joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499064
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x4991cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040ac90
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409b94
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004053c8
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.00405628
mov eax, dword [ebp - 0x1c]
mov edx, 0x4991e0
call fcn.00405514
jne 0x4990e2
lea eax, [ebp - 0x1c]
mov edx, 0x4991ec
call fcn.004051a0
mov eax, dword [ebp - 0x1c]
call fcn.004055c8
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040ab90
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.004051a0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004055c8
push eax
mov eax, dword [reloc.gdi32.dll_ExcludeClipRect]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [reloc.gdi32.dll_ExcludeClipRect]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49915c
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x4991fc
call fcn.00405414
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x41a74c]
call fcn.0040e7b4
call fcn.00404a84
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
call fcn.00420c40
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [reloc.gdi32.dll_ExcludeClipRect]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004206c0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408794
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4991d3
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x49ad94
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ae3a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0049b724
test al, al
je 0x49add5
push 0
mov eax, dword [ebp - 4]
call fcn.004059cc
push eax
call dword [0x61304c]
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x49adf9
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405390
push 0
mov eax, dword [ebp - 0xc]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x49ae24
mov eax, dword [ebp - 4]
call fcn.0049b088
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 8
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x10]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ae41
lea eax, [ebp - 0xc]
call fcn.00405108
ret

Function at 0x49bfe4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49c073
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0049bc28
test al, al
je 0x49c047
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0049bab4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059cc
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x49c055
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x49c055
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a9b8
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c07a
lea eax, [ebp - 0x10]
call fcn.0040583c
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x49c164
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49c1eb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049bfe4
mov eax, dword [ebp - 4]
call fcn.0049bc28
test al, al
je 0x49c1c2
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0049bab4
mov eax, dword [ebp - 0xc]
call fcn.004059cc
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x49c1cd
mov eax, dword [ebp - 4]
call fcn.0040aad4
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c1f2
lea eax, [ebp - 0xc]
call fcn.0040583c
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x49c4b4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49c545
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049bfe4
mov eax, dword [ebp - 4]
call fcn.0049bc28
test al, al
je 0x49c509
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0049bab4
mov eax, dword [ebp - 0xc]
call fcn.004059cc
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
jmp 0x49c527
mov eax, dword [ebp - 4]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
mov eax, dword [ebp - 4]
call fcn.00402ce4
call fcn.00402a40
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c54c
lea eax, [ebp - 0xc]
call fcn.0040583c
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x49c550
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
mov eax, dword [ebp - 8]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49c608
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049bc28
test al, al
jne 0x49c59a
mov eax, dword [ebp - 8]
call fcn.0049bc28
test al, al
je 0x49c5d2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0049bab4
mov eax, dword [ebp - 0x10]
call fcn.004059cc
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0049bab4
mov eax, dword [ebp - 0x14]
call fcn.004059cc
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
jmp 0x49c5e0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040aaec
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c60f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405854
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040512c
ret
Function at 0x49c700
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
xor edx, edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49c80a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea eax, [ebp - 8]
call fcn.00405108
push 0x40
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49c7e9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x49c7aa
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1e8]
call fcn.00405300
push dword [ebp - 0x1e8]
push 0x49c820
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405488
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp dword [edx + eax*4], 0
jne 0x49c76f
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 8]
call fcn.004053c8
test eax, eax
jle 0x49c7de
mov eax, dword [ebp - 8]
call fcn.004053c8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.00405668
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040515c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c811
lea eax, [ebp - 0x1e8]
call fcn.00405108
lea eax, [ebp - 8]
call fcn.00405108
ret
Function at 0x49e9a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49ebac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
push ebp
push 0x49eb53
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049bc8c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004055c8
mov ecx, 3
mov edx, 0x80000000
call fcn.0049c084
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x49ea43
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eb96
mov byte [ebp - 0xf], 0
cmp dword [ebp - 0x24], 0
jne 0x49ea51
cmp dword [ebp - 0x28], 0
je 0x49eb41
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
mov eax, 0xffff
call fcn.00402828
mov dword [ebp - 0x18], eax
jmp 0x49eb20
cmp dword [ebp - 0x24], 0
jne 0x49ea83
cmp dword [ebp - 0x28], 0xffff
jbe 0x49ea8d
jmp 0x49ea85
jle 0x49ea8d
mov word [ebp - 0x2a], 0xffff
jmp 0x49ea95
mov ax, word [ebp - 0x28]
mov word [ebp - 0x2a], ax
movzx eax, word [ebp - 0x2a]
xor edx, edx
sub dword [ebp - 0x28], eax
sbb dword [ebp - 0x24], edx
push 0
lea eax, [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x2a]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_ReadFile
movzx eax, word [ebp - 0x2a]
cmp eax, dword [ebp - 0x1c]
je 0x49eac8
mov byte [ebp - 0xe], 1
jmp 0x49eb34
movzx eax, word [ebp - 0x2a]
xor edx, edx
add dword [ebp - 0x38], eax
adc dword [ebp - 0x34], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
push edx
push eax
lea edx, [ebp - 0xf]
mov eax, dword [ebp - 4]
call dword [ebp - 0xc]
cmp byte [ebp - 0xf], 0
je 0x49eb0a
mov byte [0x61ce56], 1
jmp 0x49eb34
movzx ecx, word [ebp - 0x2a]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004987e0
mov edx, dword [ebp - 8]
mov dword [edx], eax
cmp dword [ebp - 0x24], 0
jne 0x49ea72
cmp dword [ebp - 0x28], 0
jne 0x49ea72
mov eax, dword [ebp - 0x18]
call fcn.00402848
mov eax, dword [ebp - 8]
not dword [eax]
mov al, byte [ebp - 0xe]
xor al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eb61
xor eax, eax
push ebp
push 0x49eb82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eb8c
cmp byte [ebp - 0xf], 0
je 0x49eb96
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ebb3
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x49ef3c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x49f119
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0x49f0c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049bc8c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004055c8
mov ecx, 3
mov edx, 0x80000000
call fcn.0049c084
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x49efd4
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f103
mov byte [ebp - 0xb], 0
cmp dword [ebp - 0x1c], 0
jne 0x49efe2
cmp dword [ebp - 0x20], 0
je 0x49f0ae
mov eax, 0xffff
call fcn.00402828
mov dword [ebp - 0x14], eax
jmp 0x49f092
cmp dword [ebp - 0x1c], 0
jne 0x49f00b
cmp dword [ebp - 0x20], 0xffff
jbe 0x49f015
jmp 0x49f00d
jle 0x49f015
mov word [ebp - 0x22], 0xffff
jmp 0x49f01d
mov ax, word [ebp - 0x20]
mov word [ebp - 0x22], ax
movzx eax, word [ebp - 0x22]
xor edx, edx
sub dword [ebp - 0x20], eax
sbb dword [ebp - 0x1c], edx
push 0
lea eax, [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x22]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_ReadFile
movzx eax, word [ebp - 0x22]
cmp eax, dword [ebp - 0x18]
je 0x49f050
mov byte [ebp - 0xa], 1
jmp 0x49f0a6
movzx eax, word [ebp - 0x22]
xor edx, edx
add dword [ebp - 0x30], eax
adc dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x30]
adc edx, dword [ebp - 0x2c]
push edx
push eax
lea edx, [ebp - 0xb]
mov eax, dword [ebp - 4]
call dword [ebp - 8]
cmp byte [ebp - 0xb], 0
je 0x49f092
mov byte [0x61ce56], 1
jmp 0x49f0a6
cmp dword [ebp - 0x1c], 0
jne 0x49effa
cmp dword [ebp - 0x20], 0
jne 0x49effa
mov eax, dword [ebp - 0x14]
call fcn.00402848
mov al, byte [ebp - 0xa]
xor al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f0ce
xor eax, eax
push ebp
push 0x49f0ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f0f9
cmp byte [ebp - 0xb], 0
je 0x49f103
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f120
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x4a127c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.0040b03c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0040b028
mov eax, dword [ebp - 0xc]
call fcn.0040b088
mov esp, ebp
pop ebp
ret
Function at 0x4a6b9c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004053c8
dec eax
test eax, eax
jl 0x4a6bef
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx]
xor al, byte [ebp - 8]
and eax, 0xff
mov eax, dword [eax*4 + 0x61352c]
mov edx, dword [ebp - 8]
shr edx, 8
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4a6bc4
xor dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4c3664
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4c366d
mov eax, dword [ebp - 4]
add esp, 0xffffffc0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0xc], 0x2000
jg 0x4c376b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4c376b
lea eax, [ebp - 0x2044]
xor ecx, ecx
mov edx, 0x2030
call fcn.0040345c
mov dword [ebp - 0x2044], 0x31
xor eax, eax
mov dword [ebp - 0x2040], eax
mov dword [ebp - 0x203c], 3
mov dword [ebp - 0x2038], 1
mov dword [ebp - 0x202c], 0x28
mov dword [ebp - 0x2028], 0x2000
cmp byte [ebp - 5], 0
je 0x4c370c
xor eax, eax
mov dword [ebp - 0x2034], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2030], eax
jmp 0x4c371e
mov dword [ebp - 0x2034], 1
xor eax, eax
mov dword [ebp - 0x2030], eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4c376b
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jbe 0x4c376b
mov byte [ebp - 0xd], 1
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x2014]
mov ecx, dword [ebp + 0xc]
call fcn.00402a8c
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c3774
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4c377d
mov eax, dword [ebp - 4]
add esp, 0xffffffc0
mov dword [ebp - 8], ecx
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp + 0xc], 0x2000
jg 0x4c3864
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c3864
lea eax, [ebp - 0x2044]
xor ecx, ecx
mov edx, 0x2030
call fcn.0040345c
mov dword [ebp - 0x2044], 0x31
xor eax, eax
mov dword [ebp - 0x2040], eax
mov dword [ebp - 0x203c], 3
mov dword [ebp - 0x2038], 2
mov dword [ebp - 0x2034], 2
mov dword [ebp - 0x2030], 0xffffffff
mov dword [ebp - 0x202c], 0x28
mov dword [ebp - 0x2028], 0x2000
push 0
mov eax, dword [ebp + 8]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4c3864
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jbe 0x4c3864
mov byte [ebp - 9], 1
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x2014]
mov ecx, dword [ebp + 0xc]
call fcn.00402a8c
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 8
Function at 0x4d7010
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d71d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405108
lea eax, [ebp - 0x146]
xor ecx, ecx
mov edx, 0x121
call fcn.0040345c
lea eax, [ebp - 0x25]
xor ecx, ecx
mov edx, 0xd
call fcn.0040345c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, 0x4d71e8
call fcn.00405414
mov eax, dword [ebp - 0x14c]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4d71a7
push 0
lea eax, [ebp - 0x14]
push eax
push 0x121
lea eax, [ebp - 0x146]
push eax
push 0xd
lea eax, [ebp - 0x25]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4d719e
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 0x4d7204
call fcn.00405414
mov eax, dword [ebp - 0x154]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.00500a2c
push dword [ebp - 0xc]
push 0x4d7218
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x15c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.00500b78
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040515c
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d71d9
lea eax, [ebp - 0x160]
mov edx, 6
call fcn.0040512c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040512c
ret
Function at 0x4da994
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4daaca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004d957c
cmp dword [ebp - 0x10], 0
je 0x4daaac
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dl, 0x2c
mov eax, dword [ebp - 0x10]
call fcn.0048c2b0
test eax, eax
jle 0x4daaa6
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x24]
push eax
mov cl, 0x2c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0048c32c
cmp dword [ebp - 0x14], 1
jle 0x4daa40
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
cmp dword [ebp - 0x1c], 0
jle 0x4daa40
mov eax, dword [ebp - 4]
cmp eax, 0xc7
jg 0x4daa40
mov dword [ebp - 0x18], eax
mov eax, dword [0x61acf4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add dword [eax + edx*4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc8
jne 0x4daa26
push 0x13
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
call fcn.004d9ff4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jne 0x4daa94
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
mov cx, word [ebp - 8]
mov word [edx + eax + 0xb], cx
mov edx, 0xc7
mov eax, dword [ebp - 0x24]
call fcn.0040a480
mov edx, dword [ebp - 4]
mov ecx, edx
shl edx, 4
add edx, ecx
mov ecx, dword [0x61add4]
mov word [ecx + edx + 0xd], ax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4da9f6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daad1
lea eax, [ebp - 0x24]
call fcn.00405108
lea eax, [ebp - 0x10]
call fcn.00405108
ret