joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9654
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d976d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c80
mov esi, 0x4d977c
lea edi, [ebp - 0x201]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x201]
push eax
push 0x200
push 0x200
mov ecx, 0x4d9980
mov edx, 0x4d9984
mov eax, 0x4d9990
call fcn.004b5ee0
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.00404ef0
cmp dword [ebp - 0x208], 0
jne 0x4d9716
mov eax, 0x90
call fcn.0040285c
mov esi, eax
push 0x90
push esi
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x20c]
mov edx, esi
call fcn.00404e78
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c500
mov eax, esi
call fcn.0040287c
jmp 0x4d9728
mov eax, ebx
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.00404ef0
mov eax, dword [ebx]
call fcn.00404f5c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4d974f
push ebx
mov eax, dword [ebx]
call fcn.00404f5c
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004051bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9774
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.00404ca4
ret

Function at 0x4d99c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d9ac5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c80
mov esi, 0x4d9ad4
lea edi, [ebp - 0x201]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x201]
push eax
push 0x200
push 0x200
mov ecx, 0x4d9cd8
mov edx, 0x4d9cdc
mov eax, 0x4d9ce4
call fcn.004b5ee0
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.00404ef0
cmp dword [ebp - 0x208], 0
jne 0x4d9a73
mov eax, 0x90
call fcn.0040285c
mov esi, eax
push esi
push 0x90
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esi
call fcn.00404e78
mov eax, esi
call fcn.0040287c
jmp 0x4d9a85
mov eax, ebx
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.00404ef0
mov eax, dword [ebx]
call fcn.00404f5c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4d9aac
push ebx
mov eax, dword [ebx]
call fcn.00404f5c
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004051bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9acc
lea eax, [ebp - 0x208]
call fcn.00404c80
ret
Function at 0x4de97c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4de984
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4deaeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c80
xor eax, eax
push ebp
push 0x4deac6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402d14
mov eax, dword [ebp - 0x14]
call fcn.0040515c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4de9e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dead0
mov eax, esi
call fcn.0040285c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402d14
mov eax, dword [ebp - 0x18]
call fcn.0040515c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4deafc
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040bd40
push dword [ebx]
push 0x4deb08
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040bd40
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.0040501c
push dword [ebx]
push 0x4deb08
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040bd40
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.0040501c
push dword [ebx]
push 0x4deb08
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040bd40
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.0040501c
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0040287c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dead0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deaf2
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404ca4
ret

Function at 0x4df594
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
cmp eax, 0xb
ja case.default.0x4df5a7
jmp dword [eax*4 + 0x4df5ae]
mov ebx, 5
jmp case.default.0x4df5a7
mov ebx, 0x23
jmp case.default.0x4df5a7
mov ebx, 0x1c
jmp case.default.0x4df5a7
mov ebx, 0x26
jmp case.default.0x4df5a7
mov ebx, 0x2e
jmp case.default.0x4df5a7
mov ebx, 0x24
jmp case.default.0x4df5a7
xor ebx, ebx
jmp case.default.0x4df5a7
mov ebx, 0x1a
jmp case.default.0x4df5a7
mov ebx, 8
jmp case.default.0x4df5a7
mov ebx, 0x28
jmp case.default.0x4df5a7
mov ebx, 0x21
jmp case.default.0x4df5a7
mov ebx, 0x20
push esp
push 0
push 0
push ebx
push 0
call sub.SHFolder.dll_SHGetFolderPathA
call fcn.0041e244
test al, al
je 0x4df653
mov eax, esi
mov edx, esp
mov ecx, 0x105
call fcn.00404ef0
jmp 0x4df65a
mov eax, esi
call fcn.00404c80
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x4dfbc8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dfca8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c80
xor edx, edx
push ebp
push 0x4dfc83
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
mov cl, 1
call fcn.004e2988
test al, al
je 0x4dfc21
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404cd4
jmp 0x4dfc79
lea eax, [ebp - 0x1dc]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x4c]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x4c]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4dfc56
pop dword fs:[0]
add esp, 8
jmp 0x4dfc8d
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4dfc6d
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 4]
call fcn.0040cc0c
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4dfc5d
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dfc8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfcaf
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x4dfcb8
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff804
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x7fc], edx
mov dword [ebp - 0x7f8], edx
mov dword [ebp - 0x7f4], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dfe77
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00404c80
xor edx, edx
push ebp
push 0x4dfe4f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4dfd35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dfe59
xor edx, edx
push ebp
push 0x4dfe2d
push dword fs:[edx]
mov dword fs:[edx], esp
lea ebx, [ebp - 0x10]
push 0
push 0
push ebx
push 0x400
lea eax, [ebp - 0x7f0]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0xc]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x4dfe23
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c
cdq
idiv ecx
mov ebx, eax
mov dl, 1
mov eax, dword [0x41f004]
call fcn.00403d7c
mov dword [ebp - 0x14], eax
mov edi, ebx
dec edi
test edi, edi
jl 0x4dfdf9
inc edi
lea ebx, [ebp - 0x7ec]
push edi
mov esi, ebx
lea edi, [ebp - 0x1b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push dword [ebp - 0x1b0]
call sub.wsock32.dll_inet_ntoa
mov esi, eax
lea eax, [ebp - 0x7f4]
mov edx, esi
call fcn.00404e78
mov eax, dword [ebp - 0x7f4]
mov edx, 0x4dfe90
call fcn.004050a8
je 0x4dfdf3
lea eax, [ebp - 0x7f8]
mov edx, esi
call fcn.00404e78
mov edx, dword [ebp - 0x7f8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x4c
dec edi
jne 0x4dfd9e
lea edx, [ebp - 0x7fc]
mov eax, dword [ebp - 0x14]
call fcn.004226f8
mov edx, dword [ebp - 0x7fc]
mov eax, dword [ebp - 4]
call fcn.00404cd4
cmp dword [ebp - 0x14], 0
je 0x4dfe23
mov eax, dword [ebp - 0x14]
call fcn.00403dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dfe37
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dfe59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfe7e
lea eax, [ebp - 0x7fc]
mov edx, 3
call fcn.00404ca4
ret
Function at 0x4e0bfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e0d1d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e0d07
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x4e0c55
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4e0d07
cmp dword [ebp - 0xc], 0
jne 0x4e0c6a
mov eax, dword [ebp - 4]
call fcn.00404c80
mov bl, 1
jmp 0x4e0d07
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00404d70
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004051b4
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x4e0c21
test eax, eax
jne 0x4e0d07
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x4e0cb1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4e0d07
jmp 0x4e0cb1
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x4e0cc4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x4e0cae
cmp dword [ebp - 8], 7
jne 0x4e0cd3
cmp dword [ebp - 0xc], 0
je 0x4e0cd3
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004052e8
cmp dword [ebp - 8], 7
jne 0x4e0cfa
cmp dword [ebp - 0xc], 0
je 0x4e0cfa
lea eax, [ebp - 0x10]
call fcn.004051b4
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404cd4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0d24
lea eax, [ebp - 0x10]
call fcn.00404c80
ret
Function at 0x4e4d58
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4e4eb1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004e4ebc
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4e4e85
xor eax, eax
push ebp
push 0x4e4e7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e4e67
xor eax, eax
push ebp
push 0x4e4e60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e4e49
xor eax, eax
push ebp
push 0x4e4e42
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004e4ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4e49
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4e67
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4e85
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
lea edx, [ebp - 0x7c]
lea eax, [ebp - 0x6c]
call fcn.004e4f70
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x7c]
call fcn.004e4fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4eb8
lea eax, [ebp - 4]
call fcn.00404c80
ret

Function at 0x4e4ebc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004083c0
ret

Function at 0x50b844
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x50b869
cmp dword [esp + 4], 5
jb 0x50b869
mov al, 1
jmp 0x50b86b
xor eax, eax
add esp, 0x94
ret
Function at 0x520f0c
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, eax
mov ebp, 0x3c
xor esi, esi
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov ebx, eax
test ebx, ebx
je 0x520f8f
push 0xf01ff
push edi
push ebx
call sub.advapi32.dll_OpenServiceA_1
mov edi, eax
test edi, edi
je 0x520f89
push esp
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x520f83
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x520f6e
cmp dword [esp + 4], 3
jne 0x520f79
push 0x3e8
call sub.kernel32.dll_Sleep_1
dec ebp
test ebp, ebp
je 0x520f79
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus_1
test eax, eax
jne 0x520f58
cmp dword [esp + 4], 1
jne 0x520f83
or esi, 0xffffffff
push edi
call sub.advapi32.dll_CloseServiceHandle_1
push ebx
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, esi
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x520ff8
Capabilities:
Query service status
