joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56b4a0
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x1bb
push dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [0x9111c4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x56b4f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56b620
push esi
push str.WinHttpConnect_failed__err:__d
push 0x1ef
jmp 0x56b606
push 0x800000
push 0
push 0
push 0
push 0x700e20
push 0x700e28
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 4], eax
test eax, eax
jne 0x56b53c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56b620
push esi
push str.WinHttpOpenRequest_failed__err:__d
push 0x1fb
jmp 0x56b606
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.0056ab30
mov esi, eax
add esp, 8
test esi, esi
jne 0x56b62f
push eax
mov eax, dword [ebp + 0x10]
push eax
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x56b5c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2ee2
jne 0x56b5b3
test byte [0x9538a8], 1
je 0x56b620
push eax
push 2
push str.GTI:_Request_to_get_reputation_from_GTI_timed_out__response_not_received_in__d_sec__err:__d
push 0x20d
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_winhttp_send_recv
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x20
jmp 0x56b620
test byte [0x9538a8], 1
je 0x56b620
push esi
push str.GTI:_WinHttpSendRequest_failed__err:__d
push 0x210
jmp 0x56b606
lea eax, [ebp - 4]
push eax
call fcn.0056af40
mov esi, eax
add esp, 4
test esi, esi
jne 0x56b62f
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x56b648
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56b620
push esi
push str.WinHttpReceiveResponse_failed__err:__d
push 0x220
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_winhttp_send_recv
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x1c
push esi
call fcn.004f1a60
mov esi, eax
add esp, 4
test esi, esi
je 0x56b63f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0056b400
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x56b651
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x56b63f
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56d950
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x56d9b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 1
je 0x56dac2
push esi
push str.The_GetFileVersion_Error__d
push 0x45
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qconf.c
push str.qconf_get_osversion_ntkernel
push dword [0x7d1dbc]
push 1
call fcn.004f21c0
add esp, 0x1c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.004f3510
mov edi, eax
add esp, 4
test edi, edi
jne 0x56d9f7
test byte [0x9538a8], 1
je 0x56d9ec
push str.Low_system_memory.
push 0x4e
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qconf.c
push str.qconf_get_osversion_ntkernel
push dword [0x7d1dbc]
push 1
call fcn.004f21c0
add esp, 0x18
pop edi
mov eax, 0xc
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
push dword [ebp - 4]
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x56da5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 1
je 0x56dab6
push esi
push str.The_GetFileVersionInfo_Error__d
push 0x56
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qconf.c
push str.qconf_get_osversion_ntkernel
push dword [0x7d1dbc]
push 1
call fcn.004f21c0
add esp, 0x1c
push edi
call fcn.004f3570
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x6ce50c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x56da96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 1
je 0x56dab6
push esi
push str.The_VerQueryValue_Error__d
push 0x5e
jmp 0x56da30
mov edx, dword [ebp - 8]
xor esi, esi
mov eax, dword [ebp + 8]
movzx ecx, word [edx + 0xa]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 0xe]
mov dword [eax], ecx
push edi
call fcn.004f3570
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x580fa0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x5810fb
mov eax, dword [ebp - 0x214]
xor esi, esi
test eax, eax
je 0x58102c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
test esi, esi
jne 0x5810fb
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x5810c7
nop dword [eax]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.00580fa0
mov esi, eax
test esi, esi
jne 0x5810fb
lea eax, [ebp - 0x228]
mov dword [ebp - 0x208], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x581080
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x5810de
push eax
call ebx
mov dword [ebp - 0x214], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], 0
call fcn.00580110
mov esi, eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x581108
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret 4
Function at 0x5813f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68210b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x58149c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x58149c
call fcn.0057fcd0
mov esi, eax
jmp 0x58158c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5814bf
call fcn.0057fcd0
jmp 0x58157f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x5814dd
call fcn.0057fcd0
jmp 0x58157f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x5814fe
mov esi, 0x8007000e
jmp 0x581581
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0057f930
jmp 0x581528
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x58153f
mov esi, 0x8007000e
jmp 0x581581
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x58155f
call fcn.0057fcd0
jmp 0x58157f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00581250
mov esi, eax
test edi, edi
je 0x58158c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x5815a5
lea ecx, [ebp - 0x418]
call fcn.005803c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret 0x10
Function at 0x59c8c0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x7ac008]
xor eax, eax
xor ebx, ebx
push str.Updating_service_configuration_for__ls._n
mov dword [ebp - 8], eax
xor edi, edi
call fcn.0063f38e
add esp, 8
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x59c917
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Failed_to_open_Service_Control_Manager:__lu_n
call fcn.0063f38e
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x43765351
push 0x208
call fcn.004f3590
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x59c950
push 0x717d00
call fcn.0063f38e
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 0xe
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jbe 0x59c97d
mov edi, 0xa1
push edi
push str.Failed_to_get_module_filename:__lu_n
call fcn.0063f38e
add esp, 8
jmp 0x59cab9
push dword [ebp - 4]
call fcn.00506810
add esp, 4
test eax, eax
je 0x59ca03
cmp word [eax], bx
je 0x59ca03
push str.scsrvc1.exe
push eax
call fcn.004f3800
add esp, 8
test eax, eax
jne 0x59ca03
push str.1.exe
push dword [ebp - 4]
call fcn.004f39b0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x59c9c4
mov edi, 0xa1
jmp 0x59cab9
push str..exe
call fcn.004f36b0
add esp, 4
push eax
push str..exe
push str.1.exe
call fcn.004f36e0
add esp, 4
push eax
push dword [ebp - 0xc]
call fcn.004f38e0
push str..exe
call fcn.004f36b0
mov ecx, dword [ebp - 0xc]
add esp, 0x14
xor edx, edx
mov word [ecx + eax*2], dx
push 0x44765351
push 0x20c
call fcn.004f3590
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x59ca34
mov edi, 0xa1
push edi
push str.Failed_to_allocate_memory_for_service_path:__lu_n
call fcn.0063f38e
add esp, 8
jmp 0x59cab9
push dword [ebp - 4]
push 0x6dd7ec
push 0x20c
push eax
call fcn.004f3b60
add esp, 0x10
push 2
push dword [0x7ac008]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x59ca75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed___lu__n
call fcn.0063f38e
add esp, 8
jmp 0x59cab9
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x59caac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig_failed___lu__n
call fcn.0063f38e
add esp, 8
jmp 0x59cab9
push str.Service_config_changed_successfully_for_pathname._n
call fcn.0063f38e
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 4]
call fcn.004f3570
mov eax, dword [ebp - 8]
add esp, 4
test eax, eax
je 0x59cadd
push eax
call fcn.004f3570
add esp, 4
test ebx, ebx
je 0x59cae4
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b0f20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x10c
push 0x94cbb0
call fcn.004f3630
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.004f3630
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.004f3630
lea eax, [ebp - 0xc4]
push 0x20
push eax
call fcn.004f3630
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x44]
add esp, 0x20
push 0x10
push eax
push 0x59
push 0x800
call esi
test eax, eax
jg 0x5b0fa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x5a
push 0x800
call esi
test eax, eax
jle 0x5b0f87
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x728928
lea eax, [ebp - 0xc4]
push 0x80
push eax
call fcn.004f3b60
add esp, 0x14
call fcn.005953e0
mov edi, eax
test edi, edi
je 0x5b101e
cmp word [edi], 0
je 0x5b101e
push 0x42534d51
push 0x80
call fcn.004f3590
mov esi, eax
add esp, 8
test esi, esi
je 0x5b1111
push edi
push 0x6d1abc
push 0x80
push esi
call fcn.004f3b60
add esp, 0x10
jmp 0x5b1076
test byte [0x9538a8], 8
je 0x5b1058
lea eax, [ebp - 0xc4]
push eax
call fcn.004f3e90
push eax
push str.Config_ssLangId_is_not_set__default_system_locale_is__s_n
push 0x9c
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_msg_msg.c
push str.msg_lib_init
push dword [0x7de1f4]
push 8
call fcn.004f21c0
add esp, 0x20
lea eax, [ebp - 0xc4]
push 0x41534d51
push eax
call fcn.004f3d00
mov esi, eax
add esp, 8
test esi, esi
je 0x5b1111
push esi
call fcn.004f3e90
lea eax, [ebp - 0xc4]
push eax
call fcn.004f3e90
mov eax, dword [0x9538a8]
add esp, 8
test al, 8
je 0x5b10ed
lea eax, [ebp - 0xc4]
push eax
push str.Current_system_locale_is__s_n
push 0xaa
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_msg_msg.c
push str.msg_lib_init
push dword [0x7de1f4]
push 8
call fcn.004f21c0
mov eax, dword [0x9538a8]
add esp, 0x1c
test al, 8
je 0x5b10ed
push esi
push str.Current_language_is__s_n
push 0xab
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_msg_msg.c
push str.msg_lib_init
push dword [0x7de1f4]
push 8
call fcn.004f21c0
add esp, 0x1c
test ebx, ebx
je 0x5b1127
push 0x43534d51
push ebx
call fcn.004f3d00
add esp, 8
mov dword [0x94cbb4], eax
test eax, eax
jne 0x5b1127
push esi
call fcn.004f3570
add esp, 4
pop edi
pop esi
mov eax, 0xc
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc4]
mov word [0x94cc1f], 0x2004
push eax
push esi
mov word [0x94cc2f], 0x5959
mov byte [0x94cc25], 0x40
mov byte [0x94cc2c], 0x40
call fcn.005b1770
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x5bfd30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x45584251
push 0
push 0xa8
push 0x94cccc
call fcn.005d1e20
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x5bfdb3
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5bfd97
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x5bfd8c
shr eax, 8
cmp al, 2
je 0x5bfdc4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x276c
push eax
call fcn.004f1a60
mov esi, eax
add esp, 4
test esi, esi
je 0x5bfdc4
push 0x94cccc
call fcn.005d1e40
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x5c7710
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [eax], 0
push 0
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], eax
call ebx
mov esi, eax
test esi, esi
je 0x5c7789
lea ecx, [esi*2 + 2]
push 0x4c435351
push ecx
call fcn.004f3590
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x5c776b
mov ebx, 0xc
mov dword [ebp + 8], ebx
jmp 0x5c77cc
push eax
lea eax, [esi + 1]
push eax
call ebx
test eax, eax
jne 0x5c7789
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
mov ebx, eax
mov dword [ebp + 8], ebx
jmp 0x5c77c5
mov esi, dword [edi]
cmp word [esi], 0
je 0x5c77ba
push 0
push esi
push edi
call fcn.005c8f70
mov ebx, eax
add esp, 0xc
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x5c77cc
push esi
call fcn.004f36b0
add esp, 4
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], bx
jne 0x5c7791
push edi
call fcn.005c93d0
mov ebx, eax
mov dword [ebp + 8], eax
add esp, 4
test ebx, ebx
je 0x5c7844
mov esi, dword [edi + 4]
test esi, esi
je 0x5c7835
lea ebx, [edi + 4]
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
cmp eax, esi
jne 0x5c77f0
mov eax, dword [eax + 8]
mov dword [ebx], eax
test eax, eax
jne 0x5c7811
mov dword [edi + 8], ebx
jmp 0x5c7811
mov ecx, dword [eax + 8]
cmp ecx, esi
je 0x5c7800
mov eax, ecx
mov ecx, dword [eax + 8]
cmp ecx, esi
jne 0x5c77f7
lea ecx, [eax + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov dword [ecx], eax
test eax, eax
jne 0x5c7811
mov dword [edi + 8], ecx
push dword [esi]
call fcn.004f3570
push dword [esi + 4]
call fcn.004f3570
push esi
call fcn.004f3570
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x5c77d6
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x5c7844
push eax
call fcn.004f3570
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8f70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x214], eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x210], esi
push edi
test ebx, ebx
je 0x5c8fc0
push ebx
call fcn.004f36b0
push dword [ebp - 0x210]
lea esi, [eax + 1]
call fcn.004f36b0
add esp, 8
add eax, esi
mov esi, dword [ebp - 0x210]
jmp 0x5c8fca
push esi
call fcn.004f36b0
add esp, 4
inc eax
add eax, eax
push 0x43435351
push eax
mov dword [ebp - 0x210], eax
call fcn.004f3590
mov edi, eax
add esp, 8
test edi, edi
je 0x5c907f
test ebx, ebx
je 0x5c9006
push ebx
push esi
push 0x6eaef8
push dword [ebp - 0x210]
push edi
call fcn.004f3b60
add esp, 0x14
jmp 0x5c9016
push esi
push dword [ebp - 0x210]
push edi
call fcn.004f3880
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x5c90cc
mov ebx, dword [ebp - 0x214]
mov esi, dword [ebx + 4]
test esi, esi
je 0x5c9061
nop
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push eax
call fcn.004f3800
add esp, 8
test eax, eax
je 0x5c910a
mov esi, dword [esi + 8]
test esi, esi
jne 0x5c9040
push 0x44435351
push 0xc
call fcn.004f3590
mov esi, eax
add esp, 8
test esi, esi
jne 0x5c9095
push edi
call fcn.004f3570
add esp, 4
pop edi
pop esi
mov eax, 0xc
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
push 0x45435351
push edi
call fcn.004f3d00
mov dword [esi], eax
lea eax, [ebp - 0x20c]
push 0x46435351
push eax
call fcn.004f3d00
lea ecx, [esi + 8]
mov dword [esi + 4], eax
mov dword [ecx], 0
add esp, 0x10
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov dword [ebx + 8], ecx
jmp 0x5c910a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
test byte [0x9538a8], 8
je 0x5c910a
push eax
push edi
push str.Failed_to_get_the_unique_volume_name_for___s_._qerr:_0x_x._n
push 0x1ff
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_scan_scan.c
push str.scan_add_vol_in_list
push dword [0x9052f0]
push 8
call fcn.004f21c0
add esp, 0x20
push edi
call fcn.004f3570
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x5c9a70
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4f435351
push 0xc
call fcn.004f3590
mov esi, dword [ebp + 8]
add esp, 8
mov dword [esi + 0x848], eax
test eax, eax
jne 0x5c9a98
mov eax, 0xc
pop esi
pop ebp
ret
push ebx
xorps xmm0, xmm0
push edi
movq qword [eax], xmm0
push str.dllcache
mov dword [eax + 8], 0
call fcn.004f36b0
push 0x50435351
lea edi, [eax + 0x104]
lea ecx, [edi + edi]
push ecx
call fcn.004f3590
mov ecx, dword [esi + 0x848]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [esi + 0x848]
mov eax, dword [eax]
test eax, eax
jne 0x5c9ae5
lea edi, [eax + 0xc]
jmp 0x5c9c3b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
je 0x5c9c2a
push str.dllcache
push str.dllcache
call fcn.004f36e0
add esp, 4
add eax, 2
push eax
mov eax, dword [esi + 0x848]
mov eax, dword [eax]
lea eax, [eax + edi*2]
push eax
call fcn.004f3880
mov eax, dword [esi + 0x848]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push dword [eax + 4]
push str.TEMP
call ebx
mov edi, eax
test edi, edi
je 0x5c9bd2
lea ecx, [edi + edi]
push 0x51435351
push ecx
call fcn.004f3590
mov ecx, dword [esi + 0x848]
add esp, 8
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x848]
mov eax, dword [eax + 4]
test eax, eax
jne 0x5c9b72
lea edi, [eax + 0xc]
jmp 0x5c9c3b
push edi
push eax
push str.TEMP
call ebx
test eax, eax
je 0x5c9c2a
push 0x52435351
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [esi + 0x848]
push dword [eax + 4]
call fcn.00557250
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x5c9c3b
mov eax, dword [esi + 0x848]
push dword [eax + 4]
call fcn.004f3570
mov ecx, dword [esi + 0x848]
add esp, 4
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword [ecx + 4], eax
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call fcn.004f1a60
add esp, 4
mov edi, eax
test byte [0x9538a8], 1
je 0x5c9c1b
push edi
call fcn.004f1b00
push eax
push edi
push edi
push str.GetEnvironmentVariable___failed_for_TEMP:_err__d__0x_x_:__s_n
push 0x4a8
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_scan_scan.c
push str.scan_construct_absolute_skiplist
push dword [0x9052f0]
push 1
call fcn.004f21c0
add esp, 0x28
cmp ebx, 0xcb
jne 0x5c9c3b
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
mov edi, eax
add esp, 4
mov eax, dword [esi + 0x848]
xor ebx, ebx
cmp dword [eax], ebx
je 0x5c9c77
xor ecx, ecx
nop dword [eax]
mov eax, dword [esi + 0x848]
push dword [ecx + eax]
call fcn.004f3570
mov eax, dword [esi + 0x848]
lea ebx, [ebx + 1]
lea ecx, [ebx*4]
add esp, 4
cmp dword [eax + ecx], 0
jne 0x5c9c50
push eax
call fcn.004f3570
add esp, 4
mov dword [esi + 0x848], 0
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret