joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f0c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x46f2a0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x46f11d
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x46f130
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x46f130
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46f180
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x46f180
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x46f190
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x46f190
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46f28f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00471e30
cmp dword [0x4c5238], 0
je 0x46f1d2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4c5238]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00471e30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x46f1f7
xor edx, edx
call fcn.0046ae90
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x46f223
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x46f23c
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f296
cmp dword [ebp - 0x10], 0
je 0x46f27b
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x46f28e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x46f28e
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x46fedc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x46ff37
cmp byte [ebx + 0x44d], 0
jne 0x46ff37
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x46ff05
xor esi, esi
jmp 0x46ff21
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.004044d8
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.004077ec
test esi, esi
je 0x46ff44
mov eax, esi
call fcn.004044f4
jmp 0x46ff44
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.004077ec
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x474df8
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x474e35
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x474e23
mov al, 7
jmp 0x474e6e
cmp edx, 5
jb 0x474e6e
mov al, 5
cmp dword [esp + 8], 1
jb 0x474e6e
mov al, 6
jmp 0x474e6e
cmp eax, 1
jne 0x474e6c
mov al, 1
cmp dword [esp + 4], 4
ja 0x474e51
cmp dword [esp + 4], 4
jne 0x474e53
cmp dword [esp + 8], 0xa
jb 0x474e53
mov al, 2
cmp dword [esp + 4], 4
ja 0x474e68
cmp dword [esp + 4], 4
jne 0x474e6e
cmp dword [esp + 8], 0x5a
jb 0x474e6e
mov al, 3
jmp 0x474e6e
xor eax, eax
add esp, 0x11c
ret

Function at 0x47b424
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x47b488
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00407794
push eax
mov eax, esi
call fcn.00407794
push eax
mov eax, ebx
call fcn.00407794
push eax
push 0x47b498
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b48f
lea eax, [ebp + 8]
call fcn.00406b28
ret

Function at 0x47b654
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x47b6ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a4c
lea eax, [ebp - 0x44]
call fcn.0047c360
xor eax, eax
push ebp
push 0x47b6d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407794
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b6d8
lea eax, [ebp - 0x44]
call fcn.0047c470
ret

Function at 0x47d7b0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404a4c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x48a8cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48aac4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48aa94
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e120
call fcn.0047f190
call fcn.004ae114
xor ecx, ecx
mov dl, 1
mov eax, dword [0x483210]
call fcn.0048698c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48aa83
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004721e4
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], edi
cmp edi, 0x20
setne al
push eax
mov edx, dword [0x4bf6a4]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00486cac
mov edx, dword [0x4bf8e4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.00486bc4
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.0040787c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00486ad4
mov ebx, eax
test ebx, ebx
je 0x48aa6d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x30]
mov cl, 7
call fcn.00472224
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48aa66
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00472ca8
call fcn.0046b138
mov ecx, eax
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.0047610c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x70]
call fcn.0043bd98
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00486048
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00407890
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x48a804]
call fcn.0048abdc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48aa49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa50
mov eax, dword [ebp - 0xc]
call fcn.00404ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa8a
mov eax, dword [ebp - 8]
call fcn.00404ebc
ret
Function at 0x497648
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.0040890c
test eax, eax
jl 0x497703
cmp word [esi], 0xd
jne 0x4976ea
mov edi, dword [ebx + 0x18]
cmp byte [edi + 0x4a7], 0
je 0x4976d2
mov eax, edi
call fcn.00471c6c
push eax
mov eax, dword [ebx + 0x18]
call fcn.00471990
dec eax
pop edx
cmp edx, eax
jne 0x4976a3
mov eax, ebx
call fcn.0049edb4
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00471e94
jmp 0x497713
mov eax, dword [ebx + 0x18]
call fcn.00471c6c
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.00471990
sub eax, 2
cmp edi, eax
jne 0x4976c8
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00471e94
jmp 0x497713
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00471e94
push 0
push 0xd
push 0x464
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_SendMessageW
cmp word [esi], 0x1b
jne 0x497703
mov eax, dword [ebx + 0x18]
cmp byte [eax + 0x4a7], 0
je 0x497703
xor edx, edx
call fcn.00471e94
cmp word [esi], 0x21
jae 0x497713
mov eax, dword [ebx + 0x18]
mov dword [eax + 0x2e], 3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49c064
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49c16e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49c14e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e120
call fcn.0047f190
call fcn.0047e03c
mov dword [ebx + 0x10], eax
call fcn.004ae114
lea eax, [ebp - 0x10]
mov edx, 1
mov cl, 1
call fcn.0042d7ac
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x49c180
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
push 0x49c190
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c52bc], eax
push 0x49c1b8
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c52c0], eax
push 0x49c1dc
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c52c4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [ebx + 0x18], 0
jne 0x49c13d
cmp dword [0x4bf3a4], 0xffffffff
je 0x49c13d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c175
lea eax, [ebp - 0x10]
call fcn.00428100
ret
Function at 0x4afa64
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x4afb24
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a4c
push ebp
call fcn.004af99c
pop ecx
xor eax, eax
push ebp
push 0x4afb07
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00407794
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004077ec
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004077ec
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004077ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afb0e
push ebp
call fcn.004afa24
pop ecx
ret
Function at 0x40b920
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x40b931
xor eax, eax
jmp 0x40b974
mov eax, dword [0x471370]
test eax, eax
je 0x40b941
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [0x46f1a0]
push 0
push esi
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0
push str.tooltips_class32
push 0
call dword [0x46f0e8]
push 0x80
push dword [ebp + 0x14]
mov dword [0x471370], eax
call fcn.004100b0
add esp, 8
xor ebx, ebx
lea edi, [ebx + 1]
nop
lea eax, [ebx + 0x429]
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x40b9ec
push eax
push 0
push 0xc
push esi
call dword [0x46f13c]
mov eax, edi
and eax, dword [ebp + 0x10]
neg eax
push 0
sbb eax, eax
neg eax
push eax
push 0xf1
push esi
call dword [0x46f13c]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push esi
push dword [0x471370]
call fcn.004074a0
add esp, 0xc
jmp 0x40ba05
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
push esi
call dword [0x46f13c]
mov esi, dword [ebp + 8]
inc ebx
rol edi, 1
cmp ebx, 0xc
jl 0x40b990
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40bcb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp eax, 0x52
jne 0x40bcf8
push dword [esi + 4]
lea eax, [esi + 0xc]
push dword [esi + 8]
push eax
push dword [ecx + 8]
call fcn.0040cbb0
add esp, 0x10
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
cmp eax, 0x43
jne 0x40bd26
push dword [esi + 4]
lea eax, [esi + 0xc]
push dword [esi + 8]
push eax
push dword [ecx + 0xc]
call fcn.0040b920
add esp, 0x10
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
cmp eax, 0x54
jne 0x40be89
push ebx
push edi
mov edi, dword [ecx + 0x10]
lea ebx, [esi + 0x1c]
push 0x81
push dword [esi + 4]
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], eax
call fcn.004100b0
lea eax, [esi + 0x30]
mov dword [ebp - 0x34], 5
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 0x430
add esp, 8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
nop word [eax + eax]
lea eax, [ecx - 5]
push eax
push edi
call esi
push dword [ebp - 0x28]
mov edi, eax
push dword [ebp - 0x38]
call esi
mov esi, eax
mov eax, dword [ebx - 0x14]
test eax, eax
je 0x40be38
push eax
push 0
push 0xc
push esi
call dword [0x46f13c]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebx], 0
jne 0x40bde6
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
push 6
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x40be48
mov eax, dword [ebp - 0x30]
test eax, eax
push 6
cmove eax, edi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
dec eax
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x2c]
mov esi, dword [0x46f13c]
push dword [eax]
push 0
push 0xc
push edi
call esi
push 0
push dword [ebx]
push 0xc5
push edi
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40be48
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 0
push esi
call edi
mov ecx, dword [ebp - 0x28]
add ebx, 4
add dword [ebp - 0x2c], 4
inc ecx
sub dword [ebp - 0x34], 1
mov edi, dword [ebp - 0x38]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x28], ecx
jne 0x40bd70
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebx
mov eax, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
Function at 0x40cbb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x40cbc1
xor eax, eax
jmp 0x40cc04
mov eax, dword [0x47136c]
test eax, eax
je 0x40cbd1
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [0x46f1a0]
push 0
push edi
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0
push str.tooltips_class32
push 0
call dword [0x46f0e8]
push 0x7f
push dword [ebp + 0x14]
mov dword [0x47136c], eax
call fcn.004100b0
mov ebx, dword [0x46f13c]
add esp, 8
xor esi, esi
nop
lea eax, [esi + 0x427]
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x40cc71
push eax
push 0
push 0xc
push edi
call ebx
xor eax, eax
cmp dword [ebp + 0x10], esi
push 0
sete al
push eax
push 0xf1
push edi
call ebx
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push edi
push dword [0x47136c]
call fcn.004074a0
add esp, 0xc
jmp 0x40cc86
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xf1
push edi
call ebx
mov edi, dword [ebp + 8]
inc esi
cmp esi, 0xc
jl 0x40cc20
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x417ee0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0xffffffff
lea eax, [ebp - 0x28]
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x28
cmovne esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0
push eax
push esi
push edi
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0xc], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x417f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x417f92
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.004174e0
add esp, 0xc
test eax, eax
je 0x417f92
cmp dword [ebp - 0x14], 0x28
jae 0x417f76
cmp esi, 0x28
jae 0x417f92
cmp dword [edi + 4], 0x24
jb 0x417f92
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
Function at 0x419000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4739a8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], 0
je 0x419104
mov esi, dword [ebp + 0xc]
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x419099
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], ecx
push edx
push 0
push 0
push 0
push 0
push 0x90020
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push ecx
movups xmmword [ebp - 0x18], xmm0
call eax
test eax, eax
jne 0x419094
call ebx
cmp eax, 0x3e5
jne 0x41912d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call fcn.004174e0
add esp, 0xc
test eax, eax
je 0x41912d
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [edi + 0x24]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 8], 0
push ecx
push 0
push 0
push 0
push 0
push 0x9001c
xorps xmm0, xmm0
push edi
movups xmmword [ebp - 0x18], xmm0
call eax
test eax, eax
jne 0x4190e4
call ebx
cmp eax, 0x3e5
jne 0x41912d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.004174e0
add esp, 0xc
test eax, eax
je 0x41912d
test esi, esi
je 0x4190ee
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0x20
jne 0x419140
mov eax, dword [edi + 0x34]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov dword [edi + 0x34], 0
call fcn.0041cc80
add esp, 4
test eax, eax
jne 0x4190ee
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x34], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x34]
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push 0x45a854
call dword [0x46f068]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4191d5
mov dword [ebp - 0x24], 1
nop dword [eax + eax]
mov eax, esi
mov dword [ebp - 0x2c], esi
dec esi
test eax, eax
je 0x4191c8
mov eax, dword [edi + 0x28]
push 0
sub eax, 0xffffff80
mov dword [ebp - 0x14], 0x440d
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0x86b
push eax
push 0x1c
push eax
push 1
push ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4191c1
test byte [ebp - 8], 1
je 0x419170
mov dword [ebp - 0x24], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x34], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret