joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446b50
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x553d34
push str.patch.bin
call fcn.00521cc9
mov edi, eax
add esp, 8
test edi, edi
je 0x446c59
push str.Metin.exe
call fcn.0051bd0f
push str.patch.bin
mov esi, eax
call fcn.0051bd0f
add esp, 8
cmp eax, esi
je 0x446c59
push edi
call fcn.005286e7
push 0x555d60
push 0x555d88
call fcn.00521c77
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00527170
add esp, 0x18
mov dword [ebp - 0x58], 0x44
mov eax, 5
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
movaps xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.metin.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x446c34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x555d9c
push 0x555dbc
call fcn.00521c77
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x446c44
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x446c4e
push eax
call esi
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x446d70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x662094]
cmp eax, 0x17c
ja 0x446e25
je 0x446e1e
add eax, 0xffffff92
cmp eax, 0xfa
ja case.0x446dae.113
movzx eax, byte [eax + 0x446ed8]
jmp dword [eax*4 + 0x446e98]
push 0x555dcc
jmp 0x446e38
push 0x555e00
jmp 0x446e38
push 0x555e48
jmp 0x446e38
push 0x555e80
jmp 0x446e38
push str.metin.ini
jmp 0x446e38
push str.Windows
jmp 0x446e38
push 0x555fe0
jmp 0x446e38
push 0x556020
jmp 0x446e38
push 0x556054
jmp 0x446e38
push 0x556128
jmp 0x446e38
push str.ini
jmp 0x446e38
push str.npgmup.des
jmp 0x446e38
push 0x5562a4
jmp 0x446e38
push 0x5562e8
jmp 0x446e38
push 0x5563cc
jmp 0x446e38
push 0x556090
jmp 0x446e38
cmp eax, 0x1f4
je 0x446e33
push str._GameGuard
jmp 0x446e38
push 0x556408
lea eax, [ebp - 0x104]
push eax
call fcn.0041f000
add esp, 8
lea eax, [ebp - 0x204]
push dword [0x662094]
push 0x5564e0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push dword [0x6e2098]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
Function at 0x446fe0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x662094]
add eax, 0xfffffc17
cmp eax, 0xe
ja case.0x447009.1003
movzx eax, byte [eax + 0x4470c8]
jmp dword [eax*4 + 0x4470b0]
push dword [0x662098]
lea eax, [ebp - 0x104]
push 0x5564f8
push eax
call fcn.0041f000
add esp, 0xc
jmp case.0x447009.1003
push dword [0x662098]
lea eax, [ebp - 0x104]
push 0x556514
push eax
call fcn.0041f000
add esp, 0xc
jmp case.0x447009.1003
push 0x55652c
jmp 0x447054
push 0x556548
lea eax, [ebp - 0x104]
push eax
call fcn.0041f000
add esp, 8
push dword [0x662094]
lea eax, [ebp - 0x204]
push str.GameGuard_Error:_lu
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push dword [0x6e2098]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.GameGuard_Error
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret

Function at 0x447120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push edi
mov edi, dword [ebp + 8]
push 0x45
push 0
push eax
call fcn.00527170
push esi
push dword [0x6e44a8]
lea eax, [ebp - 0x4c]
push edi
push str._s_d__s
push eax
call fcn.0041f000
add esp, 0x20
lea ecx, [ebp - 0x4c]
mov eax, 0x6620a8
pop edi
pop esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x447188
test dl, dl
je 0x447184
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x447188
add eax, 2
add ecx, 2
test dl, dl
jne 0x447168
xor eax, eax
jmp 0x44718d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4471b5
lea eax, [ebp - 0x4c]
push eax
push 0x45
push 0x6620a8
call fcn.00534367
push 0x6620a8
push 0
push 0x447240
call fcn.00535311
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
Function at 0x4491f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6e44ac], 0
push esi
mov esi, ecx
je 0x449236
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x6e2098]
jne 0x449236
mov dword [0x69590c], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x589d90]
mov al, byte [eax + 0x1bb]
cmp al, 2
je 0x449249
cmp al, 1
jne 0x44921d
cmp byte [esi + 0x321db], 2
je 0x4494a8
mov eax, dword [0x69590c]
inc eax
mov dword [0x69590c], eax
cmp eax, 0xa
jl 0x4494a8
xorps xmm0, xmm0
mov ecx, esi
push edi
movups xmmword [esi + 0x321cc], xmm0
call fcn.00440030
mov dword [esi + 0x321cc], eax
call fcn.0053289f
cdq
mov ecx, 3
idiv ecx
lea edi, [edx + 1]
call dword [0x5c3c68]
imul ecx, edi, 0xea60
pop edi
add eax, ecx
mov dword [esi + 0x321d0], eax
cmp byte [0x6e1307], 0
je 0x4492b7
or dword [esi + 0x321d4], 1
cmp byte [0x6e1308], 0
je 0x4492c7
or dword [esi + 0x321d4], 2
cmp byte [0x6e1309], 0
je 0x4492d7
or dword [esi + 0x321d4], 4
cmp byte [0x6e1303], 0
je 0x4492e7
or dword [esi + 0x321d4], 8
cmp byte [0x6e1305], 0
je 0x4492f7
or dword [esi + 0x321d4], 0x10
cmp byte [0x6e12ff], 0
je 0x449307
or dword [esi + 0x321d4], 0x20
cmp byte [0x6e1300], 0
je 0x449317
or dword [esi + 0x321d4], 0x40
cmp byte [0x6e1301], 0
je 0x44932a
or dword [esi + 0x321d4], 0x80
cmp byte [0x6e1383], 0
je 0x44933d
or dword [esi + 0x321d4], 0x100
cmp byte [0x6e1385], 0
je 0x449350
or dword [esi + 0x321d4], 0x200
cmp byte [0x6e1380], 0
je 0x449363
or dword [esi + 0x321d4], 0x400
cmp byte [0x6e1388], 0
je 0x449376
or dword [esi + 0x321d4], 0x800
mov al, byte [0x6e207c]
cmp al, 1
jne 0x44938e
or dword [esi + 0x321d4], 0x1000
mov al, byte [0x6e207c]
cmp al, 2
jne 0x44939c
or dword [esi + 0x321d4], 0x2000
cmp byte [0x6e207e], 0
je 0x4493af
or dword [esi + 0x321d4], 0x4000
mov eax, dword [0x589d90]
push 0x104
push 0
movzx eax, byte [eax + 0x1b4]
mov byte [esi + 0x321d8], al
mov eax, dword [0x589d90]
movzx eax, byte [eax + 0x1bb]
mov byte [esi + 0x321d9], al
lea eax, [ebp - 0x20c]
push eax
call fcn.00527170
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x6e2098]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00527170
add esp, 0xc
mov ecx, 0x555858
mov eax, 0x6e23a8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x449441
test dl, dl
je 0x44943d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x449441
add eax, 2
add ecx, 2
test dl, dl
jne 0x449421
xor eax, eax
jmp 0x449446
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [esi + 0x3076d]
je 0x449457
push 0x555844
jmp 0x44945c
push 0x555870
push eax
push 0x6e23a8
push 0x555864
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00431ee0
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.005294d0
add esp, 0xc
test eax, eax
je 0x4494a1
mov byte [esi + 0x321da], 1
mov byte [esi + 0x321db], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052388c
mov esp, ebp
pop ebp
ret
Function at 0x44cbf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
mov edx, dword [ebx + 0x168]
mov esi, dword [ebx + 0x16c]
cmp edx, 1
jle 0x44cd2f
cmp esi, 1
jle 0x44cd2f
mov ecx, dword [ebp + 0x10]
movsx eax, word [ecx + 4]
dec eax
mov dword [ebp - 4], eax
cmp edx, eax
jge 0x44cd2f
movsx eax, word [ecx + 6]
dec eax
mov dword [ebp - 8], eax
cmp esi, eax
jge 0x44cd2f
mov eax, dword [ecx]
lea ecx, [edx + edx*4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + esi*4]
cmp byte [eax + ecx*4], 1
ja 0x44cd2f
mov eax, dword [eax + ecx*4 + 8]
test al, al
js 0x44cd2f
test eax, eax
js 0x44cd2f
mov esi, dword [ebp + 8]
push edi
cmp esi, 1
jle 0x44cd22
mov edi, dword [ebp + 0xc]
cmp edi, 1
jle 0x44cd22
cmp esi, dword [ebp - 4]
jge 0x44cd22
cmp edi, dword [ebp - 8]
jge 0x44cd22
mov eax, dword [ebp - 0xc]
lea ecx, [esi + esi*4]
mov eax, dword [eax + edi*4]
cmp byte [eax + ecx*4], 1
ja 0x44cd22
mov eax, dword [eax + ecx*4 + 8]
test al, al
js 0x44cd22
test eax, eax
js 0x44cd22
cmp esi, edx
jne 0x44ccdd
cmp edi, dword [ebx + 0x16c]
jne 0x44ccdd
mov esi, dword [0x583850]
push 0x556860
call fcn.00404580
push eax
push esi
call fcn.00470bb0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0044d730
push 0x10
call fcn.00523854
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [eax], ebx
push 0
push 0
push eax
push 0x44da40
push 0
push 0
mov dword [eax + 4], esi
mov dword [eax + 8], edi
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov dword [ebx + 0x480], eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [0x583850]
push 0x556850
jmp 0x44ccc5
mov esi, dword [0x583850]
push 0x556850
call fcn.00404580
push eax
push esi
call fcn.00470bb0
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44d730
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + 0x480]
test eax, eax
je 0x44d76e
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x480]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x480], 0
test ebx, ebx
je 0x44d76e
mov ecx, ebx
call fcn.004489c0
cmp dword [edi + 0x390], 0
je 0x44d81d
push esi
mov esi, dword [edi + 0x384]
test esi, esi
je 0x44d81c
cmp dword [edi + 0x388], 0
je 0x44d81c
mov esi, dword [esi + 0x44]
test esi, esi
je 0x44d7b0
nop
push esi
mov esi, dword [esi + 0x44]
call fcn.005294aa
add esp, 4
test esi, esi
jne 0x44d7a0
mov eax, dword [edi + 0x388]
mov esi, dword [eax + 0x44]
test esi, esi
je 0x44d7d0
nop dword [eax]
push esi
mov esi, dword [esi + 0x44]
call fcn.005294aa
add esp, 4
test esi, esi
jne 0x44d7c0
push dword [edi + 0x384]
call fcn.005294aa
push dword [edi + 0x388]
mov dword [edi + 0x384], 0
call fcn.005294aa
add esp, 8
mov dword [edi + 0x388], 0
mov dword [edi + 0x390], 0
mov dword [edi + 0x394], 0
test ebx, ebx
je 0x44d81c
mov ecx, ebx
call fcn.004489c0
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x45b1b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [0x59ac14]
push 0xff
call fcn.0051ae6d
mov ecx, dword [0x59ac14]
jmp fcn.0051aeb9
jmp 0x430890
Function at 0x464930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push str.vmp_3
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
mov eax, dword [ebp + 8]
test eax, eax
je 0x46498e
mov edx, eax
push esi
lea esi, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x464950
sub edx, esi
pop esi
je 0x46498e
mov edx, 0x697bb0
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x464963
push 0
push 0
push 0x697bb0
push 0x465f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop ebp
ret 4
Function at 0x4657c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b388
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x20]
push str.vmp_6
mov dword [ebp - 4], 0
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x184]
mov byte [ebp - 0x184], 0x5c
push eax
lea ecx, [ebp + 8]
call fcn.00466750
inc eax
lea ecx, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0043a0c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x180]
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4658bc
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp byte [ebp - 0x154], 0x2e
je 0x4658a8
test byte [ebp - 0x180], 0x10
jne 0x4658a8
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00404c50
add esp, 0xc
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.00415030
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
cmp eax, 0x10
jb 0x4658a8
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404ab0
lea eax, [ebp - 0x180]
push eax
push edi
call esi
test eax, eax
jne 0x465857
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4658d1
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404ab0
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
cmp eax, 0x10
jb 0x4658f8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00404ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret

Function at 0x465cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x465d0b
push str.vmp_1
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
mov eax, dword [ebp + 0xc]
mov edx, 0x697aa8
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x465ce0
push 0
push 0
push 0x697aa8
push 0x466150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop ebp
ret 8
Function at 0x469e00
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b82c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x582654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push 0x49c500
push 0x469dc0
push 4
push 0xc
lea edi, [ebx + 0x68]
mov dword [ebx], 0xffffffff
push edi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0xffffffff
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0xffffffff
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
call fcn.00524067
push 0x64
push 0
push ebx
mov dword [ebp - 4], 0
call fcn.00527170
mov ecx, 4
add esp, 0xc
mov dword [ebp - 0x10], ecx
nop
mov eax, dword [edi]
mov byte [ebp - 4], 1
mov ebx, dword [eax + 4]
mov esi, ebx
cmp byte [ebx + 0xd], 0
jne 0x469f41
push dword [esi + 8]
mov ecx, edi
call fcn.004a2c70
mov esi, dword [esi]
push ebx
call fcn.00523887
add esp, 4
mov ebx, esi
cmp byte [esi + 0xd], 0
je 0x469f21
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
mov byte [ebp - 4], 0
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
add edi, 0xc
sub ecx, 1
mov dword [ebp - 0x10], ecx
jne 0x469f10
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471be0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54bcd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x582654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call esi
mov edi, eax
push edi
mov dword [ebp - 0x10], edi
call fcn.005238ab
add esp, 4
mov ebx, eax
push ebx
push edi
call esi
xor edi, edi
cmp dword [ebp - 0x10], edi
jbe 0x471ca1
nop word [eax + eax]
lea esi, [edi + ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x471c89
inc dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x471c89
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
shrd ecx, eax, 0x1e
shr eax, 0x1e
add dword [ebp - 0x18], ecx
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471c90
sub eax, edx
inc edi
add edi, eax
cmp edi, dword [ebp - 0x10]
jb 0x471c50
push ebx
call fcn.005238b4
mov eax, dword [ebp + 0x20]
add esp, 4
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
jae 0x471cc2
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x10], 1
cmp ecx, dword [eax]
jb 0x471cc6
mov byte [ebp - 0x10], 0
cmp byte [ebp + 0x28], 0
je 0x471cfa
push dword [ebp - 0x10]
lea eax, [ebp + 8]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404820
mov ecx, dword [ebp - 0x1c]
call fcn.00430030
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x471d0f
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00404ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x473890
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push edi
push str._s.tar
push eax
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x214], 0
call fcn.0041f000
lea eax, [ebp - 0x204]
push 0x55486c
push eax
call fcn.00521cc9
add esp, 0x14
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x4738f6
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x208], eax
push esi
test ebx, ebx
jle 0x4739ba
nop dword [eax + eax]
push eax
push edi
lea eax, [ebp - 0x104]
push str._s_d.dv
push eax
call fcn.0041f000
lea eax, [ebp - 0x104]
push 0x553d34
push eax
call fcn.00521cc9
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4739ad
push 2
push 0
push ebx
call fcn.00528c9d
push ebx
call fcn.0052920f
push 0
push 0
push ebx
mov edi, eax
call fcn.00528c9d
push edi
call fcn.005238ab
push ebx
push 1
mov esi, eax
push edi
push esi
call fcn.00528933
push dword [ebp - 0x210]
push 1
push edi
push esi
call fcn.00529452
add esp, 0x40
push 1
push esi
call fcn.0052389d
push ebx
call fcn.005286e7
mov eax, dword [ebp - 0x208]
add esp, 0xc
mov ebx, dword [ebp + 0xc]
inc eax
mov edi, dword [ebp - 0x20c]
mov dword [ebp - 0x208], eax
cmp eax, ebx
jge 0x4739ba
jmp 0x473910
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x214], 1
push dword [ebp - 0x210]
call fcn.005286e7
add esp, 4
cmp dword [ebp - 0x214], 0
je 0x4739e0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x473a0d
xor esi, esi
test ebx, ebx
jle 0x473a0d
push esi
push edi
lea eax, [ebp - 0x104]
push str._s_d.dv
push eax
call fcn.0041f000
lea eax, [ebp - 0x104]
push eax
call fcn.00535d38
inc esi
add esp, 0x14
cmp esi, ebx
jl 0x4739e6
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0052388c
mov esp, ebp
pop ebp
ret
Function at 0x474780
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2144
call fcn.00523cc0
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x140
xor ebx, ebx
lea eax, [ebp - 0x2144]
push ebx
push eax
call fcn.00527170
add esp, 0xc
lea eax, [ebp - 0x2144]
push eax
push str..upg
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4747e3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
push esi
lea esi, [ebp - 0x2004]
nop word [eax + eax]
lea eax, [ebp - 0x2118]
mov edx, esi
mov ecx, eax
inc ebx
add esi, 0x20
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x474800
lea eax, [ebp - 0x2144]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4747f0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x474865
push 0x473a60
push 0x20
lea eax, [ebp - 0x2004]
push ebx
push eax
call fcn.005337f0
add esp, 0x10
xor esi, esi
test ebx, ebx
jle 0x474865
lea edi, [ebp - 0x2004]
nop dword [eax]
push edi
call fcn.00473aa0
add esp, 4
test eax, eax
je 0x47487b
inc esi
add edi, 0x20
cmp esi, ebx
jl 0x474850
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0052388c
mov esp, ebp
pop ebp
ret

Function at 0x486770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
movzx eax, byte [esi]
sub eax, 0
je 0x4867c1
sub eax, 1
jne 0x4867cf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4867cf
mov eax, dword [ecx]
push edi
call dword [eax + 4]
sub eax, dword [esi + 0xc]
mov edi, dword [ebp + 0xc]
cmp edi, eax
jbe 0x4867a2
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax]
add eax, dword [esi + 0xc]
push edi
push eax
push dword [ebp + 8]
call fcn.00526b40
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4867cf
pop esi
pop ebp
jmp fcn.005228c0
xor eax, eax
pop esi
pop ebp
ret 8