joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011fd
Capabilities:
Copy file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x42e538], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x42e4d4
push 0x42e470
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401245
xor eax, eax
jmp 0x40126e
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40313d
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x10], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x42aa58]
mov dword [ecx + 0xb4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x42ddb4]
mov dword [eax + 0xac], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [ebp - 4]
mov dword [edx + 0xcc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xcc], 0
je 0x4031b5
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x1a0], 0x42aa60
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [eax + 0x1b4], ecx
jmp 0x403255
mov edx, dword [str.appcommand.ini]
mov dword [ebp - 0x28], edx
mov eax, dword [0x42dde8]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x42ddec]
mov dword [ebp - 0x20], ecx
mov dx, word [0x42ddf0]
mov word [ebp - 0x1c], dx
mov al, byte [0x42ddf2]
mov byte [ebp - 0x1a], al
push 0
push 0
push 4
push 0
push 0
push 2
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x403255
push 0x80
call fcn.004264f5
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x403255
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], 4
jne 0x403255
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
add ecx, 0x700
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xcc]
mov dword [eax + 0xb8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x42aa5c]
mov dword [eax + 0xb0], ecx
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 4]
mov eax, dword [0x42ddb0]
mov dword [edx + 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x184], 0x42a030
mov edx, dword [ebp - 4]
push edx
call fcn.00403905
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4036e3
Capabilities:
Copy file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
push 1
push 0xd
call fcn.00403339
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x403753
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0xa
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 4], 0
je 0x403766
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], 0
je 0x40377e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [ebp - 8]
jmp 0x403901
mov dword [ebp - 0x488], 0
mov eax, dword [str.setting.ini]
mov dword [ebp - 0x480], eax
mov ecx, dword [0x42ddf8]
mov dword [ebp - 0x47c], ecx
mov edx, dword [0x42ddfc]
mov dword [ebp - 0x478], edx
mov eax, dword [str.existing]
mov dword [ebp - 0x474], eax
mov ecx, dword [0x42de04]
mov dword [ebp - 0x470], ecx
mov dl, byte [0x42de08]
mov byte [ebp - 0x46c], dl
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.o23ne.doc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0xffffffff
jne 0x403801
xor eax, eax
jmp 0x403901
push 0
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x480]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0x80
push 4
push 0
push 1
push 4
lea edx, [ebp - 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x403843
xor eax, eax
jmp 0x403901
push 0
lea eax, [ebp - 0x490]
push eax
push 0x448
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4038d8
push 2
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x48c], eax
push 0
mov ecx, dword [ebp - 0x490]
push ecx
push 0
mov edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 0x484]
push ecx
mov edx, dword [ebp - 0x490]
push edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov edx, dword [ebp - 0x490]
push edx
push 0
mov eax, dword [ebp - 0x48c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 0x490], 0x448
je 0x403843
mov edx, dword [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4271f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42df30
cmp edx, dword [eax]
je 0x42721b
add eax, 8
inc ecx
cmp eax, 0x42dfc0
jl 0x42720c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42df30]
jne 0x427349
mov eax, dword [0x42e544]
cmp eax, 1
je 0x427323
test eax, eax
jne 0x42724c
cmp dword [0x42de84], 1
je 0x427323
cmp edx, 0xfc
je 0x427349
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x427283
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00427fe0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004260e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4272c6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004260e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4294b0
push edi
call fcn.00428160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00427fe0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00427ff0
lea eax, [ebp - 0xa0]
push 0x429490
push eax
call fcn.00427ff0
push dword [esi + 0x42df34]
lea eax, [ebp - 0xa0]
push eax
call fcn.00427ff0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004280d0
add esp, 0x2c
pop edi
jmp 0x427349
lea eax, [ebp + 8]
lea esi, [esi + 0x42df34]
push 0
push eax
push dword [esi]
call fcn.004260e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403350
Capabilities:
Encode data using xor

Disassembly:
shr byte [esi + 0x18e94b1d], 1
vmovdqa xmmword [ecx], xmm6
inc ebx
sub eax, 0x61fa98c6
shr esi, 1
sbb al, 0xc0
stosb byte es:[edi], al
pop dword [eax]
xor ebx, edx
pushal
pop ds
cwde
wait
stc
rcr byte [ebx], 0xe0
cmp byte [edx - 0x53], bh
push eax
dec esi
sbb byte [esi], dh
in eax, dx
invalid
cmp edi, edx
jo 0x40330f
add dword [edi - 0x21], edx
sbb al, 0xd8
dec esi
jo 0x4032fe
adc edi, dword [edi]
mov byte es:[0x8056be0e], al
and byte [eax + 0x1a311857], 0x53
mov ebp, 0x4240894
mov ch, 0x74
stosd dword es:[edi], eax
dec esi
push 0x5a
inc eax
mov dl, 0xa6
test byte [ecx + 0x22470d23], dh
dec ecx
add dword [ecx], eax
push es
and eax, 0x757d05ae
adc al, 0x54
sbb eax, 0x50898360
pop ebx
in eax, 0xe6
invalid
Function at 0x1001434a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014361
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x1001436b
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret
Function at 0x100157a2
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100157bb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x100157dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100157dd
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov esp, ebp
pop ebp
ret
Function at 0x1001d2f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001d325
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001d323
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001d35b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul esi, dword [eax], 0xa
mov ecx, dword [ebp - 0x18]
call fcn.100094c9
movsx eax, byte [eax]
lea eax, [esi + eax - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001dd9f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001ddcf
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ddcd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001ddf9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001ddf9
push 0x17db
push 0
push 0
push 0xca7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esp, ebp
pop ebp
ret
Function at 0x1002aa41
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002aa58
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x1002aa62
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret
Function at 0x1002e80a
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002e850
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x1002e866
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002e866
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret

Function at 0x1002e86a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002e8a4
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp - 0x10]
push 1
call fcn.1002ddb3
add esp, 0xc
jmp 0x1002e8c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002e8c0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret

Function at 0x1002e8c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002e932
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 1
mov eax, dword [ebp - 0x18]
push dword [eax]
push 0x3a7c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x28]
call fcn.1002e6b5
add esp, 0x1c
jmp 0x1002e938
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x1002eac2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002eae6
xor eax, eax
jmp 0x1002ec24
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002e80a
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002eb0e
xor eax, eax
jmp 0x1002ec24
lea eax, [ebp - 0xc]
push eax
push 0x78cc
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002e86a
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002eb32
xor eax, eax
jmp 0x1002ec24
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002e8c4
add esp, 0x18
push dword [ebp - 4]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
push 0x6db2
push 0x5383
call fcn.1002dea0
add esp, 0x18
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2fbe
call fcn.1002e93c
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.1002e99d
add esp, 0xc
push dword [ebp - 4]
call fcn.1002dba6
pop ecx
test eax, eax
jne 0x1002ebab
xor eax, eax
jmp 0x1002ec24
push dword [ebp - 4]
push 1
call fcn.100277c3
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002ec0c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002ebd6
xor eax, eax
jmp 0x1002ec24
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002ebef
xor eax, eax
jmp 0x1002ec24
push 1
push 0x1b4a
lea eax, [ebp - 4]
push eax
push 0x252e
push 0x5ced
call fcn.1002ea5a
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002ec1d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002ec21
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10041ec3
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10041edd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret

Function at 0x10042236
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004224d
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100422ba
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov esi, dword [ebp - 0x28]
add edx, dword [esi]
mov esi, dword [ebp - 8]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100423aa
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100423d0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100423ce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10042407
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
and dword [ecx + eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x1004266a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100426c2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x100426d6
push 0x22fa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret
Function at 0x10079589
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10071494
mov dword [ebp - 0x14], eax
cmp dword [0x10676698], esi
jne 0x1007967c
push 0x800
push esi
push 0x10006180
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10079609
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007975c
push esi
push esi
push 0x10006180
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007975c
push 0x10006198
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007975c
push eax
call ebx
push 0x100061a4
push edi
mov dword [0x10676698], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100061b4
push edi
mov dword [0x1067669c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100061c8
push edi
mov dword [0x106766a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106766a8], eax
test eax, eax
je 0x10079679
push 0x100061e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106766a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100796a1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10079694
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100796b6
push 4
pop eax
jmp 0x1007975e
cmp dword [ebp - 0x14], esi
je 0x100796b6
push dword [0x10676698]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007969b
mov eax, dword [0x106766a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10079714
cmp dword [0x106766a8], edi
je 0x10079714
push eax
call ebx
push dword [0x106766a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10079714
test eax, eax
je 0x10079714
call ecx
test eax, eax
je 0x10079709
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10079709
test byte [ebp - 8], 1
jne 0x10079714
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10079744
mov eax, dword [0x1067669c]
cmp eax, edi
je 0x10079741
push eax
call ebx
test eax, eax
je 0x10079741
call eax
mov esi, eax
test esi, esi
je 0x10079741
mov eax, dword [0x106766a0]
cmp eax, edi
je 0x10079741
push eax
call ebx
test eax, eax
je 0x10079741
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10676698]
call ebx
test eax, eax
je 0x1007975c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007975e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b805
mov esp, ebp
pop ebp
ret