joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov edx, dword [ebp + 8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
push esi
push edx
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, esi
jne 0x4034ec
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ecx, esi
je 0x403455
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
cmp eax, esi
mov ecx, dword [ebp - 0x18]
mov edi, eax
mov dword [ebp - 0x10], ecx
jne 0x4034ec
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x124]
push eax
push esi
push ecx
mov dword [ebp - 0x14], 0x100
call edi
test eax, eax
jne 0x4034cc
lea esp, [esp]
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004033f0
mov ebx, eax
cmp ebx, esi
jne 0x403519
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp - 0x10]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x124]
push ecx
push esi
push edx
mov dword [ebp - 0x14], 0x100
call edi
test eax, eax
je 0x403490
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x4034dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x403504
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x403531
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x407ab0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x407c57
push edi
mov ecx, esi
call fcn.00402740
mov eax, dword [esi]
push ebx
push 1
push 0x64
push esi
call dword [eax + 0x20]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
push ecx
push 0x20006
push ebx
push str.AppID
push SysReAllocStringLen
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
jne 0x407ba0
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
push 0x20006
push str.124B91A0_21B2_4107_A5BE_050B8E25079C
push edi
lea ecx, [ebp - 0x10]
call fcn.00401780
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x407bd4
push str.Cant_open_key___124B91A0_21B2_4107_A5BE_050B8E25079C_
push str.C:_ob_bora_42958_bora_apps_vmount_vmount.cpp
push 0x6f
push 7
push 1
call fcn.004090e0
add esp, 0x14
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x407b79
push eax
call esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x407b8a
push edi
call esi
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.Cant_open_key___AppID_
push str.C:_ob_bora_42958_bora_apps_vmount_vmount.cpp
push 0x69
push 7
push 1
call fcn.004090e0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x10]
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
je 0x407c17
push 1
push str.vmount2
push str.LocalService
lea ecx, [ebp - 0x10]
call fcn.004018a0
push 1
push str._Service
push str.ServiceParameters
lea ecx, [ebp - 0x10]
call fcn.004018a0
mov ecx, esi
call fcn.00402600
mov edx, dword [ebp + 8]
push ebx
push edx
mov ecx, esi
call fcn.004079a0
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
cmp edi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x407c3f
push edi
call esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x407c53
push eax
call esi
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0xc]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a630
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x40a67b
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40a67b
mov ebx, dword [sym.imp.ADVAPI32.dll_IsValidSid]
push eax
call ebx
test eax, eax
je 0x40a67b
mov eax, dword [esi + 4]
push eax
call ebx
test eax, eax
je 0x40a67b
mov ecx, dword [esi + 4]
mov edx, dword [edi + 4]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x40ed60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424e56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x2f8]
mov dword [ebp - 0x20], esi
mov dword [esi + 0xc], ebx
call fcn.0040eae0
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [esi + 0x2e0], ebx
mov dword [esi + 0x2f4], ebx
lea edi, [esi + 0x10]
mov ecx, 0x3c
rep stosd dword es:[edi], eax
call sub.vmxScsiLib.dll_VmxScsiLib_GetInterface
push 1
mov dword [esi + 0x2e4], eax
call dword [eax]
lea eax, [esi + 0x2ec]
push eax
call fcn.0041dee0
xor edi, edi
add esp, 8
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push ebx
push str.SoftwareVMware__Inc.VMware_Virtual_Image_Editing
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40ee89
mov edi, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push str.readTimeout
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40ee3a
cmp dword [ebp - 0x1c], 4
jne 0x40ee3a
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x40ee3a
push eax
call sub.vmxScsiLib.dll_VmxScsiLib_SetNbdReadTimeout
add esp, 4
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
push str.writeTimeout
push edi
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40ee74
cmp dword [ebp - 0x18], 4
jne 0x40ee74
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x40ee74
push eax
call sub.vmxScsiLib.dll_VmxScsiLib_SetNbdWriteTimeout
add esp, 4
cmp edi, ebx
je 0x40ee86
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x40ee89
mov edi, dword [ebp - 0x10]
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x40ee9a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x414780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4148e8
mov eax, dword [esi + 0x18]
test ah, 0x10
je 0x4148e8
lea eax, [esi + 0x78]
push eax
push str.._s
lea ecx, [ebp - 0x84]
push 0x80
push ecx
call fcn.0041fef0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x84]
push 1
push eax
call fcn.0041e730
add esp, 0x1c
test eax, eax
je 0x414851
lea ecx, [ebp + 8]
push ecx
push eax
push str.opening_volume_device
call fcn.0041e6b0
mov al, byte [esi + 0xf0]
add esp, 0xc
test al, al
jne 0x4147f5
mov al, 0x3f
mov edx, dword [ebp + 8]
push edx
movsx eax, al
push eax
lea ecx, [ebp - 0x84]
push ecx
push str.cannot_dismount__s___c:__:__s
lea edx, [ebp - 0x184]
push 0x100
push edx
call fcn.0041fef0
add esp, 0x18
push str.Vmount2.Vmount2Device
lea eax, [ebp - 0x184]
push eax
push 0x8004020c
push 0x42659c
call fcn.00409570
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov eax, 0x8004020c
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push edi
lea edx, [ebp + 8]
push edx
xor edi, edi
push edi
push edi
push edi
push eax
call fcn.0041e970
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4148b9
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll_free]
cmp edi, 3
jge 0x4148b8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 8]
push edx
call ebx
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0
push ecx
mov dword [ebp + 8], 0
inc edi
call fcn.0041e970
mov esi, eax
add esp, 0x18
test esi, esi
je 0x414874
pop ebx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop edi
jne 0x4148e8
push str.Vmount2.Vmount2Device
push str.Dismount_failed__volume_is_probably_busy
push 0x8004020c
push 0x42659c
call fcn.00409570
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x414e00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
push edi
push eax
call ebx
mov eax, dword [esi + 0x40]
xor edi, edi
cmp eax, edi
mov dword [esi + 0x44], edi
je 0x414e27
push eax
call ebx
mov dword [esi + 0x40], edi
cmp dword [esi + 0x14], edi
jne 0x414ecf
cmp dword [esi + 0x64], edi
je 0x414ecf
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x64], edi
mov dword [ebp - 4], edi
lea edi, [esi + 0x28]
push 0xfa
call ebx
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
push edi
push 0
push str.Virtual_Storage_Device
push 0x428d5c
push ecx
push edx
call fcn.004160e0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x414e82
mov eax, dword [ebp - 4]
inc eax
cmp eax, 6
mov dword [ebp - 4], eax
jl 0x414e48
jmp 0x414ec2
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x413e60
push 0
push 0
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi + 0x44], eax
je 0x414eb8
mov eax, 1
pop edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x68], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], eax
xor edi, edi
mov eax, dword [esi + 0x14]
cmp eax, 2
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
jne 0x414ef9
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x414f1a
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x414f1a
mov ecx, dword [esi + 0xc]
cmp ecx, edi
je 0x414f1a
mov eax, dword [esi + 0x70]
push eax
call fcn.00419f80
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418cb0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418d92
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x5c]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x418d05
mov edx, dword [esi + 0x5c]
push 0x4c7
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.CVmount2Disk::FinalRelease:_KA_thread_unresponsive__terminated.
push str.C:_ob_bora_42958_bora_apps_vmount_VmountDisk.cpp
push 0x17d
push 7
push 1
call fcn.004090e0
add esp, 0x14
mov eax, dword [esi + 0x60]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x5c]
push ecx
call edi
mov eax, dword [esi + 0x58]
cmp eax, 0xffffffff
je 0x418d42
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov edx, dword [esi + 0x40]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0xc]
add esp, 4
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ecx, dword [esi + 0x58]
push ecx
call edi
jmp 0x418d4f
mov edx, dword [esi + 0x40]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0xc]
add esp, 4
mov ecx, dword [esi + 0x3c]
push esi
mov dword [esi + 0x40], 0
call fcn.0040a150
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x3c], 0
add esi, 0x168
push esi
push str.disk__s_was_closed
push str.C:_ob_bora_42958_bora_apps_vmount_VmountDisk.cpp
push 0x197
push 7
push 0
call fcn.004090e0
add esp, 0x18
pop edi
pop esi
ret
Function at 0x41b1b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call dword [0x4341f8]
mov esi, dword [ebp + 8]
mov ebx, eax
mov eax, dword [esi + 0x84]
test eax, eax
je 0x41b2fe
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x60]
mov eax, dword [ebp - 8]
test eax, eax
mov edi, eax
jne 0x41b1e9
xor esi, esi
jmp 0x41b20e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.00422260
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.004014f0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 1
push esi
call fcn.0041e780
mov ecx, dword [ebp - 8]
add esp, 0xc
push ecx
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x41b272
push edi
push esi
lea edx, [ebp + 8]
push str.Unable_to_get_volume_size_for__s:_Windisk_Open_failed_with_err_d
push edx
call fcn.0041ff50
add esp, 0x10
push str.Vmount2.Vmount2WinVolume
mov esi, eax
push esi
push 0x80004005
push 0x4266dc
call fcn.00409570
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov eax, 0x80004005
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 4]
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0x7405c
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41b2d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jle 0x41b2b7
and esi, 0xffff
or esi, 0x80070000
push str.Vmount2.Vmount2Disk2
push str.Failed_to_get_SizeInMB
push esi
push 0x4266dc
call fcn.00409570
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push 0
push 0x100000
push edx
push eax
call fcn.00422480
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], eax
jmp 0x41b325
mov al, byte [esi + 8]
test al, al
jne 0x41b328
mov edx, dword [esi]
push 0x426fec
push esi
call dword [edx + 0x34]
test eax, eax
jl 0x41b332
mov eax, dword [esi]
push 0
push 0x426fec
push esi
call dword [eax + 0x38]
test eax, eax
jl 0x41b332
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x78]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b340
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [0x4341f8]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x84]
xor ebx, ebx
cmp eax, ebx
je 0x41b423
lea eax, [edi + 0xa0]
mov dword [edi + 0x70], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b383
sub eax, edx
mov dword [ebp + 8], eax
je 0x41b44b
mov dword [ebp - 0x14], ebx
xor bl, bl
mov byte [ebp - 0x10], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1e4]
test eax, eax
jns 0x41b3e3
call fcn.0040a1c0
mov esi, eax
test esi, esi
mov bl, 1
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], bl
jge 0x41b3e3
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoRevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [edi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x41b410
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0x70], eax
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41b44b
call dword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x41b44b
mov al, byte [edi + 8]
test al, al
jne 0x41b44b
mov esi, edi
mov edx, dword [esi]
push 0x426fec
push esi
call dword [edx + 0x34]
cmp eax, ebx
jl 0x41b455
mov eax, dword [esi]
push ebx
push 0x426fec
push esi
call dword [eax + 0x38]
cmp eax, ebx
jl 0x41b455
mov ecx, dword [edi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b470
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
call dword [0x4341f8]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x84]
xor ebx, ebx
cmp eax, ebx
je 0x41b557
lea eax, [edi + 0xa0]
mov dword [edi + 0x80], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b4b6
sub eax, edx
mov dword [ebp + 8], eax
je 0x41b57f
mov dword [ebp - 0x20], ebx
xor bl, bl
mov byte [ebp - 0x1c], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1e4]
test eax, eax
jns 0x41b516
call fcn.0040a1c0
mov esi, eax
test esi, esi
mov bl, 1
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], bl
jge 0x41b516
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoRevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41b544
mov ecx, dword [ebp + 8]
imul ecx, dword [ebp - 0x10]
mov dword [edi + 0x80], ecx
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41b57f
call dword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x41b57f
mov al, byte [edi + 8]
test al, al
jne 0x41b57f
mov esi, edi
mov edx, dword [esi]
push 0x426fec
push esi
call dword [edx + 0x34]
cmp eax, ebx
jl 0x41b58c
mov eax, dword [esi]
push ebx
push 0x426fec
push esi
call dword [eax + 0x38]
cmp eax, ebx
jl 0x41b58c
mov ecx, dword [edi + 0x80]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b5a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [0x4341f8]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x84]
test eax, eax
je 0x41b6d0
lea eax, [edi + 0xa0]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b5e0
sub eax, edx
mov dword [ebp + 8], eax
je 0x41b6bb
xor bl, bl
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1e4]
test eax, eax
jns 0x41b644
call fcn.0040a1c0
mov esi, eax
test esi, esi
mov bl, 1
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], bl
jge 0x41b644
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoRevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [edi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x41b698
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:__d
push str.C:_ob_bora_42958_bora_apps_vmount_VmountWinVolume.cpp
push 0x33a
push 7
push 2
call fcn.004090e0
mov eax, dword [edi]
add esp, 0x18
lea ecx, [ebp + 8]
push ecx
push edi
call dword [eax + 0x3c]
mov edx, dword [ebp + 8]
shl edx, 0xa
mov dword [edi + 0x6c], edx
jmp 0x41b6a8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0x6c], eax
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41b6f9
call dword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x41b6f9
mov edx, dword [edi]
lea eax, [ebp + 8]
push eax
push edi
call dword [edx + 0x3c]
mov ecx, dword [ebp + 8]
shl ecx, 0xa
mov dword [edi + 0x6c], ecx
jmp 0x41b6f9
mov al, byte [edi + 8]
test al, al
jne 0x41b6f9
mov esi, edi
mov edx, dword [esi]
push 0x426fec
push esi
call dword [edx + 0x34]
test eax, eax
jl 0x41b703
mov eax, dword [esi]
push 0
push 0x426fec
push esi
call dword [eax + 0x38]
test eax, eax
jl 0x41b703
mov ecx, dword [edi + 0x6c]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b720
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [0x4341f8]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x84]
xor ebx, ebx
cmp eax, ebx
je 0x41b80d
lea eax, [edi + 0xa0]
mov dword [edi + 0x74], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b763
sub eax, edx
mov dword [ebp + 8], eax
je 0x41b835
mov dword [ebp - 0x14], ebx
xor bl, bl
mov byte [ebp - 0x10], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1e4]
test eax, eax
jns 0x41b7c3
call fcn.0040a1c0
mov esi, eax
test esi, esi
mov bl, 1
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], bl
jge 0x41b7c3
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoRevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [edi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x41b7fa
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
sbb ecx, esi
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0x74], eax
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41b835
call dword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x41b835
mov al, byte [edi + 8]
test al, al
jne 0x41b835
mov esi, edi
mov edx, dword [esi]
push 0x426fec
push esi
call dword [edx + 0x34]
cmp eax, ebx
jl 0x41b83f
mov eax, dword [esi]
push ebx
push 0x426fec
push esi
call dword [eax + 0x38]
cmp eax, ebx
jl 0x41b83f
mov ecx, dword [edi + 0x74]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8