joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4133c3
Capabilities:
Reference sql statements

Disassembly:
push 0x4c
mov eax, 0x4f69ab
call fcn.004d2c4d
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, str.InstallerAnalytics.dll
push 7
mov dword [edi + 0xc], eax
xor eax, eax
pop ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.004d828d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004087d4
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0044eb87
pop ecx
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
push eax
mov ecx, esi
call fcn.0040c794
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.00404a9e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a9e
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov ebx, 0x520378
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x40], ax
cmp word [0x520378], ax
je 0x41346b
push ebx
call fcn.004d828d
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004087d4
mov dword [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [ebp + 8]
push esi
call fcn.004a52b0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.00404a9e
cmp dword [esi + 0x14], 8
jb 0x4134a1
mov esi, dword [esi]
mov ecx, esi
call fcn.00413338
mov ebx, eax
test ebx, ebx
je 0x4134d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeEmbeddedUI
push ebx
call esi
push str.ShutdownEmbeddedUI
push ebx
mov dword [edi], eax
call esi
push str.EmbeddedUIHandler
push ebx
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x4134e3
push 0
push 0
push dword [edi + 0xc]
call eax
call fcn.004d2bf7
ret 8

Function at 0x41c1e3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x2e4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
test eax, 0x10000000
je 0x41c242
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41c242
push 0xfffffffffffffff0
push esi
call edi
shr eax, 0x10
test al, 1
je 0x41c242
push 0
push 0
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41c242
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x41c274
push 0
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov edi, eax
test edi, edi
je 0x41c272
cmp edi, esi
je 0x41c272
push 0
push 0
push 0x87
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41c272
push edi
jmp 0x41c238
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x41cc33
Capabilities:
Get disk size

Disassembly:
push 0x78
mov eax, 0x4f8c17
call fcn.004d2cbb
mov esi, ecx
mov dword [ebp - 0x5c], esi
cmp dword [ebp + 8], 1
je 0x41cc58
and dword [esi + 0x1a4], 0
xor eax, eax
jmp 0x41cddf
xor ebx, ebx
mov dword [ebp - 4], ebx
wait
mov ecx, dword [esi + 0x258]
cmp ecx, dword [esi + 0x25c]
jne 0x41cc75
xor eax, eax
inc eax
wait
jmp 0x41cddf
mov edi, ebx
mov dword [ebp - 0x6c], edi
mov eax, dword [esi + 0x25c]
sub eax, dword [esi + 0x258]
cdq
push 0x30
pop ecx
idiv ecx
cmp edi, eax
jae 0x41cd85
imul ecx, edi, 0x30
add ecx, dword [esi + 0x258]
mov dword [ebp - 0x68], ecx
mov eax, dword [ecx + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x535f80]
lahf
test ah, 0x44
jnp 0x41cd7f
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
cmp dword [ecx + 0x14], 8
jb 0x41ccd6
mov ecx, dword [ecx]
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x60]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
call fcn.004f40f0
mulsd xmm0, qword [0x535fa0]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x41cd7f
push 0x520004
lea ecx, [ebp - 0x48]
call fcn.00408867
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x30]
call fcn.00408867
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00404a9e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404a9e
jmp 0x41cc6c
inc edi
jmp 0x41cc77
push 0x52254c
lea ecx, [ebp - 0x30]
call fcn.00408867
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x48]
call fcn.00408867
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404a9e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00404a9e
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
call fcn.004d2c08
ret 4
Function at 0x41f314
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x18
mov eax, 0x4f91a5
call fcn.004d2c19
mov esi, ecx
test esi, esi
je 0x41f32e
lea ebx, [esi - 0x28]
mov dword [ebp - 0x10], ebx
jmp 0x41f332
and dword [ebp - 0x10], 0
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
mov eax, dword [ebp + 0x14]
je 0x41f349
and dword [eax], 0
jmp 0x41f422
and dword [eax], 0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
test eax, eax
push 2
pop edx
cmovne ecx, edx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
seta cl
xor ebx, ebx
xor edi, edi
inc ebx
inc edi
cmp byte [esi + 0x18], 0
je 0x41f381
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0xc], 8
jne 0x41f393
xor ebx, ebx
test cl, cl
setne bl
add ebx, 2
jmp 0x41f3a8
cmp dword [ebp + 0xc], 0x14
jne 0x41f3b1
xor eax, eax
test cl, cl
setne al
add eax, 2
mov dword [ebp - 0x14], eax
mov edi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [ebp + 0x14], eax
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
push 0
push ebx
xor ebx, ebx
mov edx, dword [ecx]
push ebx
push eax
call dword [edx + 0x18]
mov ecx, dword [esi + 0x14]
mov esi, dword [ebp + 0x14]
push ebx
push edi
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 0x18]
cmp dword [ebp + 0xc], 8
je 0x41f3ef
cmp dword [ebp + 0xc], 0x14
jne 0x41f410
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], 0x12
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TrackMouseEvent]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41f422
push esi
mov dword [ebp + 0x14], ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.004d2be2
ret 0x10

Function at 0x421945
Capabilities:
Reference sql statements

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
push edi
mov dword [ebx], str.ASELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll
mov dword [ebx + 4], esi
mov ebp, dword [esi + 4]
mov edi, dword [esi]
jmp 0x421969
mov ecx, edi
call fcn.00408e56
add edi, 0xc
cmp edi, ebp
jne 0x42195f
mov eax, dword [esi]
pop edi
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4235bf
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x4c
mov eax, 0x4f9caa
call fcn.004d2c4d
lea ecx, [ebp - 0x28]
call fcn.00463700
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.004576f0
mov byte [ebp - 4], 1
mov edx, 0x522bfc
push eax
lea ecx, [ebp - 0x58]
call fcn.0040e019
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0042384b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00404a9e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00404a9e
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004648e0
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x42363d
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404a9e
add bl, 1
je 0x42369f
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004648e0
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x423677
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404a9e
add bl, 1
je 0x42369f
xor bl, bl
jmp 0x4236af
lea eax, [ebp - 0x28]
mov ecx, 0x56b6cc
push eax
call fcn.0046c680
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a9e
mov al, bl
call fcn.004d2bf7
ret
Function at 0x42c098
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x5651c0]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 4
mov eax, 0x4fb86e
call fcn.004d2c19
mov esi, ecx
mov edi, 0x105
lea eax, [ebp]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42c119
cmp eax, edi
jae 0x42c119
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00409419
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x523a24
call fcn.004072c4
push esi
lea ecx, [ebp - 0x10]
call fcn.004072c4
mov ecx, dword [ebp - 0x10]
call fcn.00413338
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406df6
mov eax, esi
jmp 0x42c11b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d207d
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x4331a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x4331ef
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x43321a
shr ecx, 2
test cl, 1
je 0x433222
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x433251
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x433251
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433b98
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5651c0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
push edi
push 0x30
pop edi
push edi
mov ebx, ecx
push ebp
push ebx
call fcn.004d3e90
push 0x110
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x114
push ebp
push eax
call fcn.004d3e90
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x433bf7
cmp dword [esp + 0x14], 6
jae 0x433bfa
push 0x2c
pop edi
mov eax, dword [esp + 0x134]
mov dword [ebx], edi
mov dword [ebx + 4], ebp
test eax, eax
jne 0x433c1d
push esi
call dword [sym.imp.USER32.dll_GetParent]
or dword [ebx + 4], 1
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], esi
jmp 0x433c23
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], eax
mov esi, dword [esp + 0x138]
test esi, esi
je 0x433c35
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x56a588]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x134]
mov dword [ebx + 0x28], ebp
pop ebp
mov dword [ebx + 0x24], eax
pop ebx
xor ecx, esp
call fcn.004d207d
add esp, 0x118
ret 0x18
Function at 0x443b15
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x4ff532
call fcn.004d2cbb
mov eax, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [edi], 0
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 4], 0x200
jb 0x443b84
cmp dword [ebx + 4], 0x20e
ja 0x443b84
push 0x10
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
mov ecx, 0x8000
test cx, ax
jne 0x443b78
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x443b78
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x443b8a
xor ebx, ebx
inc ebx
mov dword [edi], ebx
mov eax, ebx
jmp 0x443c72
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebx + 4], 0x100
jb 0x443c6c
cmp dword [ebx + 4], 0x109
ja 0x443c6c
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x443bc4
cmp dword [ebx + 8], 0x58
je 0x443bc4
cmp dword [ebx + 8], 0x43
je 0x443bc4
cmp dword [ebx + 8], 0x56
jne 0x443b78
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x443bde
cmp dword [ebx + 8], 0x25
je 0x443b78
cmp dword [ebx + 8], 0x27
je 0x443b78
cmp dword [ebx + 4], 0x100
jne 0x443c6c
cmp dword [ebx + 8], 8
jne 0x443c56
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 0x168]
call fcn.0044a840
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x443c0e
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
test esi, esi
je 0x443c39
mov dl, bl
mov ecx, esi
call fcn.0044a8dd
test al, al
je 0x443c39
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x443c59
mov dword [edi], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x443b7d
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x443b7d
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], 0x70
jb 0x443c6c
cmp dword [eax + 8], 0x7b
jbe 0x443b7b
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004d2c08
ret 0x10
Function at 0x444cd9
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x4ffa9c
call fcn.004d2c19
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x444cf7
xor al, al
jmp 0x444db2
mov eax, dword [0x56b70c]
mov ecx, esi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00444ed9
and dword [ebp - 4], 0
mov ecx, 0x56b70c
push dword [eax]
call fcn.004451dc
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406df6
add bl, 1
je 0x444d77
mov eax, dword [0x56b70c]
mov ecx, esi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00444f84
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444dba
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x444dba
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406df6
push 1
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.00444f2b
mov dword [ebp - 4], 6
mov ecx, eax
push 0x52662c
call fcn.004451dc
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406df6
add bl, 1
sete al
call fcn.004d2be2
ret 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.00406df6
jmp 0x444cf0
Function at 0x44e4ea
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x5016be
call fcn.004d2c19
mov ebx, ecx
call fcn.0044e4a5
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp edi, 0xffffffff
jne 0x44e530
mov bl, al
jmp 0x44e58a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp + 8], 0
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
push esi
call fcn.0044ea25
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44e577
cmp dword [ebp - 0x10], 0
je 0x44e577
push dword [ebp - 0x10]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 8]
call dword [eax + 8]
mov bl, al
jmp 0x44e579
xor bl, bl
mov byte [ebp - 4], 0
push dword [ebp + 8]
call fcn.004d26a2
and dword [ebp + 8], 0
pop ecx
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x44e59d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x18], 0
mov al, bl
call fcn.004d2be2
ret 4

Function at 0x44ec54
Capabilities:
Get disk information

Disassembly:
push 0x1c
mov eax, 0x5017ce
call fcn.004d2c4d
mov ebx, ecx
push dword [ebx + 4]
push dword [ebx]
call fcn.00408e8b
mov eax, dword [ebx]
xor ecx, ecx
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
lea ecx, [ebp - 0x28]
push 0
push esi
call fcn.0044ef53
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x44ecbc
xor bl, bl
jmp 0x44ece0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push ebx
cmovae ecx, dword [ebp - 0x28]
mov edx, eax
call fcn.00465ba0
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a9e
mov al, bl
call fcn.004d2bf7
ret
Function at 0x450777
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501d01
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
push edi
mov eax, dword [0x5651c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xc
lea ecx, [esi + 0x48]
call fcn.004508e2
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x3c]
call fcn.00451d53
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ecx]
push 0x10
pop edi
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 9
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 8
lea ecx, [esi + 0x2c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 7
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 6
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 5
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 4
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 3
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 2
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 1
lea ecx, [esi + 8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
sub ecx, edi
call fcn.00406df6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4515f9
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5023a8
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
push edi
mov eax, dword [0x5651c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xe
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ecx]
push 0x10
pop edi
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x44]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xd
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x38]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 9
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 8
lea ecx, [esi + 0x2c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 7
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 6
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 5
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 4
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 3
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 2
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 1
lea ecx, [esi + 8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
mov byte [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
sub ecx, edi
call fcn.00406df6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret