joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1648
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c1676
mov eax, ebx
call fcn.004c20fc
cmp dword [ebx + 0x40], 0
je 0x4c166f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c16e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c16d9
cmp dword [ebx + 8], 0
je 0x4c1698
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c16aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c16d9
cmp dword [ebx + 8], 0
je 0x4c168b
cmp eax, 3
je 0x4c16bd
dec eax
jne 0x4c168b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c168b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c168b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c1705
cmp dword [ebx + 0x14], 0xcc
je 0x4c1705
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c1710
pop ebx
ret

Function at 0x4da48c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x58fdf4]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or dword [ebp - 0x10], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jne 0x4da49c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4da4e3
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x4da4e6
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4da4d0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x58f9f4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x4da4c5
mov esp, ebp
pop ebp
ret
Function at 0x4da50c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4da524
cmp dword [ebp - 8], 0
jg 0x4da52e
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4da6b2
mov dword [ebp - 0x10], 0xdbc66688
cmp dword [0x58f9f0], 0
je 0x4da543
call fcn.004da48c
xor dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 8], 8
jl 0x4da677
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
sub dword [ebp - 8], 8
cmp dword [ebp - 8], 8
jge 0x4da551
cmp dword [ebp - 8], 0
je 0x4da6a9
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x58f9f4]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x4da67d
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4dc7c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4dc7f1
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4dc870
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004daa1c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4dc83e
mov cx, word [esp]
sub cx, si
jmp 0x4dc840
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4dc827
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4dc866
mov cx, word [esp]
sub cx, si
jmp 0x4dc868
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4dc84f
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4dc8cd
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004dc498
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4dc8b8
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4dc8cd
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4dc7ce
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e2778
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4e27f7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
mov cl, byte [eax]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
xor cl, byte [eax]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
mov byte [eax], cl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4e2798
mov esp, ebp
pop ebp
ret
Function at 0x4e516c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4e51a0
add eax, 3
sar eax, 2
test eax, eax
jle 0x4e52fe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x4e51dd
je 0x4e5243
sub eax, 0x2b
je 0x4e522f
sub eax, 4
je 0x4e5239
dec eax
sub eax, 0xa
jb 0x4e5219
jmp 0x4e524b
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x4e51ef
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4e5203
jmp 0x4e524b
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4e524b
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4e524b
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4e524b
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x4e524b
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x4e524b
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x4e51ba
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x4e52af
cmp byte [ebp - 0x21], 0xff
jne 0x4e52af
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x4e52ef
cmp byte [ebp - 0x22], 0xff
je 0x4e52ef
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x4e51b5
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e6478
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403bfc
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e66fc
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405894
xor eax, eax
push ebp
push 0x4e684a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004e6478
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004058a4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4e6829
xor eax, eax
push ebp
push 0x4e6822
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e680b
xor eax, eax
push ebp
push 0x4e6804
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e67ed
xor eax, eax
push ebp
push 0x4e67e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004e64d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e67ed
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e680b
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6829
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004e65ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6851
lea eax, [ebp - 4]
call fcn.00405404
ret
Function at 0x4e8370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4e8490
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
jne 0x4e83cd
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x4e83cd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e846e
mov dl, 1
mov eax, dword [0x41abf8]
call fcn.00404474
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e8467
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403548
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00420340
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
jne 0x4e8451
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x4e8451
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e846e
mov eax, dword [ebp - 0x10]
call fcn.004044a4
ret
cmp dword [ebp - 4], 0
je 0x4e847a
mov eax, dword [ebp + 8]
add dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8497
lea eax, [ebp - 0x18]
call fcn.00405404
ret
Function at 0x4ece44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040b098
mov eax, dword [ebp - 8]
call fcn.004058a4
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x41abf8]
call fcn.00404474
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ecede
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00420340
xor eax, eax
push ebp
push 0x4ecebe
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0042026c
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ecec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecee5
mov eax, dword [ebp - 0x10]
call fcn.004044a4
ret

Function at 0x4ecef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ed024
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00403bfc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
cmp byte [ebp - 9], 0
je 0x4ecf44
mov word [ebp - 0x30], 1
jmp 0x4ecf4a
mov word [ebp - 0x30], 0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040b324
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ecf6c
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4ecf9e
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, 0x4ed03c
call fcn.0040c174
jmp 0x4ecfc4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0xb
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x4ed04c
call fcn.0040c174
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004058a4
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004058a4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4ecffb
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x10], eax
jmp 0x4ed000
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed02b
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405428
ret

Function at 0x4ed054
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x108]
call fcn.0040b8e8
mov esp, ebp
pop ebp
ret
Function at 0x4ed324
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ed35b
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4ed7f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x178]
mov edx, dword [0x409268]
call fcn.00406068
xor eax, eax
push ebp
push 0x4ed933
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040fe6c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.0040549c
lea eax, [ebp - 0x17c]
mov ecx, 0x4ed94c
mov edx, dword [ebp - 0xc]
call fcn.0040572c
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x178]
mov edx, 0x3f
call fcn.0040b144
test eax, eax
jne 0x4ed8f0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x164]
call fcn.0040549c
mov eax, dword [ebp - 0x10]
mov edx, 0x4ed958
call fcn.0040583c
je 0x4ed8d6
mov eax, dword [ebp - 0x10]
mov edx, 0x4ed964
call fcn.0040583c
je 0x4ed8d6
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0xc]
call fcn.0040572c
mov eax, dword [ebp - 0x168]
and eax, 0x10
cmp eax, 0x10
jne 0x4ed8c8
mov eax, dword [ebp - 0x10]
call fcn.004ed7f4
jmp 0x4ed8d6
mov eax, dword [ebp - 0x10]
call fcn.004058a4
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x178]
call fcn.0040b194
test eax, eax
je 0x4ed873
lea eax, [ebp - 0x178]
call fcn.0040b1b8
mov eax, dword [ebp - 0xc]
call fcn.0040b690
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed93a
lea eax, [ebp - 0x17c]
call fcn.00405404
lea eax, [ebp - 0x178]
mov edx, dword [0x409268]
call fcn.00406138
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405428
ret

Function at 0x4edda8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ede29
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00405684
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 8]
call fcn.0040a440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ede30
lea eax, [ebp - 0x118]
call fcn.00405404
ret
Function at 0x4ee05c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405894
xor eax, eax
push ebp
push 0x4ee1d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x628
call fcn.00403bfc
lea edx, [ebp - 0xc]
mov eax, dword [0x5a3b78]
call fcn.00477b14
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ee1e0
call fcn.004072f8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ee1f0
call fcn.004072f8
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00405da0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405db0
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x158]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x105
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
mov eax, dword [ebp - 8]
add eax, 0x310
push eax
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x20a
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x314
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x314
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
mov eax, dword [ebp - 8]
add eax, 0x620
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
mov eax, dword [ebp - 8]
add eax, 0x624
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebp - 0x14]
call fcn.004072b4
lea eax, [ebp - 0x10]
call fcn.004072b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee1db
lea eax, [ebp - 0x18]
call fcn.00405c1c
lea eax, [ebp - 0x14]
call fcn.004072b4
lea eax, [ebp - 0x10]
call fcn.004072b4
lea eax, [ebp - 0xc]
call fcn.004072b4
lea eax, [ebp - 4]
call fcn.00405404
ret

Function at 0x4f0a8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405894
xor eax, eax
push ebp
push 0x4f0aef
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
call fcn.004f0b70
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4f0ad5
lea eax, [ebp - 4]
call fcn.004f0b70
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4f0ad9
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0af6
lea eax, [ebp - 4]
call fcn.00405404
ret