joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010c0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x401180
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4011ee
xor ecx, ecx
xor edx, edx
jmp 0x4011c6
cmp al, 0x5c
jne 0x401248
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4011e3
cmp al, 9
je 0x4011ce
cmp al, 0x20
jne 0x4011b0
test ecx, ecx
je 0x4011e3
xor edx, edx
jmp 0x4011bb
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4011e0
cmp al, 0x20
je 0x4011e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x401209
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x4011d2
and edx, 1
jne 0x4011d2
xor ecx, 1
jmp 0x4011bb
Function at 0x1004db7b
Capabilities:
Terminate process

Disassembly:
jmp fcn.10092b60
jmp 0x1008e210
cmp ecx, dword [0x10106640]
jne 0x1008e21a
repz ret
jmp 0x1004c64f

Function at 0x1006f4c0
Capabilities:
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x1c
call fcn.1004db1c
add esp, 4
mov dword [ebp - 8], eax
cmp dword [0x101062ec], 1
jae 0x1006f513
push str.please_report_occurrence_circumstances_to_gtk_devel_list_gnome.org
push str.e:02_hoffice90devimagefilter6_rsvg_rsvgdependencyglibgobjectgsignal.c:561:_handler_id_overflow___s
push 4
push str.Glib_GObject
call fcn.1004c109
add esp, 0x10
jmp 0x1006f50d
mov eax, dword [ebp - 8]
mov ecx, dword [0x101062ec]
mov dword [eax], ecx
mov edx, dword [0x101062ec]
add edx, 1
mov dword [0x101062ec], edx
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff0000
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], ecx
xor eax, eax
cmp dword [ebp + 8], 0
setne al
and eax, 1
shl eax, 0x10
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
and edx, 0xfffeffff
or edx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1004d11c
mov esp, ebp
pop ebp
ret
Function at 0x4462eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44632a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44632a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44632a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44632a
cmp dword [ecx + 0x74], 0xe
jbe 0x44632a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x44bea8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x44bf45
push ebx
push esi
call fcn.0044be71
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044be05
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x44bef2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44bf44
push edi
push eax
call fcn.0044a80b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x44bf12
call fcn.0044a859
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44bf43
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044be05
add esp, 0x20
test eax, eax
jne 0x44bf31
push edi
call fcn.0044a859
jmp 0x44bf39
push ebx
call fcn.0044a859
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x44d156
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4550c8
push 0x4550c0
push str.FlsAlloc
push 0x1f
call fcn.0044d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44d18a
push dword [ebp + 8]
mov ecx, esi
call dword [0x453130]
call esi
jmp 0x44d190
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44d1d4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4550d8
push 0x4550d0
push str.FlsGetValue
push 0x21
call fcn.0044d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44d20b
push dword [ebp + 8]
mov ecx, esi
call dword [0x453130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x44d213
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4550e0
push 0x4550d8
push str.FlsSetValue
push 0x22
call fcn.0044d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44d24d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x453130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x452610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45263d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45263d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x8254809e
add eax, 0x7debbdbb
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xc6a137ae
add dword [ebp - 0x44], 0x87b10d9d
mov dword [ebp - 0x40], 0x9560087d
add dword [ebp - 0x40], 0x9cd343c8
mov dword [ebp - 0x3c], 0x79417ed1
sub dword [ebp - 0x3c], 0x2cf53aa3
mov dword [ebp - 0x38], 0x2ab93b4b
sub dword [ebp - 0x38], 0x2ab93b4b
lea eax, [ebp - 0x44]
push eax
mov eax, 0xf8b082e6
add eax, 0x78fed7e
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9d69a9f4
add dword [ebp - 0x44], 0xd708bf62
mov dword [ebp - 0x40], 0xb8daa96f
sub dword [ebp - 0x40], 0x776e47fa
mov dword [ebp - 0x3c], 0x4d4821e2
sub dword [ebp - 0x3c], 0xe9d8b576
mov dword [ebp - 0x38], 0xaaad979c
add dword [ebp - 0x38], 0x55526864
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37691
push 0
call eax
mov ecx, 0xb851a716
sub ecx, 0xb8515c6f
xor ebx, ebx
add ebx, eax
mov edi, 0x41e98d4b
add edi, 0xbe5772b5
add edi, dword [ebp - 0x34]
mov edx, 0x3d280320
mov esi, dword [edi]
sub dword [ebp - 0x28], 0xbf3add05
sub esi, edx
sub dword [ebp - 0x18], 0xa175ac63
mov dword [ebx], esi
xor dword [ebp - 0x14], 0x7e7ed27b
add ebx, 4
add edi, 0xbad3dd29
add edi, 0x452c22db
loop 0x403f72
add eax, 0x40876eb8
add eax, 0xbf79aeb7
xor ebx, ebx
add ebx, eax
add eax, 0xf4652dbe
sub eax, 0xf4652db9
mov ecx, 0x6f76bf45
sub ecx, 0x6f36bf45
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x250a775d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3ffa3d46
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x30017c9c
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x300190b0
call fcn.30017e54
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300200e8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30017a3b
cmp eax, esi
jne 0x30017a2e
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30017a3e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30017a15
xor esi, esi
inc esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017a51
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30017a80
mov eax, dword [0x300200e4]
test eax, eax
jne 0x30017a7a
mov dword [0x300200e4], esi
push 0x30001534
push 0x30001528
call fcn.3013c000
pop ecx
pop ecx
test eax, eax
je 0x30017a80
jmp 0x30017ba8
mov dword [0x3001fd94], esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017aa4
push 0x30001524
push 0x300014e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300200e4], 2
test ebx, ebx
jne 0x30017ab0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300200f4], 0
je 0x30017ad4
push 0x300200f4
call fcn.30018076
pop ecx
test eax, eax
je 0x30017ad4
push 0
push 2
push 0
call dword [0x300200f4]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30017b30
test al, al
je 0x30017aee
cmp dword [ebp - 0x1c], 0
jne 0x30017b30
mov al, byte [esi]
test al, al
je 0x30017afe
cmp al, 0x20
ja 0x30017afe
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30017aee
test byte [ebp - 0x3c], 1
je 0x30017b0a
movzx eax, word [ebp - 0x38]
jmp 0x30017b0d
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3001fd90], eax
cmp dword [0x3001fd84], 0
jne 0x30017b84
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30017b3f
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30017b52
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30017adb
cmp dword [0x3001fd94], 0
jne 0x30017b93
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3001fd90]
jmp 0x30017bb4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30017e99
ret
call fcn.300178c4
jmp 0x300179db
Function at 0x401260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
mov ebx, eax
mov eax, 0x40d518
cmove ebx, eax
mov eax, ebx
call dbg.is_exe_file
test eax, eax
je 0x4012a0
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000000
call sym._RegQueryValueW_16
mov ebx, dword [ebp - 4]
sub esp, 0x10
test eax, eax
leave
sete al
movzx eax, al
add eax, eax
ret
Function at 0x4017e0
Capabilities:
Enumerate files on windows
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4ac
movzx ecx, word [edx]
mov dword [ebp - 0x480], eax
mov ebx, dword [eax + 0x14]
test cx, cx
je 0x401a3d
lea edi, [ebp - 0x470]
mov eax, edx
mov dword [ebp - 0x484], edi
mov edx, edi
lea esi, [esi]
add eax, 2
mov word [edx], cx
add edx, 2
movzx ecx, word [eax]
test cx, cx
jne 0x401818
xor eax, eax
mov dword [edx], 0x2a005c
mov word [edx + 4], ax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x490], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x488], eax
sub esp, 8
cmp eax, 0xffffffff
je 0x401a1f
lea eax, [ebx + 1]
xor ebx, ebx
mov dword [ebp - 0x48c], eax
lea esi, [esi]
nop
mov dword [esp + 8], 0x2b0
mov esi, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax + 0x2a4], 0
mov ebx, eax
sub esp, 0xc
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov eax, dword [ebp - 0x47c]
test eax, eax
cmove eax, ebx
mov dword [ebp - 0x47c], eax
test esi, esi
je 0x4018e1
mov dword [esi], ebx
mov eax, dword [ebp - 0x268]
lea edi, [ebx + 0x1c]
lea ecx, [ebx + 0x18]
and edi, 0xfffffffc
lea esi, [ebp - 0x268]
mov dword [ebx + 0x18], eax
sub ecx, edi
mov eax, dword [ebp - 0x1c]
sub esi, ecx
add ecx, 0x250
mov dword [ebx + 0x264], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x480]
mov edx, dword [ebp - 0x490]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x2a0], 0
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebx + 0x29c], 0
mov dword [ebx + 0x14], eax
xor eax, eax
lea esi, [esi]
movzx ecx, word [ebx + eax + 0x44]
mov word [edx + eax + 2], cx
add eax, 2
test cx, cx
jne 0x401958
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4019e3
lea eax, [ebx + 0x268]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetFileInformationByHandle]
sub esp, 8
test eax, eax
je 0x4019d7
mov dword [ebx + 0x29c], 1
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x488]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401880
mov eax, dword [ebp - 0x488]
mov dword [ebx], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x480]
mov edi, dword [ebp - 0x47c]
mov dword [eax + 0x10], 1
mov dword [eax + 4], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x470]
mov dword [ebp - 0x484], eax
mov edx, eax
jmp 0x401829
Function at 0x401b50
Capabilities:
Set application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
add eax, 0x164
sub esp, 0x44
mov dword [ebp - 0x28], eax
mov eax, dword [0x414020]
mov ecx, dword [ebx + 0x14c]
mov edx, dword [ebx + 0x150]
mov dword [ebp - 0x2c], 0x40d4dc
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x20], ecx
sub eax, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x158]
mov dword [ebp - 0x10], 0
sub eax, edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 4], dbg.CBTProc
mov dword [esp + 0xc], eax
mov dword [esp], 5
call sym._SetWindowsHookExW_16
mov dword [0x414bd8], ebx
sub esp, 0x10
mov dword [0x414bdc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [0x414044]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x220
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebx], eax
sub esp, 0x10
test eax, eax
mov eax, dword [0x414bdc]
mov dword [esp], eax
je 0x401cd8
call sym._UnhookWindowsHookEx_4
mov eax, dword [0x414060]
mov edx, 0x10
sub esp, 4
cmp eax, edx
mov dword [esp + 8], 1
cmovl eax, edx
mov dword [esp + 4], 0x1a0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x414060]
mov edx, 0x10
sub esp, 0x10
cmp eax, edx
mov dword [esp + 8], 1
cmovl eax, edx
mov dword [esp + 4], 0x1a0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x98]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [ebx + 0x94]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x18f
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x186
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [ebx]
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
call sym._UnhookWindowsHookEx_4
mov ebx, dword [ebp - 4]
xor eax, eax
sub esp, 4
leave
ret
Function at 0x401f20
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x998]
lea ebx, [ebp - 0x808]
sub esp, 0x9c0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x9a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x9a8]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
mov edx, eax
sub esp, 0x10
xor eax, eax
test edx, edx
jne 0x401fb0
lea esi, [esi]
nop
movzx edx, word [eax + 0x40d504]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x401f70
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40b
mov eax, dword [0x414048]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x908]
mov dword [esp + 0xc], 0x40
lea esi, [ebp - 0x988]
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x9a4]
mov eax, dword [ebp - 0x9a8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._StrFormatByteSizeW_16
mov dword [ebp - 0x990], eax
sub esp, 0x10
lea eax, [ebp - 0x888]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x99c]
mov eax, dword [ebp - 0x9a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._StrFormatByteSizeW_16
sub esp, 0x10
mov dword [ebp - 0x98c], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4c3
mov eax, dword [0x414020]
mov dword [esp], eax
call sym._LoadStringW_16
lea eax, [ebp - 0x990]
sub esp, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x2400
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
jmp 0x401f83
Function at 0x402080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x82c]
push ebx
xor ebx, ebx
sub esp, 0x86c
mov word [ebp - 0x824], cx
mov word [ebp - 0x822], bx
lea ebx, [ebp - 0x818]
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
mov dword [esp + 4], 0x414068
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
sub esp, 8
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x2c], 0xd
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x65
mov eax, dword [0x414020]
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x102
mov dword [esp + 4], 0x50001002
mov eax, dword [0x41402c]
mov dword [esp], eax
call sym._CreateToolbarEx_52
sub esp, 0x34
mov dword [0x414050], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4b5
mov eax, dword [0x414020]
mov dword [esp], eax
call sym._LoadStringW_16
sub esp, 0x10
cmp word [ebp - 0x818], 0
je 0x4022f7
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x402198
sub eax, ebx
sar eax, 1
add eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x818], dx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov eax, dword [0x414050]
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebp - 0x828], 0x9001
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x443
mov eax, dword [0x414050]
mov dword [esp], eax
call sym._SendMessageW_16
add dword [ebp - 0x81c], 1
sub esp, 0x10
mov dword [esp + 0xc], 0x414068
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov eax, dword [0x414050]
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebp - 0x828], 0x9002
sub esp, 0x10
cmp word [0x414068], 0
je 0x4022d3
mov ebx, 2
mov edi, 0x414068
lea esi, [esi]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
je 0x4022f0
ja 0x4022e0
mov ecx, 1
cmp eax, 2
je 0x402285
xor ecx, ecx
cmp eax, 4
sete cl
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 0x82c], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x443
mov eax, dword [0x414050]
mov dword [esp], eax
call sym._SendMessageW_16
add dword [ebp - 0x828], 1
add dword [ebp - 0x81c], 1
sub esp, 0x10
lea esi, [esi]
add edi, 2
cmp word [edi - 2], 0
jne 0x4022c0
add ebx, 1
cmp word [edi], 0
jne 0x402258
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
cmp eax, 6
sete cl
lea ecx, [ecx + ecx*2 + 2]
jmp 0x402285
mov ecx, 3
jmp 0x402285
mov eax, 1
jmp 0x4021a8