Start service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, eax
mov ebp, 0x3c
mov dword [esp], esi
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov ebx, eax
cmp ebx, 5
je 0x5210a6
cmp ebx, 0x57
je 0x5210a6
cmp ebx, 0x429
je 0x5210a6
push 0xf01ff
push esi
push ebx
call sub.advapi32.dll_OpenServiceA_1
mov esi, eax
cmp esi, 5
je 0x5210a0
cmp esi, 0x7b
je 0x5210a0
cmp esi, 6
je 0x5210a0
cmp esi, 0x424
je 0x5210a0
push esp
push 0
push esi
call sub.advapi32.dll_StartServiceA
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x521081
cmp dword [esp + 8], 2
jne 0x521090
push 0x3e8
call sub.kernel32.dll_Sleep_1
dec ebp
test ebp, ebp
je 0x521090
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus_1
test eax, eax
jne 0x52106b
cmp dword [esp + 8], 4
jne 0x52109a
or edi, 0xffffffff
push esi
call sub.advapi32.dll_CloseServiceHandle_1
push ebx
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x524b50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x524d72
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x524d42
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x524d90
push edi
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040501c
mov dword [ebp - 0x1c], 0xc
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xc
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x44
xor eax, eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3a], 0
xor eax, eax
mov dword [ebp - 0x38], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov eax, esi
call fcn.0040515c
push eax
push ebx
push 0x20
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x524c8b
lea edx, [ebp - 0x84]
mov eax, dword [0x558fe8]
mov eax, dword [eax]
call fcn.0049b4c0
push dword [ebp - 0x84]
push 0x524d9c
push dword [ebp - 8]
push 0x524d9c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x88]
call fcn.0040f95c
push dword [ebp - 0x88]
lea eax, [ebp - 0x80]
mov edx, 5
call fcn.0040501c
mov eax, dword [ebp - 0x80]
mov edx, 1
call fcn.004d9204
mov dword [ebp - 0x10], 0x103
xor eax, eax
push ebp
push 0x524d06
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x524ce7
mov eax, dword [0x558fe8]
mov eax, dword [eax]
call fcn.0049ad04
xor eax, eax
push ebp
push 0x524cd0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x524cda
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp byte [ebp - 9], 1
jne 0x524cfc
cmp dword [ebp - 0x10], 0x103
jne 0x524cfc
cmp byte [ebp + 8], 1
je 0x524ca2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x524d10
mov eax, dword [ebp - 0x74]
mov dword [ebp - 4], eax
cmp byte [ebp - 9], 1
jne 0x524d38
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x524d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x524d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524d79
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp - 8]
call fcn.00404c80
ret
Function at 0x524da4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x524e06
xor eax, eax
push ebp
push 0x524dff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
call fcn.00411e00
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524e06
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x529048
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe0c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x52926c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x310]
call fcn.004da6c0
lea eax, [ebp - 0xc]
mov ecx, 0x529284
mov edx, dword [ebp - 0x10]
call fcn.00404fa8
mov eax, dword [ebp - 0xc]
call fcn.0040c200
test al, al
je 0x5290c1
mov eax, dword [ebp - 0xc]
call fcn.0040c328
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1dc]
call fcn.004030fc
lea eax, [ebp - 0x1dc]
call fcn.00402e8c
call fcn.00402a14
mov ebx, 0x41
lea eax, [ebp - 0x1e0]
mov edx, ebx
call fcn.00404e68
lea eax, [ebp - 0x1e0]
mov edx, 0x52929c
call fcn.00404f64
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 5]
call fcn.0040ca90
lea eax, [ebp - 5]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x529155
lea eax, [ebp - 0x1e4]
mov edx, ebx
call fcn.00404e68
lea eax, [ebp - 0x1e4]
mov edx, 0x52929c
call fcn.00404f64
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1dc]
call fcn.00405378
call fcn.0040383c
call fcn.00402a14
inc ebx
cmp ebx, 0x5b
jne 0x5290e4
lea eax, [ebp - 0x1dc]
call fcn.004031c4
call fcn.00402a14
mov eax, dword [ebp - 0xc]
call fcn.0040c200
test al, al
je 0x529241
cmp byte [esi + 0x4e4], 0
jne 0x5291dc
cmp byte [esi + 0x308], 0
jne 0x5291dc
push 1
push 0
push 0x5292a8
push dword [ebp - 0x10]
push 0x5292cc
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x1ec]
mov ecx, 0x5292e4
mov edx, dword [esi + 0x310]
call fcn.00404fa8
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0x10]
pop edx
call fcn.004d8fb0
jmp 0x529241
cmp byte [esi + 0x308], 0
je 0x529214
push 0
push 0
lea eax, [ebp - 0x1f0]
mov ecx, 0x5292fc
mov edx, dword [esi + 0x310]
call fcn.00404fa8
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x10]
mov edx, 0x529314
call fcn.004d8fb0
jmp 0x529241
push 1
push 0
lea eax, [ebp - 0x1f4]
mov ecx, 0x52934c
mov edx, dword [esi + 0x310]
call fcn.00404fa8
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x10]
mov edx, 0x529314
call fcn.004d8fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529273
lea eax, [ebp - 0x1f4]
mov edx, 6
call fcn.00404ca4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404ca4
ret