joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449ee0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push 0
mov dword [esp + 0x5c], 0xffffffff
call fcn.0045c7d0
call fcn.004b4b70
mov edi, dword [esp + 0x64]
mov esi, dword [0x672f74]
push 0x200
push edi
push 0x760480
call fcn.004f6648
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], 0
push eax
call fcn.004b6a60
push edi
call fcn.004b5370
add esp, 0x3c
mov dword [esi + 0x14], eax
test eax, eax
push edi
jne 0x449f83
call fcn.004b43e0
push edi
call fcn.004b6b50
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x44a0a1
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004b5340
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x449faa
push edi
mov dword [0x760b24], 2
call fcn.004b43e0
add esp, 4
jmp 0x44a0a1
mov al, byte [esi + 0x2bc]
mov ecx, dword [esi + 0x29c]
test al, al
mov dword [esi + 0x28c], ecx
je 0x449fca
mov dword [esi + 0x28c], 1
mov edx, dword [esi + 0xc]
push edx
call fcn.004b6a50
push edi
call fcn.004f5a8f
mov ebx, dword [esi + 0x12e0]
add esp, 8
cmp ebx, 0xffffffff
mov dword [esi + 0xc], eax
je 0x44a03c
lea ebp, [esi + 0x2d8]
push 1
push ebp
push esi
call fcn.00416090
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041b910
add esp, 0x44
cmp eax, 1
jne 0x44a0a1
mov ebx, dword [esi + 0x12e4]
cmp ebx, 0xffffffff
je 0x44a099
lea ebp, [esi + 0xad8]
push 1
push ebp
push esi
call fcn.00416350
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041b910
add esp, 0x44
cmp eax, 1
jne 0x44a0a1
mov dword [esp + 0x34], 0
mov eax, dword [esi + 0x14]
push eax
call fcn.004b6a60
mov ecx, dword [esi + 0x18]
push ecx
call fcn.004b6a60
push edi
mov dword [esi + 0x18], 0
call fcn.004b6b50
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
jne 0x44a0db
push edi
call fcn.004b43e0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x44d440
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x68ca44]
push esi
mov esi, dword [0x671be8]
push 0x64
mov ecx, dword [eax + 0x88]
push 0
push 0x406
push ecx
call esi
mov edx, dword [0x68ca44]
push 0
push 0
push 0x402
mov eax, dword [edx + 0x88]
push eax
call esi
mov ecx, dword [0x68ca44]
push 1
call fcn.00451350
mov eax, dword [0x68ca44]
mov ecx, dword [eax + 0x11d0]
add eax, 0x1200
mov dword [0x68c9c4], ecx
mov edx, dword [eax - 8]
mov dword [0x68c9ec], edx
mov ecx, dword [eax - 0x28]
mov dword [0x672d10], ecx
push eax
mov ecx, 0x68c9c0
call fcn.0050e0ef
mov edx, dword [0x68ca44]
mov ecx, 0x68c9bc
add edx, 0x11c8
push edx
call fcn.0050e0ef
mov eax, dword [0x68ca44]
mov ecx, dword [eax + 0x1c]
add eax, 0x11f4
mov dword [0x6c7b34], ecx
push eax
mov ecx, 0x68c9b8
call fcn.0050e0ef
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x44cc10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
pop esi
jne 0x44d515
mov ecx, dword [0x68ca44]
push eax
call fcn.00451350
pop ecx
ret
Function at 0x44e7e0
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
cdq
and edx, 0x1ff
push ebp
push esi
add eax, edx
push edi
mov edi, eax
mov eax, dword [esp + 0x24]
sar edi, 9
cmp eax, edi
jge 0x44e806
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ebp, eax
cmp dword [eax], 0x3eb202fe
je 0x44e822
mov ecx, dword [ebp + 4]
add ebp, 4
cmp ecx, 0x3eb202fe
jne 0x44e814
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
xor ebx, ebx
mov bx, word [ebp + 0x16]
mov ecx, dword [esi]
add ebx, eax
xor eax, eax
mov ax, word [ebx + 0xe]
mov dword [eax + edx], ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov ecx, 0x20
call fcn.004f5ee0
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov cx, word [ebx + 0x10]
add esi, 8
mov dword [ecx + edx], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffc00
lea ecx, [edi - 2]
sar eax, 2
mov dword [esp + 0x14], eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
mov word [ebp + 8], cx
test eax, eax
mov word [ebp + 0xa], 2
je 0x44e88a
mov word [ebp + 0x14], 1
lea eax, [edi - 3]
xor edx, edx
mov dx, word [ebx + 0xc]
push eax
push esi
xor eax, eax
mov ax, word [ebx + 0xa]
push edx
add eax, dword [esp + 0x24]
push eax
call fcn.0044e9b0
mov ecx, dword [esp + 0x28]
xor eax, eax
mov ax, word [ebx]
mov edx, dword [esi + edi*8 - 0x18]
add eax, ecx
lea ecx, [edi - 3]
add esp, 0x10
mov dword [eax], edx
mov ecx, dword [esi + ecx*8 + 4]
mov dword [eax + 4], ecx
mov edx, dword [esi + edi*8 - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [esi + edi*8 - 0xc]
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], ecx
test esi, esi
je 0x44e922
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
mov dx, word [ebx + 4]
not ecx
cmp edx, ecx
jge 0x44e908
push str.Subdirectory_path_too_long..._aborting_install__n
push 0x670640
call fcn.004f824a
add esp, 8
push 1
call fcn.004f8157
mov eax, dword [esp + 0x18]
xor edi, edi
mov di, word [ebx + 2]
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x44e972
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
mov dx, word [ebx + 8]
not ecx
cmp edx, ecx
jge 0x44e958
push str.Subvol_name_too_long..._aborting_install__n
push 0x670640
call fcn.004f824a
add esp, 8
push 1
call fcn.004f8157
xor edi, edi
mov eax, ecx
mov di, word [ebx + 6]
mov ebx, dword [esp + 0x18]
add edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add ebp, 0x10
mov eax, 0x3eb202fe
test esi, esi
mov dword [ebp], 0
jle 0x44e999
mov edx, esi
mov edi, dword [ecx]
add ecx, 4
sub eax, edi
dec edx
jne 0x44e98f
mov dword [ebp], eax
lea eax, [esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x452490
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x264
push ebx
push esi
lea eax, [esp + 0x68]
push edi
push eax
push 0x102
xor esi, esi
call dword [0x671a64]
mov ecx, dword [str..A:]
mov ebx, dword [esp + 0x278]
mov edx, dword [0x63f034]
mov edi, eax
mov eax, dword [0x63f038]
mov dword [esp + 0x30], ecx
mov cx, word [0x63f03c]
cmp ebx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], cx
je 0x4526cf
cmp dword [ebx + 0xc], esi
je 0x4526cf
xor edx, edx
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], edx
push esi
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], edx
push 0xc
push ecx
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x284]
push esi
push esi
push 0x2d1080
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4526cf
mov eax, dword [esp + 0x44]
cmp edi, esi
mov dword [esp + 0x28], eax
jle 0x4526ca
push ebp
lea ebp, [esp + 0x70]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
cmp ax, 0x41
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
je 0x4526ab
cmp ax, 0x42
je 0x4526ab
lea edx, [esp + 0x1c]
push edx
call dword [0x671a4c]
cmp eax, 2
jb 0x4526ab
cmp eax, 3
ja 0x4526ab
mov ax, word [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [esp + 0x48]
push 0x80000000
push ecx
mov word [esp + 0x58], ax
call dword [0x671a1c]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x4526ab
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
push eax
push edx
lea eax, [esp + 0x58]
push 0x20
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4526ab
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x58]
cmp eax, ecx
jne 0x45269e
mov eax, dword [ebx + 0xc]
xor edi, edi
test eax, eax
mov dword [esp + 0x24], eax
jle 0x45269e
mov esi, dword [ebx + 0xa34]
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x60]
add esi, 0x88
