joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409570
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.00409880
test eax, eax
je 0x4095e5
push 0x4a5610
push 0x4a5608
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov dword [fcn.004ab18c], eax
jne 0x40959d
or eax, 0xffffffff
ret
push 0
push 0x2c
push 0x4ab160
push 0
call eax
test eax, eax
je 0x4095b2
or eax, 0xffffffff
ret
mov dword [0x4ab158], 0
mov dword [0x4ab15c], 0
mov dword [0x4ab150], 0
mov dword [0x4ab154], 0
call fcn.00409750
mov eax, 1
ret
push 0x4ab14c
push 0xf003f
push 0
push 0x4a55f4
push 0x80000006
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409609
or eax, 0xffffffff
ret
mov eax, dword [0x4ab14c]
push 0x4ab148
push 0x4ab140
push 0x4ab144
push 0
push 0x4a55e4
push eax
mov dword [0x4ab148], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x4ab14c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret

Function at 0x409650
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.00409880
test eax, eax
jne 0x4096b5
push 0x4ab14c
push 0xf003f
push eax
push 0x4a562c
push 0x80000006
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40967c
or eax, 0xffffffff
ret
mov eax, dword [0x4ab14c]
push 0x4ab148
push 0x4ab140
push 0x4ab144
push 0
push 0x4a55e4
push eax
mov dword [0x4ab148], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x4ab14c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x40c3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4847ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4a8c20]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x38]
mov ebx, 2
push 0x4aadf8
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.004717b5
test esi, esi
je 0x40c522
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x3c]
push esi
push eax
mov ecx, edi
call fcn.0046ac79
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.00471765
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0047162c
mov ecx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push ecx
call ebp
test eax, eax
jne 0x40c4cb
lea edx, [esp + 0x1c]
push 3
push edx
lea ecx, [esp + 0x1c]
call fcn.00469f76
lea ecx, [esp + 0x18]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x38], 4
call fcn.00469ff2
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00471765
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.0047162c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0047162c
push 0x4a5770
lea ecx, [esp + 0x18]
call fcn.00471994
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0047185b
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.00471765
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.0047162c
mov edx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x40c444
pop ebp
push 1
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.00469c73
lea eax, [esp + 0x1c]
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.00469f76
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.0044aa18
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete byte [esp + 0x38]
call fcn.0047162c
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.0047162c
mov al, byte [esp + 0x38]
test al, al
je 0x40c58d
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
dec eax
push eax
call fcn.00471afe
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004713a1
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.0047162c
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0047162c
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x411700
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c8
test eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
je 0x4118c9
mov eax, dword [edi + 0x78]
push 0
push 0
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
mov byte [esp + 0x13], 0
jle 0x4117d8
push ebp
lea ecx, [edi + 0x5c]
call fcn.0046ab6d
mov esi, eax
test esi, esi
je 0x4117c3
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esi]
cmp eax, ecx
jne 0x4117c3
mov eax, dword [esi + 4]
mov byte [esp + 0x13], 1
inc eax
mov dword [esi + 4], eax
mov edx, dword [edi + 0x238]
mov ecx, dword [edi + 0x23c]
add dword [esi + 8], edx
mov edx, dword [esi + 0xc]
push eax
push 0x4a4274
adc edx, ecx
mov dword [esi + 0xc], edx
lea edx, [esp + 0x1c]
push edx
call fcn.00449ffa
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [edi + 0x5c]
push eax
push 2
push ebp
call fcn.0046aa58
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
call fcn.00418bd0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 3
