00f0
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x4d0490
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push edi
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x67a8cc]
lea ebx, [esi + 4]
push eax
push 1
push 4
push ebx
call edi
mov ecx, dword [ebx]
shl ecx, 2
push ecx
call fcn.00478e60
mov ecx, dword [ebx]
mov dword [esi + 8], eax
mov edx, dword [0x67a8cc]
push edx
push ecx
push 4
push eax
call edi
mov edx, dword [0x67a8cc]
add esp, 0x40
lea eax, [esp + 0xc]
push edx
push 1
push 0x10
push eax
call edi
push 0x24
call fcn.004784b0
add esp, 0x14
test eax, eax
je 0x4d052e
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x4d0530
xor eax, eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x10]
or edx, 0xffffffff
pop edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4d0610
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5480a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa24
mov eax, dword [esp + 0xa34]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x34], esi
call fcn.004cef30
lea ebx, [esi + 0x14]
xor ebp, ebp
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x18], ebp
mov dword [ebx], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi], 0x5636d4
mov edx, dword [0x67a8cc]
xor ecx, ecx
push edx
mov dword [esp + 0x20], ecx
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x28], ecx
push 0x10
push eax
mov dword [esp + 0xa4c], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], ecx
call edi
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
mov dword [esp + 0x3c], eax
add esp, 0x14
lea eax, [esp + 0x34]
mov ecx, 0x140
mov dword [eax], ebp
add eax, 8
dec ecx
jne 0x4d06a3
mov edx, dword [esp + 0x20]
mov eax, dword [0x67a8cc]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push edx
push eax
call ebp
movsx edx, word [0x6969de]
mov ecx, dword [0x67a8cc]
lea eax, [esp + 0x40]
push ecx
push edx
push 8
push eax
call edi
mov ecx, dword [esp + 0x34]
mov edx, dword [0x67a8cc]
push 0
push ecx
push edx
call ebp
mov eax, dword [0x67a8cc]
push eax
push 1
push 4
push ebx
call edi
mov ecx, dword [ebx]
shl ecx, 2
push ecx
call fcn.00478e60
mov dword [esi + 0x18], eax
mov edx, dword [0x67a8cc]
xor eax, eax
push edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
push 1
lea eax, [esp + 0x54]
push 4
push eax
call edi
mov ecx, dword [esp + 0x68]
mov edx, dword [0x67a8cc]
add esp, 0x4c
add ecx, 4
push 0
push ecx
push edx
call ebp
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x20]
push eax
push 1
push 4
push ecx
call edi
mov eax, dword [ebx]
add esp, 0x1c
xor edi, edi
test eax, eax
jbe 0x4d07a4
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d0775
lea edx, [esp + 0x34]
lea ecx, [esp + 0x10]
push edx
lea edx, [esi + 4]
push ecx
push edx
mov ecx, eax
call fcn.004d01b0
jmp 0x4d0777
xor eax, eax
mov ecx, dword [esi + 0x18]
mov dword [ecx + edi*4], eax
mov edx, dword [esp + 0x10]
push edx
mov ecx, esi
call fcn.004d0820
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.004d0820
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
inc edi
cmp edi, eax
jb 0x4d0750
push 0x18
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov byte [esp + 0xa3c], 1
je 0x4d07cc
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, eax
call fcn.004d0490
jmp 0x4d07ce
xor eax, eax
mov edx, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call ebp
mov ecx, dword [esp + 0xa40]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa30
ret 4
Function at 0x4d0820
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
movsx eax, word [0x6969de]
lea edx, [ecx + eax*8 - 8]
mov eax, dword [0x67a8cc]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0xc]
push ecx
push 1
push 8
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [ecx + eax*2]
add esp, 0x24
ret 4

Function at 0x4d1450
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [str._proc_devices]
sub esp, 0x400
push ebx
xor ebx, ebx
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 8
cmp esi, ebx
jle 0x4d14c8
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
push esi
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
pop edi
jle 0x4d14c8
lea edx, [esp + 8]
push str.tsc7846
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
cmp eax, ebx
je 0x4d14be
cmp byte [eax], bl
je 0x4d14be
mov ebx, 1
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, ebx
pop esi
pop ebx
add esp, 0x400
ret
Function at 0x4d2010
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x585050
push str.tp_matrix.dat
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4d204f
mov eax, dword [esp + 0xc]
push esi
push 1
push 0x38
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov eax, 1
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x4d2060
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push 0x58518c
push str.tp_matrix.dat
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4d209f
mov eax, dword [esp + 0xc]
push esi
push 1
push 0x38
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov eax, 1
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x4d4560
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.004d3d20
push esi
call fcn.004d36a0
add esp, 4
test eax, eax
je 0x4d458c
push eax
call fcn.004d37d0
add esp, 4
mov eax, 1
pop esi
ret 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ecx, ecx
pop esi
test eax, eax
setge cl
mov eax, ecx
ret 4
Function at 0x4d4cb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x808
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._proc_bus_input_devices]
push ebx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x10], esi
jle 0x4d4d92
push ebp
lea ecx, [esp + 0x18]
push 0x800
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x4d4d77
mov ebp, dword [esp + 0x820]
xor edi, edi
test ebp, ebp
jle 0x4d4d77
mov esi, dword [esp + 0x81c]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov edx, dword [esi]
lea eax, [esp + 0x18]
push edx
push eax
call ebx
add esp, 8
test eax, eax
je 0x4d4d3a
cmp byte [eax], 0
jne 0x4d4d44
inc edi
add esi, 4
cmp edi, ebp
jge 0x4d4d73
jmp 0x4d4d24
push str.event
push eax
call ebx
add esp, 8
test eax, eax
je 0x4d4d73
cmp byte [eax], 0
je 0x4d4d73
mov ecx, dword [esp + 0x824]
mov edx, dword [eax]
mov dword [esp + 0x10], 1
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x808
ret 0xc
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x808
ret 0xc