mov edx, dword [esi - 4]
mov eax, dword [esi - 8]
push 0
push 0x200
push edx
push eax
call fcn.004f5ce0
cmp eax, ebp
jne 0x45265e
cmp edx, dword [esp + 0x64]
jne 0x45265e
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0
push 0x200
push ecx
push edx
call fcn.004f5ce0
cmp eax, ebx
jne 0x45265e
cmp edx, dword [esp + 0x6c]
je 0x45266f
mov eax, dword [esp + 0x24]
inc edi
add esi, 0x440
cmp edi, eax
jl 0x452623
jmp 0x452693
mov eax, dword [esp + 0x27c]
mov dx, word [esp + 0x1c]
mov ecx, edi
mov eax, dword [eax + 0xa34]
shl ecx, 4
add ecx, edi
shl ecx, 6
mov word [ecx + eax + 0x98], dx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x27c]
push esi
call fcn.004b6a60
mov ebp, dword [esp + 0x14]
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add eax, 4
add ebp, 8
cmp eax, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
jl 0x452547
pop ebp
mov esi, 1
mov edi, dword [esp + 0x274]
push edi
call fcn.004f4ed0
push edi
mov dword [ebx + 0xa28], eax
call fcn.004f4e80
add esp, 8
mov dword [ebx + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x264
ret
Function at 0x452b40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x760b28]
push esi
cmp eax, 2
jl 0x452b9a
mov eax, dword [esp + 0x14]
push 0
cdq
push 0x200
push edx
push eax
call fcn.004f5ce0
mov esi, dword [esp + 8]
push edx
push eax
push esi
call fcn.004b6ad0
add esp, 0xc
test eax, eax
jne 0x452b76
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
shl ecx, 9
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
pop esi
neg eax
dec eax
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
push 1
call fcn.00452a90
add esp, 0x18
pop esi
ret

Function at 0x455900
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov esi, ebx
shl esi, 0xb
test eax, eax
mov dword [esp + 0x24], 0
je 0x455963
mov ecx, dword [eax + 0x3d2cc]
test ecx, ecx
je 0x455963
push 0
push 0x800
push 0
push edi
call fcn.004f5ce0
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.004b6ad0
mov edx, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x24]
push 0
push ecx
push esi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x455979
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push esi
push ebp
push ebx
push edi
push ecx
call fcn.004cc730
add esp, 0x18
test eax, eax
je 0x4559ad
mov edx, dword [esp + 0x24]
cmp edx, esi
jae 0x4559ad
mov ecx, edx
shr ecx, 0xb
add edi, ecx
sub ebx, ecx
shl ecx, 0xb
add ebp, ecx
test ebx, ebx
jbe 0x4559ad
cmp edx, 0x800
jae 0x455910
push 0x1e
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x456400
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x529821
push eax
mov eax, 0x22a0
mov dword fs:[0], esp
call fcn.004f5a60
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x10]
call fcn.004a7c50
push 0x672d14
lea ecx, [esp + 8]
mov dword [esp + 0x22b0], 0
call fcn.0050e01c
mov byte [esp + 0x22ac], 1
call fcn.004a6ce0
cmp dword [0x66f4ec], 5
jne 0x456490
push str.Ripping...
push 0x1400
call fcn.004dd120
push eax
lea eax, [esp + 0x1208]
push eax
call fcn.004f59f2
push str.Rip_to:
push 0x13f6
call fcn.004dd120
add esp, 0x18
jmp 0x45654c
mov eax, dword [0x672f74]
test eax, eax
je 0x456512
cmp dword [eax], 0
je 0x4564e2
push ecx
mov dword [esp + 0xc], esp
mov edx, dword [eax]
mov ecx, esp
push edx
call fcn.0050e01c
lea eax, [esp + 0xc]
push eax
call fcn.004b8810
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x22b0], 2
call fcn.0050e0ef
lea ecx, [esp + 8]
mov byte [esp + 0x22ac], 1
call fcn.0050dfa8
mov eax, dword [0x672f74]
test eax, eax
je 0x456512
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x456512
mov ecx, dword [esp + 4]
push ecx
push str.Testing__s...
