joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e353
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1d4]
xor ebx, ebx
test byte [0x4b7730], 1
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x70], ebx
mov esi, 0x4b7710
jne 0x45e3af
or dword [0x4b7730], 1
mov ecx, esi
call fcn.00442759
push 0x48ebe4
call fcn.004659a2
pop ecx
cmp dword [0x4b772c], ebx
je 0x45e3da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4b770c]
sub ecx, eax
cmp ecx, 0x1388
ja 0x45e3da
cmp dword [ebp + 0x1d8], 1
jne 0x45e483
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45e483
mov ecx, esi
call fcn.0045762e
push 0x228
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
mov edi, 0x22c
push ebx
mov dword [ebp - 0x68], edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45e475
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00404be0
lea ecx, [ebp - 0x6c]
call fcn.00444269
mov ecx, eax
call fcn.00444174
lea ecx, [ebp - 0x6c]
call fcn.0040a4c0
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.00457d29
mov ecx, dword [ebp - 0x60]
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00464d20
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
add ecx, 0xfffffff0
mov dword [ebp - 0x68], edi
call fcn.004016d0
lea eax, [ebp - 0x68]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45e41b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x6c]
call fcn.00404be0
lea ecx, [ebp - 0x6c]
call fcn.0040a4c0
push esi
push dword [0x4b7728]
lea ecx, [ebp - 0x78]
call fcn.0044ec85
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00456f4e
lea ecx, [ebp - 0x78]
push ecx
mov ecx, eax
call fcn.00456826
test al, al
jne 0x45e4dd
test edi, edi
je 0x45e4d6
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.00457d29
mov eax, dword [eax]
mov dword [edi], eax
mov dword [ebp - 0x70], 1
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.004016d0
mov ecx, dword [ebp + 0x1c4]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x1c8
leave
ret
Function at 0x45efe3
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1cc]
sub esp, 0x24c
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x1c8], eax
mov eax, dword [ebp + 0x1d4]
push esi
push edi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x1d8]
xor edi, edi
test byte [0x4b7758], 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], edi
mov esi, 0x4b7738
jne 0x45f03e
or dword [0x4b7758], 1
mov ecx, esi
call fcn.004408e7
push 0x48ebfb
call fcn.004659a2
pop ecx
cmp dword [0x4b7754], edi
je 0x45f069
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4b7734]
sub ecx, eax
cmp ecx, 0x1388
ja 0x45f069
cmp dword [ebp + 0x1dc], 1
jne 0x45f116
push ebx
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45f115
mov ecx, esi
call fcn.0045d457
push 0x228
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
mov edi, 0x22c
push ebx
mov dword [ebp - 0x64], edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45f10a
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x68]
call fcn.00404be0
lea ecx, [ebp - 0x68]
call fcn.00444269
mov ecx, eax
call fcn.00444174
lea ecx, [ebp - 0x68]
call fcn.0040a4c0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
mov ecx, esi
call fcn.0045ee20
mov ecx, eax
call fcn.0045dca5
push edi
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00464d20
mov ecx, dword [ebp - 0x68]
add esp, 0xc
add ecx, 0xfffffff0
mov dword [ebp - 0x64], edi
call fcn.004016d0
lea eax, [ebp - 0x64]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45f0aa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x68]
call fcn.00404be0
lea ecx, [ebp - 0x68]
call fcn.0040a4c0
push esi
push dword [0x4b7750]
lea ecx, [ebp - 0x74]
call fcn.0044ec85
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.0045c9f8
lea ecx, [ebp - 0x74]
push ecx
mov ecx, eax
call fcn.00456826
test al, al
jne 0x45f18a
lea eax, [ebp - 0x68]
push eax
mov ecx, esi
call fcn.0045ee20
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
test ecx, 0xfffffffc
je 0x45f18a
lea eax, [ebp - 0x68]
push eax
mov ecx, esi
call fcn.0045ee20
mov ecx, dword [ebp - 0x78]
push eax
call fcn.0045d916
mov dword [ebp - 0x6c], 1
mov ecx, dword [ebp - 0x68]
add ecx, 0xfffffff0
call fcn.004016d0
mov ecx, dword [ebp + 0x1c8]
mov eax, dword [ebp - 0x6c]
pop edi
xor ecx, ebp
pop esi
call fcn.00464fe1
add ebp, 0x1cc
leave
ret
Function at 0x45fdaa
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
and ebx, 0xffdf
xor esi, esi
inc esi
lea eax, [ebx - 0x41]
push edi
mov dword [ebp - 0x30], esi
cmp ax, 0x19
ja 0x45feb2
mov eax, dword [0x4957d4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4957d8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x45feb2
push 3
pop ecx
cmp eax, ecx
je 0x45fe1e
jbe 0x45fe17
cmp eax, 5
jbe 0x45feb2
cmp eax, 6
je 0x45fe1e
mov eax, esi
jmp 0x45feb4
mov esi, str..X:
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebp - 0x14], bx
xor ebx, ebx
push ebx
push ebx
push ecx
push ebx
push ecx
push SysReAllocString
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
jne 0x45fe52
xor eax, eax
inc eax
jmp 0x45feb4
mov edi, 0x227
push edi
call fcn.00464280
pop ecx
push ebx
mov esi, eax
mov dword [esi + 4], edi
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push dword [esi + 4]
lea eax, [ebp - 0x28]
push esi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45fe9d
mov eax, dword [esi + 0x1c]
cmp eax, 7
je 0x45fe9a
cmp eax, 4
jne 0x45fe9d
mov dword [ebp - 0x30], ebx
push esi
call fcn.00466b4b
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
jmp 0x45feb4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
leave
ret

Function at 0x45fec3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and eax, 0xffdf
lea ecx, [eax - 0x41]
cmp cx, 0x19
ja 0x45ff33
mov ecx, dword [0x4957d4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x4957d8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x45ff2e
dec eax
dec eax
je 0x45ff2a
dec eax
je 0x45ff26
dec eax
je 0x45ff22
push dword [ebp + 8]
call fcn.0045fdaa
neg eax
sbb eax, eax
pop ecx
inc eax
jmp 0x45ff35
push 5
jmp 0x45ff30
push 4
jmp 0x45ff30
push 3
jmp 0x45ff30
push 2
pop eax
jmp 0x45ff36
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464fe1
leave
ret
Function at 0x460093
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 3
pop ebx
lea eax, [ebp - 0x1c]
push str.emalware.001
xor edi, edi
push eax
mov dword [ebp - 0x1c], edi
call fcn.00460064
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404cd0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call esi
test eax, eax
jne 0x460120
push 0xf
pop ebx
lea eax, [ebp - 0x14]
push str.emalware.002
push eax
call fcn.00460064
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404cd0
add esp, 0xc
push dword [eax]
call esi
test eax, eax
jne 0x460120
push 0x3f
pop ebx
lea eax, [ebp - 0xc]
push str.emalware.003
push eax
call fcn.00460064
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd0
add esp, 0xc
push dword [eax]
call esi
mov byte [ebp - 1], 0
test eax, eax
je 0x460124
mov byte [ebp - 1], 1
test bl, 0x20
je 0x460137
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
and ebx, 0xffffffdf
call fcn.004016d0
test bl, 0x10
je 0x46014a
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
and ebx, 0xffffffef
call fcn.004016d0
test bl, 8
je 0x46015d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
and ebx, 0xfffffff7
call fcn.004016d0
test bl, 4
je 0x460170
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
and ebx, 0xfffffffb
call fcn.004016d0
test bl, 2
je 0x460183
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
and ebx, 0xfffffffd
call fcn.004016d0
test bl, 1
je 0x460193
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004016d0
cmp byte [ebp - 1], 0
je 0x46019c
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4601a3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 3
pop ebx
lea eax, [ebp - 0x1c]
push str.vbase000.vdf
xor edi, edi
push eax
mov dword [ebp - 0x1c], edi
call fcn.0045ffd3
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404cd0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call esi
test eax, eax
jne 0x460230
push 0xf
pop ebx
lea eax, [ebp - 0x14]
push str.aeoffice.dll
push eax
call fcn.0045ffd3
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404cd0
add esp, 0xc
push dword [eax]
call esi
test eax, eax
jne 0x460230
push 0x3f
pop ebx
lea eax, [ebp - 0xc]
push str.aebb.dll
push eax
call fcn.0045ffd3
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd0
add esp, 0xc
push dword [eax]
call esi
mov byte [ebp - 1], 0
test eax, eax
je 0x460234
mov byte [ebp - 1], 1
test bl, 0x20
je 0x460247
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
and ebx, 0xffffffdf
call fcn.004016d0
test bl, 0x10
je 0x46025a
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
and ebx, 0xffffffef
call fcn.004016d0
test bl, 8
je 0x46026d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
and ebx, 0xfffffff7
call fcn.004016d0
test bl, 4
je 0x460280
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
and ebx, 0xfffffffb
call fcn.004016d0
test bl, 2
je 0x460293
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
and ebx, 0xfffffffd
call fcn.004016d0
test bl, 1
je 0x4602a3
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004016d0
cmp byte [ebp - 1], 0
je 0x4602ac
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4602b3
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa8]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xa4], ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], ebx
jle 0x4603eb
cmp dword [ebp + 0xa4], 2
jg 0x4603eb
push 0x4b84ac
lea ecx, [ebp - 0x6c]
call fcn.00401ae0
cmp dword [ebp + 0xa4], 1
jne 0x460324
lea eax, [ebp - 0x80]
push eax
call fcn.00460002
pop ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00404e20
mov ecx, dword [ebp - 0x80]
jmp 0x46033a
lea eax, [ebp - 0x74]
push eax
call fcn.00460035
pop ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00404e20
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.004016d0
push edi
push ebx
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4603df
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00464d20
add esp, 0xc
push ebx
lea eax, [ebp - 0x7c]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
push edi
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x68]
push str.Update_time_GMT:
push eax
call fcn.004692b0
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x4603de
add esi, 0x10
lea eax, [ebp + 0x98]
cmp esi, eax
jae 0x4603bb
cmp byte [esi], 0x20
jne 0x4603bb
inc esi
push 0x49593c
push esi
call fcn.004692b0
pop ecx
pop ecx
cmp eax, ebx
je 0x4603ce
mov byte [eax], bl
mov ecx, dword [ebp - 0x78]
push esi
call fcn.0044338d
mov dword [ebp - 0x70], 1
pop esi
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.004016d0
pop edi
mov ecx, dword [ebp + 0x98]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x9c
leave
ret
Function at 0x460507
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.LocalQ360SafeI18N
xor ebx, ebx
call fcn.00443ca3
pop ecx
cmp eax, ebx
jne 0x460531
push 0x78
jmp 0x460636
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00460404
cmp eax, 2
jne 0x460549
push 0x73
jmp 0x460636
cmp dword [0x4b7680], ebx
je 0x460634
call fcn.00443a67
test eax, eax
jne 0x460634
mov eax, dword [ebp + 8]
cmp dword [eax + 0x64], 0x6c
jne 0x460572
push 0x6c
jmp 0x460636
push 0x4b6e5c
lea ecx, [ebp - 0x18]
call fcn.00404bc0
mov esi, dword [ebp - 0x18]
cmp dword [esi - 0xc], ebx
jne 0x460597
push 0x71
pop ebx
lea ecx, [esi - 0x10]
call fcn.004016d0
jmp 0x460637
push esi
call fcn.00458a22
pop ecx
test al, al
jne 0x4605a6
push 0x6d
jmp 0x460589
mov eax, dword [0x493db0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x493db4]
mov dword [ebp - 8], eax
cmp dword [esi - 0xc], ebx
jge 0x4605c5
push 0x80070057
call fcn.004016b0
mov ax, word [esi]
mov word [ebp - 0xc], ax
push dword [ebp - 0xc]
call fcn.0045fec3
pop ecx
cmp eax, 1
je 0x4605de
push 0x70
jmp 0x460589
push edi
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
pop edi
test eax, eax
je 0x46058a
cmp dword [ebp - 0x10], ebx
ja 0x46058a
jb 0x46062d
cmp dword [ebp - 0x14], 0x11e1a300
ja 0x46058a
push 0x6f
jmp 0x460589
push 0x6b
pop ebx
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00464fe1
leave
ret
Function at 0x460647
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3f94]
mov eax, 0x4014
call fcn.00465cc0
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x3f90], eax
mov eax, dword [ebp + 0x3f9c]
push ebx
mov ebx, dword [ebp + 0x3fa8]
push esi
mov esi, dword [ebp + 0x3fa0]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3fac]
push edi
mov edi, dword [ebp + 0x3fa4]
mov dword [ebp - 0x78], eax
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push eax
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x460710
cmp eax, 0x3fff
ja 0x460710
lea ecx, [ebp - 0x70]
push ecx
push eax
push 0
push dword [ebp - 0x74]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x460710
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x499254
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x460710
mov eax, dword [ebp - 0x74]
mov cx, word [eax + 0xa]
mov word [esi], cx
mov cx, word [eax + 8]
mov word [edi], cx
mov cx, word [eax + 0xe]
mov word [ebx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp - 0x78]
mov word [ecx], ax
xor eax, eax
inc eax
jmp 0x460712
xor eax, eax
mov ecx, dword [ebp + 0x3f90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x3f94
leave
ret

Function at 0x46072a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
mov ebx, dword [ebp + 0x1a0]
push edi
mov edi, dword [ebp + 0x19c]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.00464d20
add esp, 0xc
push 0
push 0x25
lea eax, [ebp - 0x78]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jl 0x46078e
push str.User32.dll
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x4607c3
push str.ShutdownBlockReasonCreate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4607ba
push ebx
push edi
call eax
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0x190]
mov eax, dword [ebp - 0x7c]
pop edi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x194
leave
ret
Function at 0x4607dd
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push esi
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
push 0x206
mov word [ebp - 0x7c], ax
xor edi, edi
lea eax, [ebp - 0x7a]
push edi
push eax
call fcn.00464d20
add esp, 0xc
push edi
push 0x25
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jl 0x46083e
push str.User32.dll
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x46086c
push str.ShutdownBlockReasonDestroy
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x460865
push dword [ebp - 0x80]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0x18c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00464fe1
add ebp, 0x190
leave
ret

Function at 0x463d18
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4b8468], 0
push esi
jne 0x463c8b
call fcn.00463bb1
test eax, eax
je 0x463cce
mov eax, dword [0x4b8468]
cmp eax, 1
jne 0x463cac
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x463cce
pop esi
ret
push eax
call dword [0x4b8470]
test eax, eax
jne 0x463d16
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x463cd2
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4b8468]
call dword [0x4b8470]
mov edi, eax
test edi, edi
je 0x463cf7
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x463d13
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4b8468]
call dword [0x4b846c]
add edi, 0x10
cmp edi, esi
jb 0x463cff
mov eax, edi
pop edi
pop esi
ret
jmp 0x463c78

Function at 0x464fe1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b1d00]
jne 0x464feb
repz ret
jmp fcn.00470326
Function at 0x47fcc8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046e00e
and dword [ebp - 4], 0
cmp dword [0x4b92d0], 0
mov ebx, eax
jne 0x47fd79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47fe2a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x47fe2a
push eax
call fcn.0046df9c
mov dword [esp], 0x498b08
push edi
mov dword [0x4b92d0], eax
call esi
push eax
call fcn.0046df9c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b92d4], eax
call esi
push eax
call fcn.0046df9c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b92d8], eax
call esi
push eax
call fcn.0046df9c
pop ecx
mov dword [0x4b92e0], eax
test eax, eax
je 0x47fd79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046df9c
pop ecx
mov dword [0x4b92dc], eax
mov eax, dword [0x4b92dc]
cmp eax, ebx
je 0x47fdd1
cmp dword [0x4b92e0], ebx
je 0x47fdd1
push eax
call fcn.0046e017
push dword [0x4b92e0]
mov esi, eax
call fcn.0046e017
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47fdd1
test edi, edi
je 0x47fdd1
call esi
test eax, eax
je 0x47fdc8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47fdc8
test byte [ebp - 0xc], 1
jne 0x47fdd1
or dword [ebp + 0x10], 0x200000
jmp 0x47fe0a
mov eax, dword [0x4b92d4]
cmp eax, ebx
je 0x47fe0a
push eax
call fcn.0046e017
pop ecx
test eax, eax
je 0x47fe0a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x47fe0a
mov eax, dword [0x4b92d8]
cmp eax, ebx
je 0x47fe0a
push eax
call fcn.0046e017
pop ecx
test eax, eax
je 0x47fe0a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b92d0]
call fcn.0046e017
pop ecx
test eax, eax
je 0x47fe2a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47fe2c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4848a0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00465cc0
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x484a0b
cmp dword [esp + 0x2c20], edi
je 0x484a0b
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.0045c510
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x4849e4
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00464d20
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4849d7
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.00464d20
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00486000
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.004841c0
test eax, eax
jne 0x4849d7
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x4849ee
inc ebx
cmp ebx, 0x10
jl 0x4848f0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.00464fe1
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00464fe1
add esp, 0x2c14
ret