joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfc90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef1a1
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x10], 0x80004005
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004dfaa0
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
sub ecx, 1
mov dword [ebp - 0x26c], ecx
cmp dword [ebp - 0x26c], 4
ja case.default.0x4dfcff
mov edx, dword [ebp - 0x26c]
jmp dword [edx*4 + 0x4dfe94]
push 1
push 1
mov eax, dword [ebp + 8]
push eax
push 0x23
call fcn.00486810
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp case.default.0x4dfcff
push 1
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0x1a
call fcn.00486810
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp case.default.0x4dfcff
push 1
push 1
mov edx, dword [ebp + 8]
push edx
push 0x1c
call fcn.00486810
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne case.0x4dfcff.4
jmp case.default.0x4dfcff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004dfb60
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4dfd8c
push 1
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0x1c
call fcn.00486810
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne case.0x4dfcff.3
jmp case.default.0x4dfcff
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
and edx, 0x7fffbffb
add edx, 0x80004005
mov dword [ebp - 0x10], edx
jne case.default.0x4dfcff
lea ecx, [ebp - 0x23d]
call fcn.0040b800
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00414c40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.00414a10
cmp dword [ebp - 0x10], 0
jne 0x4dfe27
mov edx, dword [ebp + 8]
push edx
call fcn.0041cc80
add esp, 4
push 0x510f88
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00410d00
jmp 0x4dfe6d
lea ecx, [ebp - 0x261]
call fcn.0040b800
push eax
mov eax, dword [ebp - 0x268]
push eax
lea ecx, [ebp - 0x260]
call fcn.00414c40
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x260]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00414a10
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00413e50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret 8
Function at 0x4e06b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef643
mov eax, dword fs:[0]
push eax
mov eax, 0x1bac
call fcn.00456a90
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1bb8], ecx
push 0x10
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0044aec0
add esp, 0xc
mov dword [ebp - 0x2c], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0x513acc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0x1950
mov eax, dword [ebp - 0x28]
push eax
push 0
lea ecx, [ebp - 0x197c]
push ecx
call fcn.0044aec0
add esp, 0xc
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x197c]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4e079e
mov ecx, dword [ebp - 0x17ec]
mov dword [ebp - 0x1b88], ecx
mov dword [ebp - 0x1b8c], 0
jmp 0x4e0777
mov edx, dword [ebp - 0x1b8c]
add edx, 1
mov dword [ebp - 0x1b8c], edx
mov eax, dword [ebp - 0x1b8c]
cmp eax, dword [ebp - 0x1b88]
jge 0x4e079e
mov ecx, dword [ebp - 0x1b8c]
mov edx, dword [ebp - 0x1b8c]
mov al, byte [ebp + edx - 0x17e8]
mov byte [ebp + ecx - 0x16], al
jmp 0x4e0768
xor ecx, ecx
mov word [ebp - 0x1b84], cx
push 0x206
push 0
lea edx, [ebp - 0x1b82]
push edx
call fcn.0044aec0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x1b84]
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ecx, [ebp - 0x1bb1]
call fcn.0040b800
push eax
lea edx, [ebp - 0x1b84]
push edx
lea ecx, [ebp - 0x1bb0]
call fcn.00414c40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1bb0]
push eax
mov ecx, dword [ebp - 0x1bb8]
add ecx, 4
call fcn.00415500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1bb0]
call fcn.00414a10
push 0
push 0x513ad4
mov ecx, dword [ebp - 0x1bb8]
add ecx, 8
call fcn.0041dcb0
mov dword [ebp - 0x1b90], eax
jmp 0x4e085c
mov ecx, dword [ebp - 0x1b90]
push ecx
push 0x513adc
mov ecx, dword [ebp - 0x1bb8]
add ecx, 8
call fcn.0041dcb0
mov dword [ebp - 0x1b90], eax
cmp dword [ebp - 0x1b90], 0xffffffff
je 0x4e087e
push 1
mov edx, dword [ebp - 0x1b90]
push edx
mov ecx, dword [ebp - 0x1bb8]
add ecx, 8
call fcn.00414d50
jmp 0x4e083c
mov ecx, dword [ebp - 0x1bb8]
add ecx, 4
call fcn.00417180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret
Function at 0x4e1eb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
call fcn.0043ead0
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4e1ee1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0x44]
call eax
cmp eax, 1
jne 0x4e1ee1
mov byte [ebp - 0xd], 0
jmp 0x4e1ee5
mov byte [ebp - 0xd], 1
mov ecx, dword [ebp + 8]
push ecx
movzx edx, byte [ebp + 0xc]
push edx
movzx eax, byte [ebp - 0xd]
push eax
lea ecx, [ebp - 8]
call fcn.00441ae0
lea ecx, [ebp - 8]
push ecx
push 0x4e1d70
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp + 8]
call fcn.004333f0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e39f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec7bb
mov eax, dword fs:[0]
push eax
sub esp, 0x324
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x330], ecx
lea ecx, [ebp - 0x324]
call fcn.00419540
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x31c], ax
push 0xfe
push 0
lea ecx, [ebp - 0x31a]
push ecx
call fcn.0044aec0
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
add edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x328], edx
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x330]
add ecx, 4
call fcn.00414d50
cmp dword [ebp + 0x10], 0
jne 0x4e3a98
push str.Common
lea eax, [ebp - 0x31c]
push eax
call fcn.0044ac48
add esp, 8
cmp dword [ebp + 0xc], 0
jne 0x4e3ab4
push str.Programs
lea ecx, [ebp - 0x31c]
push ecx
call fcn.0044ac1a
add esp, 8
jmp 0x4e3aea
cmp dword [ebp + 0xc], 1
jne 0x4e3ad0
push str.Desktop
lea edx, [ebp - 0x31c]
push edx
call fcn.0044ac1a
add esp, 8
jmp 0x4e3aea
cmp dword [ebp + 0xc], 2
jne 0x4e3aea
push str.AppData
lea eax, [ebp - 0x31c]
push eax
call fcn.0044ac1a
add esp, 8
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov ecx, dword [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x324]
call fcn.00419460
test eax, eax
je 0x4e3b2e
mov byte [ebp - 0x329], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.00419520
mov al, byte [ebp - 0x329]
jmp 0x4e3c19
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x31c]
push ecx
lea ecx, [ebp - 0x324]
call fcn.004193a0
test eax, eax
je 0x4e3b73
mov byte [ebp - 0x32a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.00419520
mov al, byte [ebp - 0x32a]
jmp 0x4e3c19
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
cmp dword [ebp + 0xc], 2
jne 0x4e3b9a
push str.MicrosoftInternet_ExplorerQuick_Launch_
lea eax, [ebp - 0x21c]
push eax
call fcn.0044ac1a
add esp, 8
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x330]
call fcn.00419360
cmp dword [ebp + 8], 0
je 0x4e3bfa
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
je 0x4e3bfa
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x330]
add ecx, 4
call fcn.00410d00
mov edx, dword [ebp + 8]
push edx
call fcn.00448da2
add esp, 4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
je 0x4e3bfa
push str..lnk
mov ecx, dword [ebp - 0x330]
add ecx, 4
call fcn.00410d00
mov byte [ebp - 0x32b], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.00419520
mov al, byte [ebp - 0x32b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e6870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed5a3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x22c
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x599a34]
add eax, 1
mov dword [0x599a34], eax
cmp dword [0x599a34], 1
jle 0x4e68ce
push str._n_Dbl_crahes__n
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b2200
add esp, 8
jmp 0x4e6a2f
mov dword [ebp - 4], 0
push str.DbgHelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e69fb
push str.MiniDumpWriteDump
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4e69ea
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.Babylonuser.dmp
lea edx, [ebp - 0x228]
push edx
call fcn.0044ac1a
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x4e6986
push str.mdmp_err1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b2200
add esp, 8
jmp 0x4e69e8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x234], 1
push 0
push 0
lea eax, [ebp - 0x23c]
push eax
push 1
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x18]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._n_dump_created__n
mov eax, dword [ebp + 8]
push eax
call fcn.004b2200
add esp, 8
jmp 0x4e69fb
push str._mdmp_err2_
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b2200
add esp, 8
jmp 0x4e6a1b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x599a34]
sub eax, 1
mov dword [0x599a34], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret
Function at 0x4e6b10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee004
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x4e6b4d
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00414d50
mov ax, word [0x5079e4]
mov word [ebp - 0x20], ax