push 0x2736
call fcn.004dd120
add esp, 8
lea edx, [esp + 0x1200]
push eax
push edx
jmp 0x456532
mov eax, dword [esp + 4]
push eax
push str.Extracting__s...
push 0x2735
call fcn.004dd120
add esp, 8
lea ecx, [esp + 0x1200]
push eax
push ecx
call fcn.004f5dd2
add esp, 0xc
push str.Extract_to:
push 0x146e
call fcn.004dd120
add esp, 8
push eax
lea ecx, [esp + 0x2200]
call fcn.0050e13f
add esi, 0x10
lea ecx, [esp + 0x21fc]
push esi
call fcn.0050e3d5
mov ecx, dword [0x6c6220]
mov eax, dword [0x672f74]
test ecx, ecx
mov dword [esp + 0x11f4], 0
mov dword [esp + 0x22a0], 0x456650
mov dword [esp + 0x2290], eax
mov dword [esp + 0x2274], 1
je 0x4565ac
mov edx, dword [eax + 0x1418]
mov dword [0x6c7234], edx
lea ecx, [esp + 0xc]
call fcn.0050ea9c
mov eax, dword [0x672f74]
test eax, eax
je 0x456609
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x456604
mov eax, dword [0x760b24]
test eax, eax
jne 0x456604
push 0x40
push str.No_errors_found_during_test.
push 0x2733
call fcn.004dd120
add esp, 8
push eax
call fcn.004b4a10
add esp, 8
mov ecx, 0x71d1e8
call fcn.004b70d0
test eax, eax
je 0x456609
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004a6d40
lea ecx, [esp + 4]
mov byte [esp + 0x22ac], 0
call fcn.0050dfa8
lea ecx, [esp + 0xc]
mov dword [esp + 0x22ac], 0xffffffff
call fcn.004a7de0
mov ecx, dword [esp + 0x22a4]
pop esi
mov dword fs:[0], ecx
add esp, 0x22ac
ret
Function at 0x45641f
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x529821
push eax
mov eax, 0x22a0
mov dword fs:[0], esp
call fcn.004f5a60
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x10]
call fcn.004a7c50
push 0x672d14
lea ecx, [esp + 8]
mov dword [esp + 0x22b0], 0
call fcn.0050e01c
mov byte [esp + 0x22ac], 1
call fcn.004a6ce0
cmp dword [0x66f4ec], 5
jne 0x456490
push str.Ripping...
push 0x1400
call fcn.004dd120
push eax
lea eax, [esp + 0x1208]
push eax
call fcn.004f59f2
push str.Rip_to:
push 0x13f6
call fcn.004dd120
add esp, 0x18
jmp 0x45654c
mov eax, dword [0x672f74]
test eax, eax
je 0x456512
cmp dword [eax], 0
je 0x4564e2
push ecx
mov dword [esp + 0xc], esp
mov edx, dword [eax]
mov ecx, esp
push edx
call fcn.0050e01c
lea eax, [esp + 0xc]
push eax
call fcn.004b8810
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x22b0], 2
call fcn.0050e0ef
lea ecx, [esp + 8]
mov byte [esp + 0x22ac], 1
call fcn.0050dfa8
mov eax, dword [0x672f74]
test eax, eax
je 0x456512
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x456512
mov ecx, dword [esp + 4]
push ecx
push str.Testing__s...
push 0x2736
call fcn.004dd120
add esp, 8
lea edx, [esp + 0x1200]
push eax
push edx
jmp 0x456532
mov eax, dword [esp + 4]
push eax
push str.Extracting__s...
push 0x2735
call fcn.004dd120
add esp, 8
lea ecx, [esp + 0x1200]
push eax
push ecx
call fcn.004f5dd2
add esp, 0xc
push str.Extract_to:
push 0x146e
call fcn.004dd120
add esp, 8
push eax
lea ecx, [esp + 0x2200]
call fcn.0050e13f
add esi, 0x10
lea ecx, [esp + 0x21fc]
push esi
call fcn.0050e3d5
mov ecx, dword [0x6c6220]
mov eax, dword [0x672f74]
test ecx, ecx
mov dword [esp + 0x11f4], 0
mov dword [esp + 0x22a0], 0x456650
mov dword [esp + 0x2290], eax
mov dword [esp + 0x2274], 1
je 0x4565ac
mov edx, dword [eax + 0x1418]
mov dword [0x6c7234], edx
lea ecx, [esp + 0xc]
call fcn.0050ea9c
mov eax, dword [0x672f74]
test eax, eax
je 0x456609
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x456604
mov eax, dword [0x760b24]
test eax, eax
jne 0x456604
push 0x40
push str.No_errors_found_during_test.
push 0x2733
call fcn.004dd120
add esp, 8
push eax
call fcn.004b4a10
add esp, 8
mov ecx, 0x71d1e8
call fcn.004b70d0
test eax, eax
je 0x456609
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004a6d40
lea ecx, [esp + 4]
mov byte [esp + 0x22ac], 0
call fcn.0050dfa8
lea ecx, [esp + 0xc]
mov dword [esp + 0x22ac], 0xffffffff
call fcn.004a7de0
mov ecx, dword [esp + 0x22a4]
pop esi
mov dword fs:[0], ecx
add esp, 0x22ac
ret
Function at 0x457e80
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [0x760b28]
sub esp, 0x28
cmp eax, 3
jl 0x457f58
push esi
mov esi, dword [esp + 0x34]
xor eax, eax
movsx cx, byte [esi + 0xc6]
movsx dx, byte [esi + 0xc7]
mov dword [esp + 0xc], eax
add ecx, 0x76c
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
movsx cx, byte [esi + 0xc9]
mov dword [esp + 0x14], eax
mov word [esp + 0xe], dx
movsx dx, byte [esi + 0xca]
mov dword [esp + 0x18], eax
mov word [esp + 0x14], cx
movsx ax, byte [esi + 0xc8]
mov word [esp + 0x12], ax
mov word [esp + 0x16], dx
movsx ax, byte [esi + 0xcb]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push edx
mov word [esp + 0x20], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 4]
push eax
call fcn.00421a80
lea ecx, [esp + 8]
push ecx
movsx ecx, byte [esi + 0xcc]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*8]
shl edx, 2
sub eax, edx
push eax
call fcn.00421a50
add esp, 0xc
lea eax, [esp + 4]
lea ecx, [esp + 4]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x18], ecx
movsx dx, byte [eax + 0xc6]
mov dword [esp + 0x1c], ecx
add edx, 0x76c
mov dword [esp + 0x20], ecx
mov word [esp + 0x18], dx
movsx dx, byte [eax + 0xc8]
mov dword [esp + 0x24], ecx
mov word [esp + 0x1e], dx
movsx cx, byte [eax + 0xc7]
movsx dx, byte [eax + 0xca]
mov word [esp + 0x1a], cx
mov word [esp + 0x22], dx
movsx cx, byte [eax + 0xc9]
movsx ax, byte [eax + 0xcb]
mov word [esp + 0x20], cx
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
mov word [esp + 0x2c], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea edx, [esp]
lea eax, [esp]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add esp, 0x28
ret
Function at 0x45ae60
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x529c1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [0x614128]
mov cx, word [0x61412c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], cx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x32]
mov dword [esp + 0x14], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
call fcn.004b6fe0
mov edx, dword [esp + 0x15c]
mov dword [esp + 0x154], 0
push edx
call fcn.0045ae10
lea eax, [esp + 0xd0]
push str.DeviceSCDEmuSCDEmuCd
push eax
call fcn.004f5dd2
lea ecx, [esp + 0xd8]
push ecx
call fcn.004f5a40
add esp, 0x10
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, 0x41
mov dword [esp + 0x28], eax
mov ebp, ebx
cmp bx, 0x43
jbe 0x45afc8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
test edx, eax
je 0x45afc8
lea eax, [esp + 0x4c]
push 0x40
lea ecx, [esp + 0x30]
push eax
push ecx
mov word [esp + 0x38], bx
call dword [0x671ad0]
test eax, eax
jle 0x45afc8
cmp eax, 0x3f
jge 0x45afc8
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x4c]
lea esi, [esp + 0xcc]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x45afc8
lea eax, [esp + 0x4c]
push eax
call fcn.004f5a40
mov edx, dword [esp + 0x14]
add esp, 4
sub eax, edx
cmp eax, 1
je 0x45af77
cmp eax, 2
jne 0x45afc8
mov ecx, dword [esp + 0x10]
lea edx, [esp + ecx*2 + 0x4c]
push edx
call fcn.004f5bdc
mov edi, eax
add esp, 4
test edi, edi
jl 0x45afc8
cmp edi, 0x17
jge 0x45afc8
push 0x28
call fcn.004b6a20
mov esi, eax
add esp, 4
test esi, esi
je 0x45afc8
push ebp
lea eax, [esi + 4]
push 0x640e00
push eax
mov dword [esi + 0x24], edi
call fcn.004f5dd2
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esi], 0
push esi
call fcn.004b7050
mov ecx, dword [esp + 0x14]
inc ebx
inc ebp
shl ecx, 1
cmp bx, 0x5a
mov dword [esp + 0x14], ecx
jbe 0x45af03
lea ecx, [esp + 0x18]
xor edi, edi
call fcn.004b70d0
test eax, eax
jle 0x45b03e
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.004b70d0
test eax, eax
jle 0x45b031
push esi
lea ecx, [esp + 0x1c]
call fcn.004b7090
cmp dword [eax + 0x24], edi
jg 0x45b023
mov ecx, dword [esp + 0x15c]
push eax
call fcn.004b7050
push esi
lea ecx, [esp + 0x1c]
call fcn.004b7150
inc edi
lea ecx, [esp + 0x18]
inc esi
call fcn.004b70d0
cmp esi, eax
jl 0x45affc
lea ecx, [esp + 0x18]
call fcn.004b70d0
test eax, eax
jg 0x45afed
lea ecx, [esp + 0x18]
mov dword [esp + 0x154], 0xffffffff
call fcn.004b7020
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x45b620
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x529cb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0xf6
mov dword [esp + 0x18], esi
call fcn.004a77d0
mov ecx, dword [0x66f704]
lea edi, [esi + 0x68]
mov dword [esp + 0x1c], 0
mov dword [edi], ecx
mov edx, dword [0x66f704]
lea ebx, [esi + 0x6c]
mov dword [ebx], edx
mov eax, dword [0x66f704]
lea ebp, [esi + 0x70]
mov dword [ebp], eax
mov ecx, dword [0x66f704]
mov dword [esi + 0x74], ecx
mov edx, dword [0x66f704]
mov dword [esi + 0x78], edx
mov eax, dword [0x66f704]
mov dword [esi + 0x7c], eax
push fcn.0045c270
push 0x45c230
push 5
lea ecx, [esi + 0x80]
push 0x3c
push ecx
mov byte [esp + 0x30], 6
call fcn.004f85ea
push 0x672d14
mov ecx, edi
mov byte [esp + 0x20], 7
mov dword [esi], method.CDialog.virtual_0
call fcn.0050e13f
push 0x672d14
mov ecx, ebx
call fcn.0050e13f
push 0x672d14
mov ecx, ebp
call fcn.0050e13f
push 0x672d14
lea ecx, [esi + 0x74]
call fcn.0050e13f
push 0x672d14
lea ecx, [esi + 0x78]
call fcn.0050e13f
push 0x672d14
lea ecx, [esi + 0x7c]
call fcn.0050e13f
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4