Function at 0x4d4dc0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.005322e0
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._proc_bus_usb_devices]
mov dword [esp + 0x14], str.Driverusb_storage
push eax
mov dword [esp + 0x1c], str.WLAN_Adapter
call dword [sym.imp.MSVCRT.dll__open]
mov ebp, eax
add esp, 8
cmp ebp, ebx
jle 0x4d4e55
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x4d4e4b
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
xor esi, esi
mov edx, dword [esp + esi + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call edi
add esp, 8
test eax, eax
je 0x4d4e43
or ebx, dword [esi + 0x67a8e4]
add esi, 4
cmp esi, 8
jl 0x4d4e2a
push ebp
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
call fcn.00488f40
mov esi, eax
mov ecx, esi
call fcn.004af400
test eax, eax
je 0x4d4e75
mov eax, dword [esi + 0xc]
test ah, 8
je 0x4d4e75
or ebx, dword [0x67a8e8]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x1008
ret
Function at 0x4d4f90
Capabilities:
Create directory

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
xor edi, edi
call fcn.00493e00
mov ecx, eax
call fcn.00491dc0
cmp eax, dword [esi + 0x1c]
je 0x4d4fb2
mov dword [esi + 0x1c], eax
mov ecx, esi
call fcn.004d48d0
mov ebp, eax
mov eax, dword [esi]
cmp ebp, eax
je 0x4d50dc
push ebx
push ebp
push str.curStatus:_d
call fcn.00458ab0
mov eax, dword [esi]
add esp, 8
xor eax, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
mov esi, 0x67a8e4
mov ebx, 0x618af8
mov edi, 0x585e74
jmp 0x4d4ff5
mov eax, dword [esp + 0x1c]
test dword [esi], eax
je 0x4d50a8
call fcn.00493e00
mov ecx, eax
call fcn.00491dc0
mov dword [esp + 0x14], eax
mov eax, dword [esi]
test ebp, eax
je 0x4d508f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp edi, 0x585ed4
jge 0x4d504d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
call fcn.004d4ef0
test eax, eax
jne 0x4d504d
push edi
push ebp
push str.mount_failed_curStatus:_d__DevName_Usbs:_s
call fcn.00458ab0
mov ecx, dword [esi]
add esp, 0xc
not ecx
and ebp, ecx
jmp 0x4d50a8
push ebx
call fcn.004d5120
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
or eax, edx
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 3
push eax
push 0x23c1
call fcn.00493e00
mov ecx, eax
call fcn.004904b0
push 1
push 0x2394
call fcn.00493e00
mov ecx, eax
call fcn.004903e0
jmp 0x4d50a8
mov ecx, dword [esp + 0x10]
push 1
add ecx, 0x23c1
push ecx
call fcn.00493e00
mov ecx, eax
call fcn.00490410
mov ecx, dword [esp + 0x10]
add edi, 0x20
inc ecx
add ebx, 0x100
add esi, 4
cmp edi, 0x585ef4
mov dword [esp + 0x10], ecx
jl 0x4d4ff1
mov edx, dword [esp + 0x18]
pop ebx
pop edi
pop esi
mov dword [edx], ebp
mov eax, 1
pop ebp
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x4d5120
Capabilities:
Create directory

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x108]
push ebp
push esi
push edi
mov ebp, 0x56378c
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add ebp, 4
cmp ebp, 0x5637b0
jl 0x4d5136
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
Function at 0x4d5300
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004d56a0
mov ebp, dword [esp + 0x14]
mov eax, dword [0x67a8cc]
push 0
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
lea edx, [esp + 0x20]
push 2
push edx
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x2a]
push eax
push 1
push 2
push ecx
call edi
mov dx, word [esp + 0x38]
mov ax, word [esp + 0x3a]
mov word [esp + 0x40], dx
mov word [esp + 0x42], ax
mov ecx, dword [esp + 0x40]
mov dword [esi + 8], ecx
mov edx, dword [0x67a8cc]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [esi]
add esp, 0x3c
test eax, eax
jg 0x4d5386
mov dword [esi], 0
pop edi
pop esi
pop ebp
pop ecx
ret 8
shl eax, 2
push ebx
push eax
call fcn.00478e60
mov ecx, dword [esi]
add esp, 4
shl ecx, 2
push ecx
mov ecx, 0x6d07d8
mov dword [esi + 4], eax
call fcn.004bb1f0
mov edx, dword [0x67a8cc]
mov ecx, dword [esi]
push edx
push ecx
push 4
push eax
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esi]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x4d5503
mov edx, dword [esp + 0x18]
lea edi, [edx + 2]
movsx eax, word [edi - 2]
add eax, 0xfffffeff
cmp eax, 5
ja case.default.0x4d53e1
jmp dword [eax*4 + 0x4d5528]
push 0x1ec
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046e420
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
push 0x1e4
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046f3a0
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
push 0x1f0
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046e940
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
push 0x1f4
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046ed70
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
push 0x1f0
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046f580
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
push 0x1ec
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4d54e1
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046ebf0
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
mov edx, dword [esi + 4]
xor eax, eax
mov dword [edx + ebx*4], eax
jmp 0x4d54f5
mov eax, dword [esi + 4]
mov dword [eax + ebx*4], 0
mov eax, dword [esi]
inc ebx
add edi, 4
cmp ebx, eax
jl 0x4d53cf
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, 0x6d07d8
call fcn.004bb220
mov edx, dword [esp + 0x1c]
mov ecx, esi
push edx
call fcn.004d5640
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x4d65f0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret