joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a100
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x120], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], 0
jne 0x41a236
push 5
xor eax, eax
mov dword [ebp - 0x18], 7
push str.en_US
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00408c90
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, ecx
and eax, 0x3ff
cmp ax, 4
jne 0x41a1c3
mov eax, 0xc04
cmp cx, ax
je 0x41a1b2
mov eax, 0x1404
cmp cx, ax
je 0x41a1b2
mov eax, 0x404
cmp cx, ax
je 0x41a1b2
mov eax, 0x7c04
cmp cx, ax
je 0x41a1b2
push str.zh_CN
jmp 0x41a1ff
push 5
push str.zh_TW
lea ecx, [ebp - 0x2c]
call fcn.00408c90
jmp 0x41a207
cmp ax, 0x12
jne 0x41a1da
push 5
push str.ko_KR
lea ecx, [ebp - 0x2c]
call fcn.00408c90
jmp 0x41a207
cmp ax, 0x2a
jne 0x41a1e7
push str.vi_VN
jmp 0x41a1ff
cmp ax, 0x1e
jne 0x41a1f4
push str.th_TH
jmp 0x41a1ff
cmp ax, 0x11
jne 0x41a207
push str.ja_JP
lea ecx, [ebp - 0x2c]
call fcn.00404900
lea ecx, [edi + 0x110]
lea eax, [ebp - 0x2c]
cmp ecx, eax
je 0x41a21e
push 0xffffffffffffffff
push 0
push eax
call fcn.00408920
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x41a236
push dword [ebp - 0x2c]
call fcn.00484840
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
lea ecx, [edi + 0x110]
mov dword [esi + 0x10], 0
push ecx
mov ecx, esi
mov word [esi], ax
call fcn.00408920
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret 4

Function at 0x41d8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ba188
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4f07b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4d8960
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00408c90
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 4]
push eax
push 0x50
call fcn.0041a7a0
cmp dword [esp + 0x20], 8
jb 0x41d94c
push dword [esp + 0xc]
call fcn.00484840
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422210
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbe10
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x54], ecx
push 0
push 0
push 0
push 0
push 0x4dc3bc
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edx, dword [ebp - 0x44]
mov dword [edx], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x422275
push 0
mov ecx, dword [ebp - 0x44]
call fcn.004225a0
xor al, al
jmp 0x42235a
lea ecx, [ebp - 0x28]
call fcn.00408e80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00408e80
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00422a80
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x4222dd
push 1
mov ecx, dword [ebp - 0x44]
call fcn.004225a0
mov byte [ebp - 0x45], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00408ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408ee0
mov al, byte [ebp - 0x45]
jmp 0x42235a
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.004085d0
mov ecx, dword [ebp - 0x44]
mov dx, word [ebp - 0x4c]
mov word [ecx + 0x1c], dx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x20
call fcn.004085d0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x38
call fcn.004085d0
push 8
push str.https:__
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
call fcn.00491b0a
add esp, 0xc
test eax, eax
jne 0x422338
mov edx, dword [ebp - 0x44]
mov byte [edx + 0x50], 1
mov byte [ebp - 0x46], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00408ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408ee0
mov al, byte [ebp - 0x46]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422750
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
push eax
push 0
push 3
push 0
push 0
movzx ecx, word [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00408df0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x422795
xor al, al
jmp 0x422797
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4227a0
Capabilities:
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2824
call fcn.00492090
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x280c], ecx
mov dword [ebp - 0x2824], 1
mov dword [ebp - 0x2820], 0x4dc3f8
mov dword [ebp - 0x281c], 0
mov dword [ebp - 0x2814], 0x84001081
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4227ff
mov ecx, dword [ebp - 0x2814]
or ecx, 0x800000
mov dword [ebp - 0x2814], ecx
push 0
mov edx, dword [ebp - 0x2814]
push edx
push 0
push 0
push 0x4dc400
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
push 0x4dc414
mov eax, dword [ebp - 0x280c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [ebp - 0x280c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x280c]
cmp dword [eax + 4], 0
jne 0x422868
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error__d
push 0xfc
push 0x4dc43c
call fcn.00424270
add esp, 0x10
xor al, al
jmp 0x422988
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004048b0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00408df0
push eax
mov eax, dword [ebp - 0x280c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x42289f
mov byte [ebp - 0x2805], 1
jmp 0x4228a6
mov byte [ebp - 0x2805], 0
mov dl, byte [ebp - 0x2805]
mov byte [ebp - 0x2806], dl
movzx eax, byte [ebp - 0x2806]
test eax, eax
jne 0x4228e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error2__d
push 0x102
push 0x4dc47c
call fcn.00424270
add esp, 0x10
xor al, al
jmp 0x422988
mov dword [ebp - 0x2818], 0
mov byte [ebp - 0x2804], 0
push 0x27ff
push 0
lea ecx, [ebp - 0x2803]
push ecx
call fcn.0048f3e0
add esp, 0xc
mov dword [ebp - 0x2810], 0
lea edx, [ebp - 0x2810]
push edx
push 0x2800
lea eax, [ebp - 0x2804]
push eax
mov ecx, dword [ebp - 0x280c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x42295c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error3__d
push 0x10f
push str.utility::CHttpConnection::post
call fcn.00424270
add esp, 0x10
xor al, al
jmp 0x422988
cmp dword [ebp - 0x2810], 0
jne 0x422967
jmp 0x422986
mov eax, dword [ebp - 0x2810]
push eax
lea ecx, [ebp - 0x2804]
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.00411690
mov edx, 1
test edx, edx
jne 0x422909
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4229a0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x20000013
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4229db
xor al, al
jmp 0x422a24
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x20000005
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x422a22
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x422a80
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x204], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x202]
push ecx
call fcn.0048f3e0
add esp, 0xc
mov dword [ebp - 0x240], 0
push 0x38
push 0
lea edx, [ebp - 0x23c]
push edx
call fcn.0048f3e0
add esp, 0xc
mov dword [ebp - 0x240], 0x3c
lea eax, [ebp - 0x204]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 0xff
mov dword [ebp - 0x210], 1
lea ecx, [ebp - 0x240]
push ecx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.004048b0
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00408df0
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x422b22
xor al, al
jmp 0x422b4f
mov edx, dword [ebp - 0x230]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404900
mov eax, dword [ebp + 0xc]
mov cx, word [ebp - 0x228]
mov word [eax], cx
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00404900
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret

Function at 0x422b60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x118
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0048f3e0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x422bc5
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x422bd2
mov al, 1
jmp 0x422bd4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret
Function at 0x422bf0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4f1a20], 0xffffffff
je 0x422c30
cmp dword [0x4f1a20], 0
je 0x422c1e
mov byte [ebp - 0x121], 1
jmp 0x422c25
mov byte [ebp - 0x121], 0
mov al, byte [ebp - 0x121]
jmp 0x422ccd
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x422c62
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
push str.isWin7major___d__minor___d
push 0x48
push 0x4dc59c
call fcn.00424270
add esp, 0x14
cmp dword [ebp - 0x11c], 6
jne 0x422cc1
cmp dword [ebp - 0x118], 1
jne 0x422cc1
movzx ecx, byte [ebp - 6]
cmp ecx, 1
jne 0x422cc1
mov dword [0x4f1a20], 1
push str.is_win7
push 0x4c
push str.utility::usystem::isWin7
call fcn.00424270
add esp, 0xc
mov al, 1
jmp 0x422ccd
mov dword [0x4f1a20], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret

Function at 0x422ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x422d0f
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
jmp 0x422d19
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x28]
cmp edx, 9
je 0x422d2b
movzx eax, word [ebp - 0x28]
cmp eax, 6
jne 0x422d2f
mov al, 1
jmp 0x422d31
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x422d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0048f3e0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], 0x4dca94
mov ecx, dword [ebp + 8]
call fcn.00408df0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x422db1
push 5
push 0
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
push str.iexplore.exe
push 0x4dcabc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x422e90
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x422f57
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x422f57
push str._c_del
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.____NUL
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x422f57
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x422f57
mov eax, 1
jmp 0x422f59
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret

Function at 0x422f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbe7b
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x250], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x208
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0048f3e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00408d90
mov dword [ebp - 4], 0
push 3
push 0
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x234]
call fcn.0040c0e0
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x254]
push edx
lea ecx, [ebp - 0x234]
call fcn.004048c0
lea ecx, [ebp - 0x24c]
call fcn.00408ee0
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d590
mov ecx, dword [ebp - 0x250]
or ecx, 1
mov dword [ebp - 0x250], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00408ee0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret
Function at 0x423080
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbeb8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4dd398
lea ecx, [ebp - 0x28]
call fcn.00408d90
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e3e0
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x28]
call fcn.00408df0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x423130
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFile___Error:__ld_n
call fcn.0048b274
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.004919f8
add esp, 0xc
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408ee0
mov eax, dword [ebp - 0x44]
jmp 0x4231c2
push 0
lea edx, [ebp - 0x4c]
push edx
push 0xc
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0x2d1080
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x4231a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IOCTL_STORAGE_GET_DEVICE_NUMBER_Error:__ld_n
call fcn.0048b274
mov edx, 0x20
shl edx, 1
add eax, edx
push eax
call fcn.004919f8
add esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408ee0
mov eax, dword [ebp - 0x3c]
jmp 0x4231c2
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408ee0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret

Function at 0x423480
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00408df0
push eax
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4234a9
mov al, 1
jmp 0x4234e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, byte [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00408df0
push eax
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
push str.copy_file_from____s___to____s___flag___d_failed__error___d.
push 0x103
push str.utility::ufile::copyFile
call fcn.00424270
add esp, 0x1c
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x423af0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x423b0b
mov al, 1
jmp 0x423b3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408df0
push eax
push str.removeFile_file_from____s___error___d.
push 0x15e
push str.utility::ufile::removeFile
call fcn.00424270
add esp, 0x14
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x423b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0048f3e0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00408d90
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040d590
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
lea ecx, [ebp - 0x228]
call fcn.00408ee0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048464b
mov esp, ebp
pop ebp
ret

Function at 0x427dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x427dd4
xor al, al
jmp 0x427e18
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x427ec0
push 0
push 0
call fcn.0048f1a8
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x427e20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x427e75
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x427e5e
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x427e96
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [eax]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x427eb6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov esp, ebp
pop ebp
ret 4