joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c58c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00471870
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004701a0
mov esi, 0x800
push esi
lea eax, [ebp - 0x1004]
push 0x4cd6a0
push eax
call fcn.00470149
push esi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00471c13
push esi
lea eax, [ebp - 0x1004]
push 0x4cd6a8
push eax
call fcn.00471c13
push esi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00471c13
push esi
lea eax, [ebp - 0x1004]
push str.vL
push eax
call fcn.00471c13
add esp, 0x48
push esi
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00471c13
push esi
lea eax, [ebp - 0x1004]
push 0x4cd6f8
push eax
call fcn.00471c13
push esi
lea eax, [ebp - 0x1004]
push 0x4bcc60
push eax
call fcn.00471c13
add esp, 0x24
push 0x14
push edi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x45c6a2
call fcn.00401f40
test eax, eax
je 0x45c68b
call fcn.00401f5d
test eax, eax
je 0x45c68b
push 5
xor eax, eax
push eax
push eax
push 0x4e9700
jmp 0x45c696
push 5
xor eax, eax
push eax
push eax
push 0x4e9568
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], 0
je 0x45c6af
push 0
call fcn.00471b7b
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047021a
leave
ret 0xc

Function at 0x45c6c2
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c6d8
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x45c6dc
xor eax, eax
inc eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
jne 0x45c701
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x45c706
push edi
call esi
test eax, eax
je 0x45c706
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x45c757
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
push edi
mov edi, ecx
test eax, eax
jne 0x45c77e
xor eax, eax
jmp 0x45c7c2
cmp eax, 0x104
jge 0x45c77a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004701a0
add esp, 0xc
push str.360leakfixer.exe
push dword [esi]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [edi + 0x1d0], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047021a
leave
ret 4
Function at 0x45c7d2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x45c84d
cmp eax, 0x104
jge 0x45c84d
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004701a0
add esp, 0xc
push 0x4ba970
push dword [esi]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c84d
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00402346
pop ecx
pop ecx
test eax, eax
je 0x45c84d
xor eax, eax
inc eax
jmp 0x45c84f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047021a
leave
ret 4

Function at 0x45c886
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.0045bab5
cmp eax, edi
je 0x45c95e
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
test eax, eax
je 0x45c95e
push 0x800
lea eax, [ebp - 0x884]
push edi
push eax
call fcn.004701a0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.crypt32.dll
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c95e
mov ecx, esi
call fcn.0045bfe0
mov esi, eax
cmp esi, edi
je 0x45c95e
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push edi
push eax
call fcn.004701a0
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x884]
push ecx
push esi
call dword [eax + 0x60]
test eax, eax
je 0x45c95e
lea eax, [ebp - 0x84]
push str.6.1.7601.24382
push eax
call fcn.00446a3c
pop ecx
pop ecx
test eax, eax
jge 0x45c95e
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047021a
leave
ret
Function at 0x45d2a2
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x424
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x424], eax
push 0x1c
mov eax, 0x4ad697
call fcn.004711ef
xor esi, esi
push 6
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x4d304c
lea ecx, [ebp - 0x18]
call fcn.0045686c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x430]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.0043281a
add esp, 0xc
push eax
lea ecx, [ebp + 0x430]
mov byte [ebp - 4], 2
call fcn.00401d9d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0040290e
lea ecx, [ebp + 0x430]
call fcn.0045c96e
mov dword [ebp - 0x14], eax
xor eax, eax
push 0x206
mov word [ebp + 0x14], ax
lea eax, [ebp + 0x16]
push esi
push eax
call fcn.004701a0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x14]
push eax
call edi
push str.Shell32.dll
lea eax, [ebp + 0x14]
push esi
push eax
call fcn.00471539
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
call ebx
push str.SHCreateItemFromParsingName
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45d490
lea ecx, [ebp - 0x10]
push ecx
push 0x4bcd84
push 0
push dword [ebp - 0x14]
call eax
test eax, eax
jl 0x45d490
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x21c], ax
lea eax, [ebp + 0x21e]
push eax
call fcn.004701a0
add esp, 0xc
push esi
lea eax, [ebp + 0x21c]
push eax
call edi
push str.Propsys.dll
lea eax, [ebp + 0x21c]
push esi
push eax
call fcn.00471539
add esp, 0xc
lea eax, [ebp + 0x21c]
push eax
call ebx
push str.PSGetPropertyKeyFromName
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45d490
lea ecx, [ebp]
push ecx
push str.System.Volume.BitLockerProtection
call eax
test eax, eax
jl 0x45d490
push 0x10
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004701a0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [ebp - 0x28]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x45d490
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x20]
push eax
call dword [ecx + 8]
cmp esi, 1
je 0x45d458
cmp esi, 3
je 0x45d458
cmp esi, 5
je 0x45d458
xor esi, esi
jmp 0x45d45b
xor esi, esi
inc esi
mov ecx, dword [ebp + 0x430]
add ecx, 0xfffffff0
call fcn.0040290e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x424]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x428
leave
ret 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45d454
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45d454
Function at 0x45d595
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1108
call fcn.00471870
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1108], eax
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x104
jle 0x45d5cf
xor eax, eax
jmp 0x45d691
push esi
mov esi, 0x800
push esi
lea eax, [ebp - 0x1104]
push 0
push eax
call fcn.004701a0
push esi
xor esi, esi
lea eax, [ebp - 0x904]
push esi
push eax
call fcn.004701a0
push dword [edi]
lea eax, [ebp - 0x1104]
push 0x400
push eax
call fcn.00472f25
add esp, 0x24
cmp ebx, esi
je 0x45d621
cmp word [ebx], si
je 0x45d621
push ebx
lea eax, [ebp - 0x1104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.004701a0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00401000
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1104]
push eax
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x904]
push str..tmp
push eax
call fcn.00472798
pop ecx
pop ecx
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45d69f
inc esi
cmp esi, 0xa
jl 0x45d636
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047021a
leave
ret
mov ecx, dword [ebp - 0x1108]
lea eax, [ebp - 0x904]
push eax
call fcn.0040285e
xor eax, eax
inc eax
jmp 0x45d690

Function at 0x45dbd7
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4ae058
call fcn.004711ef
mov esi, ecx
push 0x4f39f8
lea ecx, [ebp - 0x10]
call fcn.004028e9
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0045da4b
push str.360DiagnoseScan.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004039cd
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040290e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040290e
mov eax, esi
call fcn.004712c7
ret
Function at 0x45dc3f
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4aa1a2
call fcn.004711ef
mov edi, ecx
mov eax, dword [edi + 0x108]
test eax, eax
jne 0x45dc5d
call fcn.004712c7
ret
mov esi, 0x4f39f8
push esi
lea ecx, [ebp - 0x14]
call fcn.004028e9
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.0045da4b
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
je 0x45dcf0
push esi
lea ecx, [ebp - 0x10]
call fcn.004028e9
push edi
lea eax, [ebp - 0x10]
push str._s360leakfixer.exe
push eax
mov byte [ebp - 4], 1
call fcn.00403ac2
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push ebx
call esi
test eax, eax
je 0x45dce8
push edi
lea eax, [ebp - 0x10]
push str._s_safemonFreeSaaS.tpi
push eax
call fcn.00403ac2
mov ebx, dword [ebp - 0x10]
add esp, 0xc
push ebx
call esi
test eax, eax
je 0x45dce8
lea ecx, [ebx - 0x10]
call fcn.0040290e
xor esi, esi
inc esi
lea ecx, [edi - 0x10]
call fcn.0040290e
mov eax, esi
jmp 0x45dc57
lea ecx, [ebx - 0x10]
call fcn.0040290e
xor esi, esi
jmp 0x45dcd9

Function at 0x45dcf4
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4ad74b
call fcn.004711ef
mov esi, ecx
push 0x4f39f8
lea ecx, [ebp - 0x10]
call fcn.004028e9
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0045da4b
push str.antiarp
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00415e37
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040b353
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.004701a0
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.miniui.dll
push ebx
lea eax, [ebp]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x45dd9b
lea eax, [ebp]
push eax
call fcn.00468191
pop ecx
push str.360NetUL.dll
push ebx
lea eax, [ebp]
push eax
call esi
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x45ddbb
lea eax, [ebp]
push eax
call fcn.00468191
pop ecx
lea ecx, [ebx - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x20c
leave
ret
Function at 0x45dde6
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 8
mov eax, 0x4ad783
call fcn.004711ef
mov edi, dword [ebp + 0x80c]
mov dword [ebp - 0x10], ecx
mov esi, 0x4f39f8
push esi
lea ecx, [ebp - 0x14]
call fcn.004028e9
mov ecx, dword [ebp - 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.0045da4b
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
jne 0x45de69
lea ecx, [ebx - 0x10]
call fcn.0040290e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x804
leave
ret 4
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004701a0
add esp, 0xc
push str.360leakfixer.exe
push ebx
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45de3a
mov ecx, dword [ebp - 0x10]
call fcn.0045bfe0
mov ebx, eax
test ebx, ebx
jne 0x45deb0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
jmp 0x45de3d
push esi
lea ecx, [ebp - 0x10]
call fcn.004028e9
push dword [edi]
lea eax, [ebp - 0x10]
push str._silent3__id_s___p0
push eax
mov byte [ebp - 4], 1
call fcn.00403ac2
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx]
add esp, 0xc
push 0xffffffffffffffff
xor esi, esi
push esi
push esi
push 1
push esi
push edi
lea ecx, [ebp]
push ecx
push ebx
call dword [eax + 0x24]
test eax, eax
jne 0x45df05
lea ecx, [edi - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
mov eax, esi
jmp 0x45de44
xor esi, esi
inc esi
jmp 0x45deeb
Function at 0x45e6f5
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x45e763
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
push edi
test eax, eax
je 0x45e75d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
jmp 0x45e768
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Non_existent_Process
mov ecx, esi
call fcn.004025d8
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047021a
leave
ret 8
Function at 0x45f464
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x4ada7e
call fcn.004711ef
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
mov ebx, ecx
call fcn.004701a0
add esp, 0xc
lea eax, [ebp]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
lea eax, [ebp]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004025d8
call fcn.00454557
pop ecx
test eax, eax
jne 0x45f519
push 0x96
lea ecx, [ebp - 0x10]
call fcn.00432171
mov esi, eax
and dword [ebp - 4], 0
push 0xd4
lea ecx, [ebp - 0x14]
call fcn.00432171
push 1
push 0x40
push dword [esi]
mov ecx, ebx
push dword [eax]
mov byte [ebp - 4], 1
push 0
call fcn.0045d09d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040290e
xor eax, eax
jmp 0x45f51c
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x804
leave
ret
Function at 0x45f53f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x210
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x210], eax
push 0x18
mov eax, 0x4adacf
call fcn.004711ef
mov eax, dword [ebp + 0x21c]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [edi + 8]
cmp eax, ebx
jne 0x45f5a1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x210]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x214
leave
ret 4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.0045bfe0
mov esi, eax
cmp esi, ebx
je 0x45f57a
push 0x4f39f8
lea ecx, [ebp - 0x14]
call fcn.004028e9
push 0x4f5948
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0045da4b
push dword [0x4f5948]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f649
push dword [0x4f5948]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x45f649
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.004701a0
add esp, 0xc
push 1
push 0x23
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.004025d8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.0045d595
mov ecx, dword [ebp - 0x18]
add esp, 0xc
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040290e
jmp 0x45f656
push 0x4f5948
lea ecx, [ebp - 0x14]
call fcn.00401d9d
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov ecx, dword [esi]
cdq
push edx
push eax
push edi
push esi
call dword [ecx + 0x30]
test eax, eax
je 0x45f687
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00403c4d
call fcn.00454557
pop ecx
cmp eax, ebx
jne 0x45f746
push dword [ebp - 0x1c]
mov eax, dword [esi]
push esi
call dword [eax + 0x54]
movzx ecx, ax
cmp cx, bx
jne 0x45f6a5
lea ecx, [edi - 0x10]
call fcn.0040290e
jmp 0x45f57a
xor eax, eax
push 0x3a
lea edi, [ebp + 0x20a]
stosd dword es:[edi], eax
pop eax
mov word [ebp + 0x20a], ax
lea eax, [ebp + 0x208]
mov word [ebp + 0x208], cx
push eax
lea ecx, [ebp - 0x18]
call fcn.004025d8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 1
call fcn.0045d595
add esp, 0xc
test eax, eax
je 0x45f70a
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call fcn.00403c4d
call fcn.00454557
pop ecx
mov byte [ebp - 0xd], bl
cmp eax, ebx
jne 0x45f70e
mov byte [ebp - 0xd], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 4], ebx
call fcn.0040290e
cmp byte [ebp - 0xd], bl
je 0x45f746
push ebx
push ebx
push 0x99
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
mov eax, ebx
jmp 0x45f57c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
call fcn.00401d9d
xor ebx, ebx
inc ebx
jmp 0x45f734
Function at 0x460b14
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x18
push esi
xor esi, esi
cmp ecx, esi
je 0x460b6d
cmp word [ecx], si
je 0x460b6d
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
pop edi
test eax, eax
je 0x460b6d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
shrd ecx, edx, 0xa
shr edx, 0xa
mov dword [eax], ecx
mov dword [eax + 4], edx
inc esi
mov eax, esi
pop esi
leave
ret 8

Function at 0x461387
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004701a0
movzx eax, word [ebp + 8]
push eax
push str.._c:
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00415679
add esp, 0x1c
push esi
push esi
push 3
push esi
push 3
push closesocket
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4613f6
xor eax, eax
jmp 0x461437
push esi
lea eax, [ebp - 0x210]
push eax
push 0xc
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x2d1080
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
test eax, eax
jne 0x461422
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4613f2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
je 0x461434
mov eax, dword [ebp - 0x218]
mov dword [edi], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047021a
leave
ret 8
Function at 0x463bfb
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
sub esp, 0x414
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x414], eax
push 0xc
mov eax, 0x4adec8
call fcn.004711ef
mov eax, dword [ebp + 0x420]
mov ax, word [eax]
mov esi, 0x4bee08
lea edi, [ebp + 0x40c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebp + 0x40c], ax
lea eax, [ebp + 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x463c76
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x414]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x418
leave
ret 4
push 0x4b6678
lea ecx, [ebp - 0x14]
call fcn.004025d8
lea eax, [ebp + 0x40c]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00403a9d
push 0x3ff
lea eax, [ebp + 0xd]
push ebx
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp + 0xc], bl
call fcn.004701a0
add esp, 0xc
push 0x4f39f8
lea ecx, [ebp - 0x10]
call fcn.004028e9
mov esi, 0x400
push esi
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00415e37
push eax
lea eax, [ebp + 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0040b353
cmp edi, ebx
jbe 0x463d22
mov edi, str.DeviceHarddisk
push edi
call fcn.00470c3e
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.00472a9e
add esp, 0x10
test eax, eax
je 0x463d22
lea ecx, [edi - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
jmp 0x463c4f
push ebx
push 0x80
push 3
push ebx
push 1
push 0x20000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x463d5f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040290e
mov eax, ebx
jmp 0x463c51
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0xc
lea eax, [ebp]
push eax
push 0x2d1400
push edi
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x463d94
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x463d42
xor esi, esi
inc esi
cmp dword [ebp + 0x28], 4
je 0x463da3
cmp dword [ebp + 0x28], 7
jne 0x463da5
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
jmp 0x463d42