push ebp
lea ecx, [edi + 0x5c]
call fcn.0046aa58
inc ebp
cmp ebp, ebx
jl 0x41173c
mov al, byte [esp + 0x13]
test al, al
jne 0x4118c9
push 0x501
lea edx, [esp + 0x7c]
push 0x160
push edx
lea eax, [edi + 0x134]
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x7c]
push 0
push ecx
push 0
lea edx, [esp + 0x194]
push 0
lea ebp, [edi + 0x5c]
push edx
push ebx
push 3
mov ecx, ebp
call fcn.0046a95d
xor eax, eax
xor ecx, ecx
mov al, byte [esp + 0x1de]
lea edx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1e0]
mov cl, ah
and eax, 0xff
push ecx
push eax
push 0x4a5994
push edx
call fcn.00449ffa
add esp, 0x14
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
push 1
push ebx
call fcn.0046aa58
push 0x10
call fcn.004708e9
add esp, 4
mov esi, eax
mov ecx, ebp
push esi
push 0
push 0
push 0
push 0
push 4
push 0
push ebx
call fcn.0046a9df
mov ecx, dword [esp + 0x1dc]
mov dword [esi + 4], 1
mov dword [esi], ecx
mov edx, dword [edi + 0x238]
mov dword [esi + 8], edx
mov eax, dword [edi + 0x23c]
push 0x4a5990
push 2
push ebx
mov ecx, ebp
mov dword [esi + 0xc], eax
call fcn.0046aa58
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
call fcn.00418bd0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 3
push ebx
mov ecx, ebp
call fcn.0046aa58
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c8
ret 4
Function at 0x411dd0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.0044a1ab
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x411df0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
push 0
rep stosb byte es:[edi], al
mov eax, dword [0x4ab1a0]
mov edi, dword [esp + 0x20]
cdq
idiv esi
push 0
push edi
mov ebp, eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
test ebp, ebp
mov dword [esp + 0x20], 0
jle 0x411e4c
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x411e5d
mov eax, dword [esp + 0x20]
inc eax
cmp eax, ebp
mov dword [esp + 0x20], eax
jl 0x411e2b
push ebx
call fcn.0044a134
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call fcn.0044a134
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x4139b0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
lea eax, [esp]
mov dword [0x4ab1b4], 0
mov dword [0x4ab1b8], 0
push esi
mov esi, dword [esp + 0x168]
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x101
push 0x160
push eax
push 0
push esi
call edi
test eax, eax
je 0x413a05
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [0x4ab1c0], ecx
mov dword [0x4ab1b8], edx
push 0x103
lea eax, [esp + 0xc]
push 0x160
push eax
push 0
push esi
call edi
pop edi
pop esi
test eax, eax
je 0x413a33
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov dword [0x4ab1bc], ecx
mov dword [0x4ab1b4], edx
add esp, 0x160
ret

Function at 0x413c05
Capabilities:
Get disk size

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp esi, ebp
jne 0x413c13
xor eax, eax
jmp 0x413c16
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x5fc]
push 0x1004
mov dword [ecx], eax
mov edx, dword [esi + 0x5fc]
mov dword [edx + 0x128], ebp
mov dword [edx + 0x12c], ebp
mov eax, dword [esi + 0x5fc]
mov dword [eax + 0x114], ebp
mov ecx, dword [esi + 0x5fc]
mov dword [ecx + 0x110], ebp
mov edx, dword [esi + 0x5fc]
mov eax, dword [esi + 0x8c]
mov dword [edx + 8], eax
call fcn.0044a1ab
mov ebx, eax
mov ecx, 0x401
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x5fc]
add esp, 4
lea eax, [esp + 0x10]
mov dword [ecx + 4], 1
mov edx, dword [esi + 0x5fc]
push ebp
push eax
mov dword [edx + 0x130], ebp
push 0x1004
push ebx
push ebp
mov dword [edx + 0x134], ebp
mov ecx, dword [esi + 0x5fc]
push ebp
push 0x7400c
mov edx, dword [ecx + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x413d32
cmp dword [ebx], 0
jbe 0x413d30
lea edi, [ebx + 0x1c]
mov eax, dword [edi]
test eax, eax
jbe 0x413d26
mov edx, dword [esi + 0x5fc]
lea ecx, [esp + 0x24]
push ecx
push eax
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.00417d70
add esp, 0xc
cmp eax, 0xffffffff
je 0x413d26
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x413d26
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x5fc]
sub edx, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, dword [esp + 0x20]
add dword [eax + 0x130], edx
adc dword [eax + 0x134], ecx
mov eax, dword [ebx]
inc ebp
add edi, 0x20
cmp ebp, eax
jb 0x413cc1
xor ebp, ebp
push 1
call fcn.00416c90
add esp, 4
lea ecx, [esi + 0xa8]
push ebp
call fcn.0047028c
call dword [sym.imp.kernel32.dll_GetTickCount]
pop edi
pop esi
pop ebp
mov dword [0x4ab1ac], eax
pop ebx
add esp, 0x34
ret
Function at 0x415040
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
imul ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x415070
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, esi
push ecx
mov ecx, dword [esp + 0x14]
cdq
push ecx
push edx
push eax
call fcn.0044a100
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push 0
push edx
push eax
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
imul ecx, esi
lea eax, [esp + 0x1c]
push 0
push eax
push ecx
push edx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret

Function at 0x4150d0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
imul ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x415100
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, esi
push ecx
mov ecx, dword [esp + 0x14]
cdq
push ecx
push edx
push eax
call fcn.0044a100
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push 0
push edx
push eax
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
imul ecx, esi
lea eax, [esp + 0x1c]
push 0
push eax
push ecx
push edx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret
Function at 0x4166f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
push ebx
push ebp
push esi
push edi
mov edi, 0x4a6bd8
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0x4a6bb4
mov eax, ecx
mov esi, edi
mov edi, ebx
mov dword [esp + 0x14], 0x4a6b90
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 0x4a6b6c
and ecx, 3
mov dword [esp + 0x1c], 0x4a6b48
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], 0x4a6b24
mov dword [esp + 0x24], 0x4a6b00
mov dword [esp + 0x28], 0x4a6adc
mov dword [esp + 0x2c], 0x4a6ab8
mov dword [esp + 0x30], 0x4a6a94
mov dword [esp + 0x34], 0x4a6a70
mov dword [esp + 0x38], 0x4a6a4c
mov dword [esp + 0x3c], 0x4a6a28
mov dword [esp + 0x40], 0x4a6a04
mov dword [esp + 0x44], 0x4a69e0
mov dword [esp + 0x48], 0x4a69bc
mov dword [esp + 0x4c], 0x4a6998
mov dword [esp + 0x50], 0x4a6974
mov dword [esp + 0x54], 0x4a6950
mov dword [esp + 0x58], 0x4a692c
mov dword [esp + 0x5c], 0x4a6908
mov dword [esp + 0x60], 0x4a68e4
mov dword [esp + 0x64], 0x4a68c0
mov dword [esp + 0x68], 0x4a689c
mov dword [esp + 0x6c], 0x4a6878
mov dword [esp + 0x70], 0x4a6854
mov dword [esp + 0x74], 0x4a6830
mov dword [esp + 0x78], 0x4a680c
mov dword [esp + 0x7c], 0x4a67e8
mov dword [esp + 0x80], 0x4a67c4
mov dword [esp + 0x84], 0x4a67a0
mov dword [esp + 0x88], 0x4a677c
mov dword [esp + 0x8c], 0x4a6758
mov dword [esp + 0x90], 0x4a6734
mov dword [esp + 0x94], 0x4a6710
mov dword [esp + 0x98], 0x4a66ec
mov dword [esp + 0x9c], 0x4a66c8
mov dword [esp + 0xa0], 0x4a66a4
mov dword [esp + 0xa4], 0x4a6680
mov dword [esp + 0xa8], 0x4a665c
mov dword [esp + 0xac], 0x4a6638
mov dword [esp + 0xb0], 0x4a6614
mov dword [esp + 0xb4], 0x4a65f0
mov dword [esp + 0xb8], 0x4a65cc
mov dword [esp + 0xbc], 0x4a65a8
mov dword [esp + 0xc0], 0x4a6584
mov dword [esp + 0xc4], 0x4a6560
mov dword [esp + 0xc8], 0x4a653c
mov dword [esp + 0xcc], 0x4a6518
mov dword [esp + 0xd0], 0x4a64f4
mov dword [esp + 0xd4], 0x4a64d0
mov dword [esp + 0xd8], 0x4a64ac
mov dword [esp + 0xdc], 0x4a6488
mov dword [esp + 0xe0], 0x4a6464
mov dword [esp + 0xe4], 0x4a6440
mov dword [esp + 0xe8], 0x4a641c
mov dword [esp + 0xec], 0x4a63f8
mov dword [esp + 0xf0], 0x4a63d4
mov dword [esp + 0xf4], 0x4a63b0
mov dword [esp + 0xf8], 0x4a638c
mov dword [esp + 0xfc], 0x4a6368
mov dword [esp + 0x100], 0x4a6364
xor edi, edi
mov ebp, dword [esp + 0x108]
mov esi, dword [esp + edi*4 + 0x10]
push esi
call fcn.0044a3ed
mov edx, eax
add esp, 4
cmp edx, ebp
jne 0x4169af
lea edi, [esi + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or edi, 0xffffffff
jmp 0x4169b0
inc edi
cmp edx, 0xffffffff
je 0x4169ba
cmp edi, 0xffffffff
jne 0x416977
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x417d70
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, 0x4aadf8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4a6f0c]
mov dx, word [0x4a6f10]
mov al, byte [0x4a6f12]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x4a5768]
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
mov dword [esp + 0x10], ecx
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.kernel32.dll_GetDriveTypeA]
mov esi, dword [sym.imp.kernel32.dll_CreateFileA]
mov ebp, dword [sym.imp.kernel32.dll_DeviceIoControl]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
shr edx, cl
test dl, 1
je 0x417e5d
mov bl, cl
lea eax, [esp + 0x10]
add bl, 0x41
push eax
mov byte [esp + 0x14], bl
call edi
cmp eax, 3
jne 0x417e59
push 0
push 0
push eax
push 0
push eax
lea ecx, [esp + 0x34]
push 0xc0000000
push ecx
mov byte [esp + 0x40], bl
call esi
cmp eax, 0xffffffff
je 0x417e59
lea edx, [esp + 0x1c]
push 0
push edx
lea ecx, [esp + 0x30]
push 0xc
push ecx
push 0
push 0
push 0x2d1080
push eax
call ebp
test eax, eax
je 0x417e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
cmp edx, eax
jne 0x417e59
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
je 0x417e76
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x1a
mov dword [esp + 0x14], ecx
jl 0x417de6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x417eb0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push 0x4a6f24
push 0x4a6f14
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x417f2a
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
push edx
call eax
test eax, eax
jne 0x417eee
xor al, al
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0x14
call fcn.0044b1b0
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.0044b1b0
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
add esp, 0x28
ret
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x34]
lea eax, [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x417f53
xor al, al
add esp, 0x28
ret
mov eax, dword [esp]
mov ecx, dword [esp + 0x34]
imul eax, dword [esp + 4]
mov edx, eax
imul eax, dword [esp + 0xc]
imul edx, dword [esp + 8]
shr edx, 0x14
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x30]
shr eax, 0x14
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov al, 1
add esp, 0x28
ret

Function at 0x418030
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
push esi
push edi
call ebx
mov edi, dword [esp + 0x10]
push 0x4ff
push edi
push 0
push 0
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call ebx
mov ecx, eax
sub ecx, esi
cmp ecx, edi
jge 0x41808e
push ebp
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
jge 0x41806a
mov esi, eax
sub esi, eax
add edi, esi
mov esi, eax
call fcn.00417fe0
push 0x4ff
push edi
push 0
push 0
push 0
call ebp
call ebx
mov edx, eax
sub edx, esi
cmp edx, edi
jl 0x418064
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x419040
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
push ebp
call fcn.0044a1ab
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41921b
push edi
mov edi, 0x4aadf8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x12c]
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4aadf8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x138]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
je 0x419212
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x4a7058
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x419212
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4a704c
mov edx, dword [eax]
mov cx, word [eax]
shr edx, 0x10
shl ecx, 0x10
or edx, ecx
lea ecx, [esp + 0x20]
mov dword [eax], edx
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
push eax
push 0x4a7030
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push eax
push ecx
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x419161
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x124]
push edx
push 0x4a702c
push eax
call fcn.00449ffa
add esp, 0xc
mov ecx, dword [esp + 0x14]
push 0x4a701c
lea eax, [esp + 0x20]
mov edx, dword [ecx]
push edx
push 0x4a7030
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push ecx
push edx
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4191af
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x128]
push ecx
push 0x4a702c
push edx
call fcn.00449ffa
add esp, 0xc
mov eax, dword [esp + 0x14]
push 0x4a7010
lea edx, [esp + 0x20]
mov ecx, dword [eax]
push ecx
push 0x4a7030
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4191fd
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x12c]
push eax
push 0x4a702c
push ecx
call fcn.00449ffa
add esp, 0xc
push ebx
call fcn.0044a134
add esp, 4
mov al, 1
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push ebx
call fcn.0044a134
add esp, 4
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
Function at 0x419230
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 8]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea ecx, [esp + 0x30]
push 2
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [esp + 4], eax
je 0x41929e
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x41928f
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 4]
pop ebx
add esp, 0x10
ret