joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c040
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x488bab
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x4b2098]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x828]
mov dword fs:[0], eax
mov edi, dword [esp + 0x838]
inc dword [0x4b3788]
mov ebx, 0x400
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0044ba29
xor ecx, ecx
xor ebp, ebp
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x41c0b7
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [0x4b3788]
push ecx
lea edx, [esp + 0x24]
push str.querysize_d
push edx
mov dword [esp + 0x83c], ebp
call fcn.004019b0
mov eax, dword [esp + 0x2c]
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x20], ebp
call fcn.0041b370
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x41c21f
push 0
push 0x84000100
push 0xffffffffffffffff
push 0
push edi
push ebp
mov ecx, esi
call fcn.0041af10
mov esi, eax
test esi, esi
je 0x41c22e
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push 0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 5
push esi
call edi
lea ecx, [esp + 0x24]
push ecx
call fcn.00467fac
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
push 0x13
push esi
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x24]
push ecx
call fcn.00467fac
add esp, 4
cmp eax, 0x194
jne 0x41c184
mov dword [esp + 0x1c], 0xffffffff
jmp 0x41c223
lea edx, [esp + 0x24]
push edx
call fcn.00467fac
add esp, 4
cmp eax, 0xc8
je 0x41c1b6
lea eax, [esp + 0x24]
push eax
call fcn.00467fac
add esp, 4
cmp eax, 0xce
je 0x41c1b6
mov dword [esp + 0x1c], 0xffffffff
jmp 0x41c223
cmp dword [0x4b045c], 1
je 0x41c223
push 0x800
lea ecx, [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x20], ebx
call fcn.00467da0
add esp, 0xc
push 0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0x25
push esi
call edi
push str.qupdater2.xx
lea ecx, [esp + 0x1c]
call fcn.00402410
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.00403c20
add esp, 8
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00401310
test bl, bl
je 0x41c223
mov dword [0x4b045c], 1
jmp 0x41c223
mov esi, dword [esp + 0x18]
test esi, esi
je 0x41c22e
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebp, ebp
je 0x41c239
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x830], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41c264
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.00467b90
add esp, 0x820
ret 4
Function at 0x41e050
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x488ea8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push str.RT_RCDATA
push 0xb3
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41e146
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41e146
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x41e146
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
call edi
push esi
push 0
mov dword [esp + 0x1c], 0
call edi
mov edi, eax
push 0x492b3c
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403080
mov eax, dword [eax]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e12a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 0xffffffff
je 0x41e146
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e16e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
Function at 0x41f2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x489100
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
push 0x494c78
lea ecx, [esp + 0x18]
call fcn.00402410
push str.RT_RCDATA
push 0xb3
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41f3b0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41f3b0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x41f3b0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
lea ecx, [esp + 0x18]
call fcn.0041dde0
lea eax, [esp + 0x10]
lea ecx, [edi + 0xa4]
push eax
mov byte [esp + 0x24], 1
call fcn.004022f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f3c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41f3c2
push 0
lea ecx, [edi + 0xa4]
push 0x494c78
call fcn.00402100
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x20], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f3e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x422e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489678
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
test esi, esi
jge 0x422e41
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
cmp esi, dword [0x4b37f8]
jge 0x422e2d
push 0xf0013
call fcn.00422bb0
add esp, 4
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.00411e10
cmp esi, dword [0x4b37f8]
mov dword [esp + 0x38], 0
jge 0x422ee5
mov ecx, dword [0x4b37f4]
lea eax, [esi + esi*8]
lea edx, [ecx + eax*4]
push edx
lea ecx, [esp + 0x10]
call fcn.00412460
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x20]
call fcn.00403300
push 0x490090
lea ecx, [esp + 0x20]
call fcn.00403300
sub esp, 0x24
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
call fcn.00402c90
push esi
mov ecx, 0x4b37f0
call fcn.00422d90
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esp + 0xc]
call fcn.00402a90
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
call fcn.0043ea0b
int3
Function at 0x422f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4896c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
push eax
mov dword [esp + 0x28], esi
call fcn.00401380
add eax, 0x10
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x24], 1
cmp dword [eax - 0xc], esi
je 0x422fbc
lea esi, [eax - 0x10]
push esi
call fcn.00401380
mov edi, dword [esp + 0x30]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x24], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4230a1
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x4230a1
push 0x4b3830
lea ecx, [esp + 0x10]
call fcn.004022f0
mov ecx, dword [0x4b382c]
push ecx
push str.listurl_base
lea ecx, [esp + 0x14]
call fcn.00402d90
mov edx, dword [esp + 0x34]
push edx
push str.filename
lea ecx, [esp + 0x14]
call fcn.00402d90
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x494c78
call fcn.00402410
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
mov byte [esp + 0x30], 2
call fcn.00401380
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x1c]
add esp, 4
push eax
mov byte [esp + 0x30], 1
call fcn.00406920
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.004022f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42306a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
push esi
call fcn.00401380
mov edi, dword [esp + 0x30]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x24], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4230a1
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea ecx, [esp + 0x30]
call fcn.00402a90
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4244d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x489978
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4245af
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424503
sub eax, edx
sar eax, 1
je 0x4245af
call fcn.0044ba29
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x424532
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push 0x493aa4
push edx
mov dword [esp + 0x20], 0
call fcn.004019b0
add esp, 0xc
push 0x49258c
push 0x493aa0
lea ecx, [esp + 0x24]
call fcn.00402d90
mov esi, dword [esp + 0x1c]
push 0
push 0
push esi
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4245af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4246d0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x4899f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
push edi
lea ecx, [esp + 0x14]
call fcn.00402410
push 4
push 0x492d38
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], 0
call fcn.00403160
push 0x48fda0
push 0x48fd98
lea ecx, [esp + 0x18]
call fcn.00402d90
lea ecx, [esp + 0x1c]
call fcn.0044e923
mov eax, dword [esp + 0x10]
push 0
mov bl, 1
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], bl
call fcn.0044e99e
test eax, eax
je 0x4247ec
lea ecx, [esp + 0x1c]
call fcn.0044e69a
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0044e8e4
test eax, eax
jne 0x4247e4
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x38]
push 0x10
lea ecx, [esp + 0x20]
call eax
test eax, eax
je 0x4247a2
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.0044eb9d
mov eax, dword [eax]
push eax
mov byte [esp + 0x40], 2
call fcn.004246d0
mov eax, dword [esp + 0x18]
jmp 0x4247c1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.0044eb9d
mov eax, dword [eax]
push eax
mov byte [esp + 0x40], 3
call fcn.004086c0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov byte [esp + 0x40], bl
add esp, 4
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4247e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x424756
lea ecx, [esp + 0x1c]
call fcn.0044e5b4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 0
call fcn.0044e94c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424832
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x427670
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4276fd
lea eax, [esp + 4]
push eax
push 0x64
push 2
push 0
push 0
push 0x11
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [esp + 4], 0
jne 0x4276ab
xor al, al
pop esi
pop ecx
ret
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x10
push esi
call edi
push 0
push 0
push 0x12
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
pop edi
test esi, esi
je 0x4276fd
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4276f6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ecx
ret
Function at 0x42cfc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48a896
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4b2098]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x264]
mov dword fs:[0], eax
call fcn.00403ba0
mov esi, eax
mov edi, edx
call fcn.0044ba29
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42d01f
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push edi
push esi
lea ecx, [esp + 0x1c]
push 0x490450
push ecx
mov dword [esp + 0x27c], ebx
call fcn.004019b0
mov esi, dword [esp + 0x24]
push esi
push str.OwerCheckTm
push 0x48fd60
call fcn.0040e120
add esp, 0x1c
push 0x104
lea edx, [esp + 0x5c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00467da0
lea ecx, [esp + 0x64]
add esp, 0xc
mov dword [esp + 0x2c], ecx
push str.downparam0
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00402410
mov eax, 1
mov byte [esp + 0x26c], al
cmp dword [0x4b045c], eax
jne 0x42d0d1
push 0xa
push str.downparam1
lea ecx, [esp + 0x18]
call fcn.00402100
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.00407280
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x38], ecx
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d114
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x26c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d146
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x26c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d16d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.00467b90
add esp, 0x260
ret
Function at 0x4324c0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push edi
mov ecx, 0x4b383c
call fcn.00401f40
push 0xffffffffffffffff
xor edi, edi
push edi
mov ecx, 0x4b3840
call fcn.0043ec8f
push 0x48fd74
push str.CheckVerNumber
push str.APPLICATION
call fcn.00405850
add esp, 0xc
test al, al
je 0x4325f3
push ebx
push esi
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0x42d1a0
push edi
push edi
lea ebx, [edi + 1]
mov dword [0x4b3acc], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x494460
push str.TimeOut
lea ecx, [esp + 0x18]
push 0x48fd60
push ecx
call fcn.0040b750
mov eax, dword [eax]
push eax
call fcn.00467fc2
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43256c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
imul esi, esi, 0x64
cmp esi, edi
jle 0x4325bb
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
lea ebx, [ebx]
push 0xf000d
call fcn.00422bb0
mov ecx, dword [0x4b3acc]
add esp, 4
cmp ecx, 2
jne 0x43259c
xor ebx, ebx
jmp 0x4325a4
cmp ecx, 3
jne 0x4325a6
lea ebx, [ecx - 2]
mov edi, esi
push eax
call ebp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, esi
jl 0x432580
pop ebp
test ebx, ebx
je 0x4325d7
mov ecx, dword [esp + 0x18]
push ecx
push 2
mov ecx, 0x4b37f0
call fcn.00412700
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 8
ret 4
mov edx, dword [0x4b383c]
cmp dword [edx - 0xc], 0
jne 0x4325ea
mov eax, dword [esp + 0x18]
push eax
jmp 0x4325c0
mov ecx, dword [esp + 0x18]
push ecx
push 3
jmp 0x4325c2
mov edx, dword [esp + 0x10]
push edx
call fcn.00431d30
xor eax, eax
pop edi
add esp, 8
ret 4
Function at 0x432a10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x48b269
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x18], ebx
mov ax, word [esp + 0x3c]
push 3
lea edx, [esp + 0x24]
push edx
push 2
mov word [esp + 0x48], ax
lea eax, [esp + 0x48]
push eax
push ebx
xor ecx, ecx
push 0xfde9
mov dword [esp + 0x48], ebx
mov word [esp + 0x56], cx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
push ecx
push edi
mov ecx, esi
call fcn.00432970
mov edx, dword [esp + 0x19]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], 1
call fcn.00432970
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, edi
mov dword [esp + 0x30], 1
call fcn.00403160
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x28], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432ae3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1a]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00432970
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, edi
mov dword [esp + 0x30], 2
call fcn.00403160
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x28], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432b2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x436580
Capabilities:
Get storage device properties

Disassembly:
push 0xffffffffffffffff
push 0x48b8eb
mov eax, dword fs:[0]
push eax
mov eax, 0x2d14
call fcn.004688c0
mov eax, dword [0x4b2098]
xor eax, esp
mov dword [esp + 0x2d10], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b2098]
xor eax, esp
push eax
lea eax, [esp + 0x2d28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2d38]
xor ebx, ebx
push 0x494c78
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
call fcn.00402410
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2d30], ebx
xor edi, edi
lea ecx, [ecx]
push edi
lea ecx, [esp + 0x418]
push str..PhysicalDrive_d
push ecx
call fcn.004333b0
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea edx, [esp + 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x436712
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push 0x2710
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x618]
push ebx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00467da0
add esp, 0xc
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x2710
lea edx, [esp + 0x620]
push edx
push 0xc
lea eax, [esp + 0x34]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4366d1
mov edx, dword [esp + 0x62c]
lea ecx, [esp + 0x2c]
push ecx
push 1
push edx
lea eax, [esp + 0x620]
push eax
call fcn.00433210
movsx ecx, byte [esp + 0x3c]
push ecx
call fcn.00469d4c
add esp, 0x14
test eax, eax
jne 0x4366c1
movsx edx, byte [esp + 0x3f]
push edx
call fcn.00469d4c
add esp, 4
test eax, eax
je 0x4366e0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.00404b70
jmp 0x4366e0
push ebx
push 0x494c78
lea ecx, [esp + 0x1c]
call fcn.00402100
lea ecx, [esp + 0x14]
call fcn.00404c60
mov ecx, eax
call fcn.00404cb0
push eax
lea ecx, [esp + 0x18]
call fcn.004022f0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], ebx
push esi
jg 0x436743
call ebp
inc edi
cmp edi, 0x10
jl 0x4365f0
jmp 0x436745
mov esi, dword [esp + 0x18]
push 0x494c78
mov ecx, esi
call fcn.00402410
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x2d30], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x436779
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
push eax
call fcn.00401380
mov esi, dword [esp + 0x1c]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x2d34], edx
add esp, 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436785
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x2d28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d10]
xor ecx, esp
call fcn.00467b90
add esp, 0x2d20
ret