joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a760
Capabilities:
Get socket status

Disassembly:
sub esp, 0x218
push ebx
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 8]
push eax
xor ebx, ebx
push edi
mov dword [edi + 0x130], ebx
call sym.Setup.exe_libssh2_keepalive_send
add esp, 8
cmp eax, ebx
jl 0x45a8b1
mov edx, dword [esp + 8]
mov ecx, edx
push edi
imul ecx, ecx, 0x3e8
call sym.Setup.exe_libssh2_session_block_directions
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x45a7b4
call fcn.00467640
mov ecx, 0x3e8
mov eax, dword [edi + 0x54]
cmp eax, ebx
push esi
jle 0x45a803
cmp edx, ebx
je 0x45a7c4
cmp edx, eax
jle 0x45a803
push ebx
call fcn.005ebd4c
mov ecx, dword [esp + 0x234]
push edx
mov edx, dword [esp + 0x234]
push eax
push ecx
push edx
call fcn.005f9e62
fmul qword [0x6a7120]
add esp, 0x14
call fcn.005ca9d0
mov ecx, dword [edi + 0x54]
cmp eax, ecx
jg 0x45a899
sub ecx, eax
mov esi, 1
jmp 0x45a80c
xor eax, eax
cmp ecx, ebx
setg al
mov esi, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
imul eax, eax, 0x3e8
sub ecx, eax
mov al, byte [esp + 0x10]
imul ecx, ecx, 0x3e8
push ebp
xor ebp, ebp
mov dword [esp + 0x1c], ecx
test al, 1
je 0x45a854
mov ecx, dword [edi + 0x11c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], 1
lea ebx, [esp + 0x20]
test al, 2
je 0x45a877
mov edx, dword [edi + 0x11c]
mov dword [esp + 0x128], edx
mov dword [esp + 0x124], 1
lea ebp, [esp + 0x124]
mov ecx, dword [edi + 0x11c]
neg esi
sbb esi, esi
lea eax, [esp + 0x18]
and esi, eax
push esi
push 0
push ebp
push ebx
inc ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
pop ebp
test eax, eax
jg 0x45a8ae
mov eax, 0xfffffff7
pop esi
mov dword [edi + 0x130], eax
pop edi
pop ebx
add esp, 0x218
ret
xor eax, eax
pop esi
pop edi
pop ebx
add esp, 0x218
ret
Function at 0x474d70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x474d91
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x474da9
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x474dc1
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x474dd7
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x474def
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x479550
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
je 0x479586
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x13c]
je 0x479586
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x13c]
jne 0x479599
jmp 0x4796fd
mov edx, dword [ebp - 4]
cmp dword [edx + 0x13c], 0
je 0x479623
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x14
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x13c]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x13c]
mov edx, dword [eax + 0x108]
call edx
push 0
push 0
push 0
push 0x67c164
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x13c]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047a000
mov edx, dword [ebp - 4]
mov dword [edx + 0x13c], 0
cmp dword [ebp + 8], 0
jne 0x47962e
jmp 0x4796fd
cmp dword [ebp + 8], 0
je 0x4796fd
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, dword [ebp - 4]
jne 0x4796fd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xc8]
call eax
movzx ecx, al
test ecx, ecx
je 0x4796fd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xd4]
call edx
movzx eax, al
test eax, eax
je 0x4796fd
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x13c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x15
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x13c]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x13c]
mov edx, dword [eax + 0x108]
call edx
push 0
push 0
push 0
push str.setfocus
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x13c]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047a000
mov esp, ebp
pop ebp
ret 4
Function at 0x47d810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x113
je 0x47d835
cmp dword [ebp - 4], 0x402
je 0x47d84b
jmp 0x47d853
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0047d870
jmp 0x47d853
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.004ff108
mov esp, ebp
pop ebp
ret 0xc

Function at 0x47d960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60d7d6
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x11c], ecx
push 0x67ea84
mov ecx, dword [ebp - 0x11c]
add ecx, 0x2c
call fcn.0047b3c0
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + 0x35c], eax
push 0x67ea98
mov ecx, dword [ebp - 0x11c]
add ecx, 0x2c
call fcn.0047b3c0
mov edx, dword [ebp - 0x11c]
mov dword [edx + 0x358], eax
push str.foreImage
mov ecx, dword [ebp - 0x11c]
add ecx, 0x2c
call fcn.0047b3c0
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + 0x3c0], eax
push str.version
mov ecx, dword [ebp - 0x11c]
add ecx, 0x2c
call fcn.0047b3c0
mov edx, dword [ebp - 0x11c]
mov dword [edx + 0x368], eax
lea ecx, [ebp - 0x94]
call fcn.004f056c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x368]
mov eax, dword [ebp - 0x11c]
mov edx, dword [edx]
mov ecx, dword [eax + 0x368]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x124], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x124]
push edx
lea ecx, [ebp - 0x94]
call fcn.004f06dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004f065e
mov ecx, dword [ebp - 0x11c]
add ecx, 0x384
call fcn.0047db80
push eax
lea ecx, [ebp - 0x94]
call fcn.004f07ec
push 0
push 0x32
push 0x3e8
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
mov edx, dword [ebp - 0x11c]
push edx
push 0x47d940
push 0
push 0
call fcn.005e79f3
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004f065e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4819d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x4819e0
xor al, al
jmp 0x481a20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4819f7
xor al, al
jmp 0x481a20
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x481a05
mov byte [ebp - 2], 1
jmp 0x481a1d
mov edx, dword [ebp - 8]
and edx, 0x10
jne 0x481a13
mov byte [ebp - 1], 0
jmp 0x481a17
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret

Function at 0x481a30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dac8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.0048c370
movzx eax, al
test eax, eax
je 0x481a6e
xor al, al
jmp 0x481b52
push 0
mov ecx, dword [ebp + 8]
call fcn.0047bff0
push eax
call fcn.004819d0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x481a8f
mov al, 1
jmp 0x481b52
mov dword [ebp - 0x38], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.0047bff0
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x28]
call fcn.0048c940
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
lea edx, [ebp - 0x34]
push edx
mov eax, dword [0x6c7aa4]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.005e7628
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x481b1e
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x28]
call fcn.0048c710
mov eax, dword [0x6c7aa4]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048c710
lea ecx, [ebp - 0x28]
call fcn.0047bff0
push eax
call fcn.005ec024
add esp, 4
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [0x6c7aa4]
push edx
push 0
call fcn.005e7628
add esp, 0xc
mov dword [ebp - 0x30], eax
jmp 0x481ad0
cmp dword [ebp - 0x38], 0xffffffff
jne 0x481b3c
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x29]
jmp 0x481b52
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x491c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ec78
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x491c40
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x491c4c
mov al, 1
jmp 0x491def
mov dword [ebp - 0x48], 8
call fcn.0047f810
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0047f810
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0047f790
add esp, 8
movzx eax, al
test eax, eax
je 0x491c8f
xor al, al
jmp 0x491def
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0048c8d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.0047bfd0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.00493cd0
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x491d0a
cmp dword [ebp - 0x38], 1
je 0x491d11
cmp dword [ebp - 0x38], 3
je 0x491dab
jmp 0x491dc3
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x491d74
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
push eax
call fcn.005eb678
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x491d74
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2d]
jmp 0x491def
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x491d97
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2e]
jmp 0x491def
cmp dword [ebp - 0x34], 0
jne 0x491da9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00491830
jmp 0x491ddb
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2f]
jmp 0x491def
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x30]
jmp 0x491def
jmp 0x491ca2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4a7c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f713
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0
push 0
mov eax, dword [ebp - 0x2c]
push eax
push 0x4a7bd0
push 0
push 0
call fcn.005e79f3
add esp, 0x18
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
push 1
push 3
lea ecx, [ebp - 0xe8]
call fcn.0048d880
mov dword [ebp - 4], 0
push str..log
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004a9180
push eax
call fcn.0049a740
add esp, 8
push 0x6a5a00
mov ecx, dword [ebp - 0x2c]
add ecx, 0x20
call fcn.004a9090
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0xe8]
call fcn.0048d7e0
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
call fcn.0047bff0
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x20
call fcn.0048c710
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00481790
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret

Function at 0x4a8420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f816
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0048c940
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.0048c940
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
push str.0.0B_S
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004a9090
mov edx, dword [ebp - 0x10]
xorps xmm0, xmm0
movsd qword [edx + 0x28], xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
push str.0.0B_S
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004a9090
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x50], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b4d80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610666
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x140], 0x100000
mov dword [ebp - 0x13c], 0
lea ecx, [ebp - 0x94]
call fcn.004f056c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x4b4e03
mov byte [ebp - 0x119], 1
jmp 0x4b4e0a
mov byte [ebp - 0x119], 0
mov cl, byte [ebp - 0x119]
mov byte [ebp - 0x11a], cl
movzx edx, byte [ebp - 0x11a]
test edx, edx
je 0x4b4ee5
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
call fcn.005ca750
cvtsd2ss xmm0, xmm0
divss xmm0, dword [0x6a7190]
divss xmm0, dword [0x6a7190]
divss xmm0, dword [0x6a7190]
cvtss2sd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
mov ecx, dword [ebp - 0x120]
add ecx, 0x4f8
call fcn.0047db80
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.004f0b06
add esp, 0x10
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
call fcn.005ca750
cvtsd2ss xmm0, xmm0
divss xmm0, dword [0x6a7190]
divss xmm0, dword [0x6a7190]
divss xmm0, dword [0x6a7190]
mov ecx, dword [ebp - 0x120]
movss dword [ecx + 0x4d8], xmm0
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
mov edx, dword [ebp - 0x120]
mov eax, dword [edx + 0x37c]
mov ecx, dword [ebp - 0x120]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x37c]
mov eax, dword [edx + 0x2c]
call eax
push 0x68ef5c
mov ecx, dword [ebp - 0x120]
add ecx, 0x2c
call fcn.0047b3c0
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x128]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x128]
mov edx, dword [eax + 0x28]
call edx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x138]
call fcn.004f0b96
push eax
mov ecx, dword [ebp - 0x120]
add ecx, 0x4e0
call fcn.0047db80
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.004f0b06
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004f065e
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
mov edx, dword [ebp - 0x120]
mov eax, dword [edx + 0x378]
mov ecx, dword [ebp - 0x120]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x378]
mov eax, dword [edx + 0x2c]
call eax
mov cl, byte [ebp - 0x11a]
mov byte [ebp - 0x121], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004f065e
mov al, byte [ebp - 0x121]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x4b56c0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6107b7
mov eax, dword fs:[0]
push eax
sub esp, 0x594
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x57c], ecx
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.005e3180
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.005e3180
add esp, 0xc
push 0x68f034
mov ecx, dword [ebp - 0x57c]
add ecx, 0x2c
call fcn.0047b3c0
mov dword [ebp - 0x578], eax
lea edx, [ebp - 0x4ec]
push edx
mov eax, dword [ebp - 0x578]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x578]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x580], eax
mov ecx, dword [ebp - 0x580]
mov dword [ebp - 0x584], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x584]
call fcn.004f0b96
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0047dbc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ec]
call fcn.004f065e
push 0x68f058
mov ecx, dword [ebp - 0x57c]
add ecx, 0x2c
call fcn.0047b3c0
mov dword [ebp - 0x578], eax
lea edx, [ebp - 0x570]
push edx
mov eax, dword [ebp - 0x578]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x578]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x588], eax
mov ecx, dword [ebp - 0x588]
mov dword [ebp - 0x58c], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x58c]
call fcn.004f0b96
push eax
lea ecx, [ebp - 0x450]
call fcn.0048c140
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x570]
call fcn.004f065e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x59c], esp
lea edx, [ebp - 0x450]
push edx
call fcn.0047dde0
mov dword [ebp - 0x5a0], eax
call fcn.004da670
add esp, 0x18
mov byte [ebp - 0x571], al
movzx eax, byte [ebp - 0x571]
test eax, eax
je 0x4b584b
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
jmp 0x4b585e
push 0
push 0x10
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x104
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x438]
call fcn.0048c140
mov byte [ebp - 4], 4
push 0x68f054
lea ecx, [ebp - 0x438]
call fcn.004c50e0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x57c]
call fcn.004c2130
mov dword [ebp - 0x590], eax
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x594], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x594]
push edx
lea ecx, [ebp - 0x438]
call fcn.004c5100
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x468]
call fcn.0047dc50
push 0
lea ecx, [ebp - 0x438]
call fcn.0047db80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047dbe0
mov dword [ebp - 0x598], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x438]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.0047dc50
mov eax, dword [ebp - 0x598]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 8
Function at 0x4bbbc0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x26
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esp, ebp
pop ebp
ret 4

Function at 0x4bc330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610e4f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x40
call fcn.005c9a55
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 1
mov eax, dword [ebp - 0x10]
add eax, 0x2c
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4b8]
mov eax, dword [ebp - 0x10]
mov edx, dword [edx]
mov ecx, dword [eax + 0x4b8]
mov eax, dword [edx + 0x30]
call eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004e10f0
mov dword [ebp - 0x14], eax
jmp 0x4bc3c1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x364], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x364]
call fcn.004e11c0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4cc], 1
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c0
call fcn.004c4b70
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
push 1
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x18]
mov edx, dword [eax + 0x13c]
call edx
push 0x6913fc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x4b8]
call fcn.004707d0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x55c], 1
jle 0x4bc459
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x564]
push eax
push 0x7d0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret