joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024c7
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4650cc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x2c], eax
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [esp + 0x24], edi
lea eax, [esp + 0x64]
push eax
push dword [ebp + 4]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x34]
call fcn.0041767f
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
push eax
push edi
call fcn.004176aa
push dword [esp + 0x34]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call ebx
mov esi, eax
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x80], 4
mov ecx, dword [ebp + 0x28]
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [esp + 0x6c]
sub eax, dword [esp + 0x64]
push 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
sub eax, dword [esp + 0x6c]
push 0x4889f4
xor ecx, ecx
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push edi
lea eax, [esp + 0x28]
push eax
push ecx
push ecx
push dword [ebp + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push esi
push edi
call ebx
push dword [esp + 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
lea ecx, [esp + 0x34]
call fcn.0041769c
test edi, edi
je 0x402609
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x2c]
call fcn.0040324e
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00437bed
add esp, 0x70
ret

Function at 0x402981
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call fcn.00402f0e
mov ecx, eax
call fcn.0040c2b8
mov esi, eax
mov edx, 0x47a880
mov ecx, esi
call fcn.0041d7ab
xor edi, edi
push edi
or edx, 0xffffffff
mov ecx, esi
call fcn.0041d44a
pop ecx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.0040384f
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.0041d09c
push 1
push edi
push edi
push dword [ebp - 4]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00401551
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x405a4f
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
push edi
mov edi, ecx
jne 0x405a5e
push 0xd
pop eax
jmp 0x405a84
push dword [esp + 0xc]
call fcn.00437bfc
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
ret 0xc
Function at 0x405f8c
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x22c]
mov eax, dword [ebx + 4]
push ebp
push esi
or eax, 0x2001f
push eax
push ecx
push dword [ebx]
xor ebp, ebp
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00405f3c
mov esi, eax
test esi, esi
jne 0x40606b
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x28]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [esp + 0x38], 0x100
call ebp
test eax, eax
jne 0x406043
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00405f8c
mov esi, eax
test esi, esi
jne 0x40606b
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebp
test eax, eax
je 0x406008
jmp 0x406045
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x40605a
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.0040613b
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x40607c
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437bed
add esp, 0x224
ret 4
Function at 0x40749f
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4650cc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x2c], eax
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [esp + 0x24], edi
lea eax, [esp + 0x64]
push eax
push dword [ebp + 4]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x34]
call fcn.0041767f
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
push eax
push edi
call fcn.004176aa
push dword [esp + 0x34]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call ebx
mov esi, eax
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x80], 4
mov ecx, dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [esp + 0x6c]
sub eax, dword [esp + 0x64]
push 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
sub eax, dword [esp + 0x6c]
push 0x488d58
xor ecx, ecx
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push edi
lea eax, [esp + 0x28]
push eax
push ecx
push ecx
push dword [ebp + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push esi
push edi
call ebx
push dword [esp + 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
lea ecx, [esp + 0x34]
call fcn.0041769c
test edi, edi
je 0x4075e1
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x2c]
call fcn.0040324e
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00437bed
add esp, 0x70
ret
Function at 0x407c79
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x810
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x80c], eax
mov eax, dword [esp + 0x820]
push ebx
mov ebx, dword [esp + 0x81c]
push ebp
push esi
push edi
mov esi, str.hwang
lea edi, [esp + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
mov dword [esp + 0x1c], eax
movzx ebp, bx
lea eax, [esp + 0x2e]
push 0
push eax
mov dword [esp + 0x1c], ecx
add ebp, 0x2b10
movsw word es:[edi], word [esi]
call fcn.00438850
push ebp
lea eax, [esp + 0x38]
push str.DTLInstallDlg::OnDTLUMSetAnimationTimer__d
push eax
call fcn.00437dbf
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [esp + 0x10]
push 0
shr ebx, 0x10
push ebx
push ebp
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x82c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebp
call fcn.0040820a
push eax
add eax, 0x10
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x38]
call fcn.00408233
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
mov dword [eax], 1
xor ecx, esp
xor eax, eax
call fcn.00437bed
add esp, 0x810
ret 0x10

Function at 0x407d57
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x814
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x824]
push ebx
push ebp
mov ebp, dword [esp + 0x824]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
lea ebx, [ecx + 0x38]
lea eax, [esp + 0xc]
mov dword [esp + 0x14], ecx
add ebp, 0x2b10
push eax
mov ecx, ebx
mov dword [esp + 0x14], ebp
call fcn.004080a3
mov eax, dword [esp + 8]
cmp eax, dword [ebx]
je 0x407e14
mov eax, dword [eax + 0x14]
cmp eax, dword [esp + 0x828]
jne 0x407e14
push esi
push edi
mov esi, str.hwang
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
lea eax, [esp + 0x32]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
push ebp
lea eax, [esp + 0x3c]
push str.DTLInstallDlg::OnDTLUMKillAnimationTimer__d
push eax
call fcn.00437dbf
add esp, 0x18
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00407e62
mov eax, dword [esp + 0x18]
push ebp
push dword [eax + 4]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x818]
pop ebp
pop ebx
mov dword [eax], 1
xor ecx, esp
xor eax, eax
call fcn.00437bed
add esp, 0x814
ret 0x10
Function at 0x409bcd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call fcn.00402f0e
mov ecx, eax
call fcn.0040c2b8
mov esi, eax
mov edx, 0x47b5bc
mov ecx, esi
call fcn.0041d7ab
xor edi, edi
push edi
or edx, 0xffffffff
mov ecx, esi
call fcn.0041d44a
pop ecx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.0040384f
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.0041d09c
push 1
push edi
push edi
push dword [ebp - 4]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00401551
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x40a27d
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4655bd
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x828]
mov dword fs:[0], eax
mov esi, dword [esp + 0x838]
mov edi, dword [esp + 0x83c]
mov ebx, section..data
push ebx
lea ecx, [esp + 0x18]
call fcn.00401314
and dword [esp + 0x830], 0
push ebx
lea ecx, [esp + 0x1c]
call fcn.00401314
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 1
call fcn.00401314
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x834], 2
call fcn.00401761
push edi
lea ecx, [esp + 0x20]
call fcn.00401761
mov esi, str.hwang
lea edi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
lea eax, [esp + 0x36]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
push edi
push esi
lea eax, [esp + 0x44]
push str.CheckDir__s___s
push eax
call fcn.00437dbf
add esp, 0x1c
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x5c
push esi
call fcn.00438ee3
mov ebp, eax
pop ecx
or ebx, 0xffffffff
pop ecx
test ebp, ebp
jne 0x40a372
mov ebp, ebx
jmp 0x40a376
sub ebp, esi
sar ebp, 1
push 0x2f
push esi
call fcn.00438ee3
pop ecx
pop ecx
test eax, eax
je 0x40a38a
mov ebx, eax
sub ebx, esi
sar ebx, 1
cmp ebp, ebx
cmovg ebx, ebp
lea ecx, [esp + 0x14]
lea eax, [ebx + 1]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0040ad62
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 3
call fcn.0040ad17
mov byte [esp + 0x830], 2
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401551
push edi
lea ecx, [esp + 0x1c]
call fcn.004045e9
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [edi - 0x10]
inc bl
call fcn.00401551
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00401551
lea ecx, [esi - 0x10]
call fcn.00401551
mov al, bl
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.00437bed
add esp, 0x820
ret 8
Function at 0x40a421
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4650cc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x2c], eax
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [esp + 0x24], edi
lea eax, [esp + 0x64]
push eax
push dword [ebp + 4]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x34]
call fcn.0041767f
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x68]
push eax
push edi
call fcn.004176aa
push dword [esp + 0x34]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call ebx
mov esi, eax
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x80], 4
mov ecx, dword [ebp + 0x50]
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [esp + 0x6c]
sub eax, dword [esp + 0x64]
push 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
sub eax, dword [esp + 0x6c]
push 0x488ffc
xor ecx, ecx
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push edi
lea eax, [esp + 0x28]
push eax
push ecx
push ecx
push dword [ebp + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push esi
push edi
call ebx
push dword [esp + 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
lea ecx, [esp + 0x34]
call fcn.0041769c
test edi, edi
je 0x40a563
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x2c]
call fcn.0040324e
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00437bed
add esp, 0x70
ret
Function at 0x40b977
Capabilities:
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x465cff
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, ecx
push dword [esp + 0x24]
xor edi, edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], edi
test esi, esi
je 0x40ba19
mov ebx, dword [esp + 0x28]
push 0x104
mov ecx, ebx
call fcn.00401662
mov ecx, dword [ebx]
mov edx, eax
mov eax, 0x104
cmp dword [ecx - 8], eax
jge 0x40b9e5
push 0x80070057
call fcn.00401697
mov dword [ecx - 0xc], eax
mov eax, dword [ebx]
push 0x104
push edx
xor ecx, ecx
push esi
mov word [eax + 0x208], cx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x40ba0e
push ebx
mov ecx, ebp
call fcn.0040ba31
mov edi, eax
test esi, esi
je 0x40ba19
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40baa0
Capabilities:
Get disk information
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x465d25
mov eax, dword fs:[0]
push eax
sub esp, 0xa10
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0xa0c], eax
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0xa20]
mov dword fs:[0], eax
mov ebp, ecx
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
jne 0x40bb46
mov esi, str.hwang
lea edi, [esp + 0x21c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f2
xor edi, edi
lea eax, [esp + 0x22e]
push edi
push eax
call fcn.00438850
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x22c]
push str.GetLogicalDriveStrings_failedhwang_err:_d_r_n
push eax
call fcn.00437dbf
add esp, 0xc
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x40bbec
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437a3e
pop ecx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40baec
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
xor edi, edi
lea eax, [esp + 0x1a]
push edi
push eax
call fcn.00438850
add esp, 0xc
jmp 0x40bbe4
mov word [esi + 4], ax
push 0x104
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40bbe1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.0040178b
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [ebp + 4]
mov dword [esp + 0xa30], edi
call fcn.00410b2a
mov ecx, eax
call fcn.00401761
or dword [esp + 0xa28], 0xffffffff
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401551
add esi, 8
xor eax, eax
cmp word [esi], di
jne 0x40bb8a
inc eax
mov ecx, dword [esp + 0xa20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xa0c]
xor ecx, esp
call fcn.00437bed
add esp, 0xa1c
ret
Function at 0x40bc13
Capabilities:
Acquire debug privileges
Enumerate gui resources
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x46648b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x40bc48
xor eax, eax
inc eax
jmp 0x40bcd9
push esi
call fcn.0040bd36
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
or dword [esp + 0x14], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004081df
mov dword [esp + 0x18], eax
xor edx, edx
inc edx
mov ecx, str.SeDebugPrivilege
mov dword [esp + 0x28], ebx
call fcn.0040b69b
push esi
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40bca1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [eax - 0x57]
neg edi
sbb edi, edi
inc edi
jmp 0x40bcce
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, 0xbb8
push ebp
push esi
call edi
test eax, eax
je 0x40bcbc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
push esi
call edi
mov edi, eax
neg edi
sbb edi, edi
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
call fcn.00410c14
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x40c52d
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x810
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x80c], eax
mov eax, dword [esp + 0x81c]
mov edx, dword [esp + 0x814]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
push eax
push dword [esp + 0x830]
mov ecx, dword [esi]
call fcn.0041efc4
add esp, 0xc
push ebx
test eax, eax
jne 0x40c581
push ebx
push dword [esi]
call fcn.0040ca44
neg eax
sbb eax, eax
inc eax
jmp 0x40c62a
mov ecx, dword [esi]
or edx, 0xffffffff
call fcn.0041d44a
pop ecx
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.0040384f
mov ecx, dword [esi]
push 0xfffffffffffffffe
pop edx
call fcn.0041d09c
mov esi, str.hwang
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, 0x7f2
movsd dword es:[edi], dword [esi]
push ebp
lea eax, [esp + 0x2a]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
add esp, 0xc
lea eax, [esp + 0x24]
push dword [esp + 0x14]
push str._s_r_n
push eax
call fcn.00437dbf
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call ebx
mov esi, str.hwang
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebp
lea eax, [esp + 0x2a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
add esp, 0xc
lea eax, [esp + 0x24]
push str.luaL_loadbuffer_failed__r_n
push eax
call fcn.00437dbf
pop ecx
pop ecx
lea eax, [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401551
xor eax, eax
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437bed
add esp, 0x810
ret 0xc
Function at 0x40d2d4
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x465ad1
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x830]
call fcn.0041d08d
push dword [ebx]
mov edx, 0xfff0b9d8
mov edi, eax
call fcn.0041d888
pop ecx
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.00404c66
xor ebp, ebp
mov dword [esp + 0x828], ebp
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
call fcn.0041d664
or dword [esp + 0x828], 0xffffffff
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401551
mov edx, dword [esp + 0x834]
mov ecx, dword [ebx + 4]
call fcn.0041d5fc
call fcn.00402f0e
push 1
push 2
push dword [ebx + 4]
call fcn.0040ca44
mov ecx, dword [ebx + 4]
or edx, 0xffffffff
push ebp
test eax, eax
je 0x40d3fb
call fcn.0041d44a
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.0040384f
mov esi, str.hwang
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp], 0x7f2
lea eax, [esp + 0x2e]
push ebp
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
push dword [esp + 0x20]
lea eax, [esp + 0x38]
push str._s_r_n
push eax
call fcn.00437dbf
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebx + 4]
push 0xfffffffffffffffe
pop edx
call fcn.0041d09c
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401551
push 2
pop eax
jmp 0x40d40f
call fcn.0041d36d
pop ecx
mov ecx, dword [ebx + 4]
mov edx, edi
mov esi, eax
call fcn.0041d09c
mov eax, esi
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.00437bed
add esp, 0x818
ret 8