xor ecx, ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov word [ebp - 0x12], cx
push 8
lea edx, [ebp - 0x20]
push edx
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 2
jge 0x4e6b82
xor eax, eax
jmp 0x4e6bd7
cmp dword [ebp + 8], 0
je 0x4e6bbf
lea ecx, [ebp - 0x41]
call fcn.0040b800
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
call fcn.00414c40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00414a10
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x4e6bd5
lea eax, [ebp - 0x20]
push eax
call fcn.00487eb0
add esp, 4
jmp 0x4e6bd7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret

Function at 0x4e8cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5ab3
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5392a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x595b40], 0
je 0x4e8cfd
push 0
mov ecx, 0x595ce0
call fcn.004c9c40
push 2
push 0x66
mov eax, dword [0x595ba0]
mov edx, dword [eax]
mov ecx, dword [0x595ba0]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x38]
mov eax, dword [edx + 0x138]
call eax
cmp eax, 0x1d4e
jl 0x4e8d37
mov ecx, dword [ebp + 8]
call fcn.004e83a0
cmp dword [0x595b40], 0
jne 0x4e8db6
push 0
push 0x44
push 0
push 0x37
push 0x16
push 0x37
push 0
call fcn.004be4a0
add esp, 0x1c
cmp eax, 6
jne 0x4e8db4
lea ecx, [ebp - 0x31]
call fcn.0040b800
push eax
lea ecx, [ebp - 0x30]
call fcn.004148f0
mov dword [ebp - 4], 0
push str.src2
push str.bgl_installer
lea ecx, [ebp - 0x30]
push ecx
call fcn.004c5b80
add esp, 0xc
push 5
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.00413e50
push eax
push 0x513ac0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00414a10
jmp 0x4e8dee
cmp dword [0x595b44], 0x1772
jge 0x4e8dda
push 0
push 0x40
push 0
push 0x37
push 0x19
push 0x37
push 0
call fcn.004be4a0
add esp, 0x1c
jmp 0x4e8dee
push 0
call fcn.004e89a0
add esp, 4
push 0
call fcn.004c86f0
add esp, 4
push 0
push 0
push 0x403
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004489b2
mov esp, ebp
pop ebp
ret 4
Function at 0x401250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
mov ebx, eax
mov eax, 0x40d4f8
cmove ebx, eax
mov eax, ebx
call dbg.is_exe_file
test eax, eax
je 0x401290
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000000
call dword [sym.imp.advapi32.dll_RegQueryValueW]
mov ebx, dword [ebp - 4]
sub esp, 0x10
test eax, eax
leave
sete al
movzx eax, al
add eax, eax
ret
Function at 0x401a90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x2c
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], edx
test eax, eax
je 0x401b80
xor ebx, ebx
lea esi, [esi]
nop
mov eax, dword [eax]
mov esi, ebx
add ebx, 1
test eax, eax
jne 0x401ab0
lea eax, [ebx*4]
mov dword [esp + 4], 0
mov ecx, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [edi + 4]
sub esp, 0xc
mov edx, ecx
test eax, eax
je 0x401b01
mov dword [edx], eax
mov eax, dword [eax]
add edx, 4
test eax, eax
jne 0x401af6
mov eax, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax*4 + 0x40d4ac]
mov dword [esp + 8], 4
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
call dword [sym.imp.ucrtbase.dll_qsort]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, ecx
mov dword [edi + 4], edx
test esi, esi
jne 0x401b42
jmp 0x401b56
mov edx, dword [eax]
mov ebx, dword [eax + 4]
add eax, 4
mov dword [edx], ebx
sub esi, 1
jne 0x401b40
mov eax, dword [ebp - 0x20]
mov edx, dword [ecx + eax - 4]
mov dword [edx], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401b90
Capabilities:
Set application hook

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
add eax, 0x164
sub esp, 0x40
mov dword [ebp - 0x28], eax
mov eax, dword [0x417020]
mov ecx, dword [ebx + 0x14c]
mov edx, dword [ebx + 0x150]
mov dword [ebp - 0x2c], 0x40d4bc
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x20], ecx
sub eax, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x158]
mov dword [ebp - 0x10], 0
sub eax, edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 4], dbg.CBTProc
mov dword [esp + 0xc], eax
mov dword [esp], 5
call dword [sym.imp.user32.dll_SetWindowsHookExW]
mov dword [0x417bd8], ebx
mov esi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov dword [0x417bdc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [0x417044]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x220
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [ebx], eax
test eax, eax
mov eax, dword [0x417bdc]
mov dword [esp], eax
je 0x401d10
call dword [sym.imp.user32.dll_UnhookWindowsHookEx]
mov eax, dword [0x417060]
mov edx, 0x10
sub esp, 4
cmp eax, edx
mov dword [esp + 8], 1
cmovl eax, edx
mov dword [esp + 4], 0x1a0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
mov eax, dword [0x417060]
mov edx, 0x10
sub esp, 0x10
cmp eax, edx
mov dword [esp + 8], 1
cmovl eax, edx
mov dword [esp + 4], 0x1a0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x98]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x94]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x18f
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 8], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x186
mov dword [esp], eax
call esi
mov eax, dword [ebx]
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.user32.dll_UnhookWindowsHookEx]
xor eax, eax
sub esp, 4
jmp 0x401d09
Function at 0x401f50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x998]
sub esp, 0x9c0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x9a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x9a8]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
jne 0x401fe0
xor eax, eax
mov edx, 0x3f
lea ebx, [ebp - 0x808]
jmp 0x401fa7
movzx edx, word [eax + 0x40d4e4]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x401fa0
mov eax, dword [0x417048]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40b
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x908]
mov edx, dword [ebp - 0x9a4]
mov ebx, dword [sym.imp.shlwapi.dll_StrFormatByteSizeW]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x9a8]
lea esi, [ebp - 0x988]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x99c]
sub esp, 0x10
mov dword [ebp - 0x990], eax
lea eax, [ebp - 0x888]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x9a0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], 0x40
mov dword [esp], eax
call ebx
lea ebx, [ebp - 0x808]
mov dword [ebp - 0x98c], eax
mov eax, dword [0x417020]
sub esp, 0x10
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4c3
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x990]
sub esp, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x2400
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
jmp 0x401fb3
Function at 0x4020c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x86c
mov word [ebp - 0x824], cx
mov word [ebp - 0x822], bx
lea ebx, [ebp - 0x818]
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
mov dword [esp + 4], 0x417068
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x82c]
sub esp, 8
mov dword [esp + 0x18], eax
mov eax, dword [0x417020]
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x10], eax
mov eax, dword [0x41702c]
mov dword [esp + 0x2c], 0xd
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x65
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x102
mov dword [esp + 4], 0x50001002
mov dword [esp], eax
call sym._CreateToolbarEx_52
mov dword [0x417050], eax
mov eax, dword [0x417020]
sub esp, 0x34
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4b5
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
cmp word [ebp - 0x818], 0
je 0x402337
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4021d8
sub eax, ebx
sar eax, 1
add eax, 1
xor edx, edx
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], ebx
mov edi, 0x417068
mov word [ebp + eax*2 - 0x818], dx
mov eax, dword [0x417050]
mov ebx, 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov dword [esp], eax
call esi
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x828], 0x9001
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x417050]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x443
mov dword [esp], eax
call esi
mov eax, dword [0x417050]
add dword [ebp - 0x81c], 1
sub esp, 0x10
mov dword [esp + 0xc], 0x417068
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov dword [esp], eax
call esi
mov dword [ebp - 0x828], 0x9002
sub esp, 0x10
cmp word [0x417068], 0
je 0x402313
lea esi, [esi]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
je 0x402330
ja 0x402320
mov edx, 1
cmp eax, 2
je 0x4022c5
xor edx, edx
cmp eax, 4
sete dl
lea edx, [edx + edx + 2]
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], edx
mov dword [esp + 0xc], eax
mov eax, dword [0x417050]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x443
mov dword [esp], eax
call esi
add dword [ebp - 0x828], 1
add dword [ebp - 0x81c], 1
sub esp, 0x10
lea esi, [esi]
add edi, 2
cmp word [edi - 2], 0
jne 0x402300
add ebx, 1
cmp word [edi], 0
jne 0x402298
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
cmp eax, 6
sete dl
lea edx, [edx + edx*2 + 2]
jmp 0x4022c5
mov edx, 3
jmp 0x4022c5
mov eax, 1
jmp 0x4021e8