joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f100
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
mov eax, dword [esi]
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea ecx, [ebp - 0x808]
add esp, 4
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47f150
sub ecx, edx
sar ecx, 1
jne 0x47f182
push dword [esi + 0x10]
push str.NO_VOLUME_SELECTED
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 4
test eax, eax
jne 0x47f1b6
push dword [esi + 0x10]
push str.INVALID_PATH
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x808]
mov ecx, esi
push eax
mov eax, dword [esi]
push 0x40a
call dword [eax + 0x8c]
push eax
call fcn.00418340
add esp, 8
mov ecx, esi
call fcn.0047c880
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x10]
call fcn.004cc740
add esp, 8
test eax, eax
je 0x47f218
xor eax, eax
cmp dword [ebp + 8], 1
sete al
push eax
push dword [esi + 0x10]
call fcn.004cc930
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea eax, [ebp - 0x808]
mov ecx, esi
push eax
call fcn.0047bdf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4

Function at 0x47fee0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
mov eax, dword [esi]
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea eax, [ebp - 0x808]
add esp, 4
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47ff30
sub eax, edx
sar eax, 1
jne 0x47ff60
push dword [esi + 0x10]
push str.NO_VOLUME_SELECTED
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 4
test eax, eax
jne 0x47ff92
push dword [esi + 0x10]
push str.INVALID_PATH
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
mov ecx, esi
push eax
mov eax, dword [esi]
push 0x40a
call dword [eax + 0x8c]
push eax
call fcn.00418340
add esp, 8
mov ecx, esi
call fcn.0047c880
call fcn.00416ae0
test eax, eax
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x10]
je 0x47ffe2
call fcn.004a5310
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
call fcn.004ced00
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x480100
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd9f8
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x57f78c], 0
push esi
mov dword [ebp - 0xd9f8], ecx
jne 0x4802c7
mov esi, dword [ebp + 8]
cmp esi, 0x8000
je 0x4802c7
push ebx
lea eax, [ebp - 0xd9f0]
push edi
push eax
call fcn.00428bc0
add esp, 4
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov dword [ebp - 0xd9f4], eax
cmp esi, 0x8004
jne 0x480206
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 2
jne 0x480206
xor ebx, ebx
lea esi, [ebp - 0xd9ec]
mov edi, 1
nop dword [eax]
test dword [ebp - 0xd9f0], edi
je 0x4801f4
push 0x51abf8
push esi
call fcn.004e480a
add esp, 8
cmp eax, esi
lea eax, [esi + 8]
je 0x48019f
mov eax, esi
cmp word [eax + 2], 0x3a
jne 0x4801f4
movzx ecx, word [eax]
mov ax, 0x5a
cmp ax, cx
sbb eax, eax
and eax, 0x20
add eax, 0x41
sub ecx, eax
mov eax, 1
shl eax, cl
mov ecx, dword [ebp + 0xc]
test dword [ecx + 0xc], eax
je 0x4801f4
test dword [ebp - 0xd9f4], eax
jne 0x4801f4
mov eax, dword [ebp - 0xd9f8]
push 1
push ebx
push dword [eax + 0x10]
call fcn.004cba20
push str.HOST_DEVICE_REMOVAL_DISMOUNT_WARN
push str.HOST_DEVICE_REMOVAL_DISMOUNT_WARN_TITLE
call fcn.004ce630
add esp, 0x14
inc ebx
rol edi, 1
add esi, 0x802
cmp ebx, 0x1a
jl 0x480180
xor ebx, ebx
lea esi, [ebp - 0xd9ec]
mov edi, 1
test dword [ebp - 0xd9f0], edi
je 0x48028c
push 0x51abf8
push esi
mov dword [ebp - 0xd9f4], esi
call fcn.004e480a
add esp, 8
cmp eax, esi
jne 0x48023e
lea eax, [esi + 8]
mov dword [ebp - 0xd9f4], eax
jmp 0x480240
mov eax, esi
push eax
call fcn.00429b60
add esp, 4
test eax, eax
je 0x48028c
push 0
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebp - 0xd9f4]
push eax
call fcn.0042a7a0
add esp, 0xc
test eax, eax
jne 0x48028c
mov eax, dword [ebp - 0xd9f8]
push 1
push ebx
push dword [eax + 0x10]
call fcn.004cba20
push str.HOST_DEVICE_REMOVAL_DISMOUNT_WARN
push str.HOST_DEVICE_REMOVAL_DISMOUNT_WARN_TITLE
call fcn.004ce630
add esp, 0x14
inc ebx
rol edi, 1
add esi, 0x802
cmp ebx, 0x1a
jl 0x480213
push 0
call fcn.004a41a0
push 0
call fcn.0049e9f0
add esp, 8
mov eax, 1
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 8
Function at 0x4807d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
mov eax, dword [esi]
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea eax, [ebp - 0x808]
add esp, 4
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480820
sub eax, edx
sar eax, 1
jne 0x480850
push dword [esi + 0x10]
push str.NO_VOLUME_SELECTED
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 4
test eax, eax
jne 0x480882
push dword [esi + 0x10]
push str.INVALID_PATH
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
mov ecx, esi
push eax
mov eax, dword [esi]
push 0x40a
call dword [eax + 0x8c]
push eax
call fcn.00418340
add esp, 8
mov ecx, esi
call fcn.0047c880
call fcn.00416ae0
test eax, eax
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x10]
je 0x4808d2
call fcn.004a53c0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
call fcn.00476720
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x4808f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [ecx]
push 0x3ee
call dword [eax + 0x8c]
push eax
call fcn.00406330
add esp, 4
neg eax
sbb eax, eax
add eax, 1
mov dword [0x559304], eax
jne 0x480919
call fcn.004188c0
call fcn.004cc0f0
jmp fcn.00421930
Function at 0x480cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0x10
mov esi, ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x480cde
call fcn.004cb060
test eax, eax
jne 0x480cde
xor edi, edi
jmp 0x480ce3
mov edi, 1
mov eax, dword [esi + 0x840]
test eax, eax
js 0x480d08
push eax
mov eax, dword [esi]
mov ecx, esi
push 0x3ef
call dword [eax + 0x8c]
push eax
call fcn.00406350
add esp, 8
jmp 0x480d0b
or eax, 0xffffffff
push edi
shr eax, 0x10
push eax
push dword [esi + 0x10]
call fcn.004cf9e0
add esp, 0xc
test eax, eax
je 0x480d43
cmp dword [0x55e044], 0
je 0x480d3a
push str.MOUNTED_VOLUMES_MOUNTED
push str.SUCCESSFULLY_MOUNTED
call fcn.004ce1b0
add esp, 8
pop edi
mov ecx, esi
pop esi
jmp fcn.0047c880
pop edi
pop esi
ret

Function at 0x481630
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x10]
call fcn.00493180
add esp, 4
cmp eax, 1
jne 0x481657
cmp dword [0x57f7a8], 0
push dword [esi + 0x10]
je 0x481659
call fcn.004ce3a0
add esp, 4
pop esi
ret
call fcn.004ce5a0
add esp, 4
cmp dword [esi + 0x838], 0
je 0x481657
mov ecx, esi
pop esi
jmp fcn.0047cad0

Function at 0x481680
Capabilities:
Get disk information

Disassembly:
push edi
mov edi, ecx
call fcn.00421850
push 7
call fcn.0041c0f0
add esp, 4
test eax, eax
je 0x48169f
call fcn.0041c1d0
test eax, eax
jne 0x4816d9
push esi
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, eax
mov ecx, esi
not ecx
push ecx
push 0
push 0x8004
call fcn.004ca970
mov edx, dword [edi]
add esp, 0xc
mov ecx, edi
push 0x64
call dword [edx + 0xd0]
push esi
push 0
push 0x8000
call fcn.004ca970
add esp, 0xc
pop esi
push 1
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.00482420
mov ecx, edi
call fcn.0047c880
mov eax, dword [edi]
mov ecx, edi
push 0x3ef
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
jmp fcn.00421690
Function at 0x481710
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
mov eax, dword [esi]
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea ecx, [ebp - 0x808]
add esp, 4
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481760
sub ecx, edx
sar ecx, 1
jne 0x481790
push dword [esi + 0x10]
push str.NO_VOLUME_SELECTED
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 4
test eax, eax
jne 0x4817c2
push dword [esi + 0x10]
push str.INVALID_PATH
call fcn.00419c20
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
mov ecx, esi
push eax
mov eax, dword [esi]
push 0x40a
call dword [eax + 0x8c]
push eax
call fcn.00418340
add esp, 8
mov ecx, esi
call fcn.0047c880
call fcn.00416ae0
test eax, eax
je 0x481825
lea eax, [ebp - 0x808]
push eax
call fcn.00429b60
add esp, 4
test eax, eax
je 0x481825
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x10]
call fcn.004a5470
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x10]
call fcn.004d2950
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x481b10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, dword [ebx]
mov edi, eax
push 0x400
lea eax, [ebp - 0x808]
mov ecx, ebx
push eax
push 0x40a
call dword [edx + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea ecx, [ebp - 0x808]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481b70
sub ecx, edx
sar ecx, 1
jne 0x481ba1
push dword [ebx + 0x10]
push str.NO_VOLUME_SELECTED
call fcn.00419c20
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 4
test eax, eax
jne 0x481bd4
push dword [ebx + 0x10]
push str.INVALID_PATH
call fcn.00419c20
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x808]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0x40a
call dword [eax + 0x8c]
push eax
call fcn.00418340
add esp, 8
mov ecx, ebx
call fcn.0047c880
lea eax, [ebp - 0x808]
push eax
push dword [ebx + 0x10]
call fcn.004cc740
add esp, 8
test eax, eax
je 0x481c24
push 1
push edi
push dword [ebx + 0x10]
call fcn.004cda40
add esp, 0xc
jmp 0x481d0e
push str.IDM_CHANGE_PASSWORD
call fcn.004bb8b0
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
add esp, 4
push eax
push 0x9c4f
push 0
push edi
call esi
push str.IDM_CHANGE_HEADER_KEY_DERIV_ALGO
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c65
push 0
push edi
call esi
push 0
push 0
push 0x800
push edi
call esi
push str.IDM_ADD_REMOVE_VOL_KEYFILES
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c63
push 0
push edi
call esi
push str.IDM_REMOVE_ALL_KEYFILES_FROM_VOL
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c64
push 0
push edi
call esi
push 0
push 0
push 0x800
push edi
call esi
push str.IDM_BACKUP_VOL_HEADER
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c5a
push 0
push edi
call esi
push str.IDM_RESTORE_VOL_HEADER
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c5b
push 0
push edi
call esi
push 0
push 0
push 0x800
push edi
call esi
push str.IDM_EXPAND_VOL_SPACE
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c8b
push 0
push edi
call esi
push str.IDM_COMPRESS_VOL_SPACE
call fcn.004bb8b0
add esp, 4
push eax
push 0x9c91
push 0
push edi
call esi
lea eax, [ebp - 0x818]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0x40f
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x814]
push 0
push dword [ebx + 0x10]
add eax, 2
push 0
push eax
mov eax, dword [ebp - 0x818]
add eax, 2
push eax
push 0x100
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [ebx]
mov ecx, ebx
push 0
push esi
push 0x111
call dword [eax + 0xa4]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x481ee0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
push dword [edi + 0x10]
call fcn.00421af0
mov esi, eax
add esp, 4
cmp esi, dword [edi + 0x10]
je 0x481f9f
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
je 0x481f1a
push 8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x481f9f
cmp dword [0x575114], 0
je 0x481f6b
cmp dword [0x559304], 0
je 0x481f6b
mov ecx, 0x575118
mov dword [ebp - 0xc], 0x4d414e56
mov dword [ebp - 4], 0x575118
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481f42
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x10]
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x838], 0
jne 0x481f94
push 0
push 0
push 0x80ca
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483d00
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
cmp dword [0x576488], edi
jne 0x483d1b
cmp dword [0x576494], edi
je 0x483e39
mov esi, dword [0x55baf8]
cmp esi, 0xffffffff
jne 0x483d2d
call fcn.00427e60
mov esi, eax
cmp dword [0x57f7bc], edi
je 0x483d6e
cmp dword [0x568600], edi
jne 0x483d55
cmp dword [0x58d384], edi
jne 0x483d55
call fcn.004cb060
test eax, eax
je 0x483d55
mov eax, 1
jmp 0x483d57
xor eax, eax
push eax
push esi
push dword [ebx + 0x10]
call fcn.004cf9e0
add esp, 0xc
test eax, eax
mov eax, 1
cmove edi, eax
cmp dword [0x57f7c0], 0
je 0x483d91
push 0
push dword [0x57f7b8]
call fcn.004d0930
add esp, 8
test eax, eax
mov eax, 1
cmove edi, eax
cmp dword [0x576494], 0
je 0x483e39
push 0x576498
call fcn.00429ee0
add esp, 4
test eax, eax
je 0x483dde
cmp dword [0x57f79c], 0
je 0x483dcd
push 0x576498
call fcn.00428c00
push eax
call fcn.00416d60
add esp, 8
jmp 0x483e1a
push 0
push str.ERR_VOL_ALREADY_MOUNTED
call fcn.00419c20
add esp, 8
jmp 0x483e1a
cmp esi, 0xffffffff
je 0x483dfd
push esi
call fcn.004cf8d0
add esp, 4
test eax, eax
jne 0x483dfd
or eax, 0xffffffff
cmp dword [0x576c9c], 0
cmovne esi, eax
push 0
push 0x576498
push esi
push dword [ebx + 0x10]
call fcn.004cf910
add esp, 0x10
test eax, eax
mov eax, 1
cmove edi, eax
push 0x576498
call fcn.00428c00
mov ecx, dword [0x55e048]
add esp, 4
cmp eax, 0xffffffff
cmovne ecx, eax
mov dword [0x55e048], ecx
cmp dword [0x576d18], 0
je 0x483e4f
push dword [0x568600]
mov ecx, ebx
call fcn.0048b2e0
cmp dword [0x58d388], 0
je 0x483e82
mov eax, 0x58d388
mov ecx, 0x48
mov esi, ecx
mov edx, eax
mov byte [edx], 0
lea edx, [edx + 1]
sub esi, 1
jne 0x483e66
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x483e71
mov dword [0x58d388], ecx
cmp dword [0x58d3d0], 0
je 0x483eb8
push 0x58d3d0
call fcn.004b9bc0
add esp, 4
cmp dword [0x57e22c], 0
je 0x483eae
push 0x57e22c
call fcn.004b9bc0
add esp, 4
mov dword [0x57e228], 0
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x483ec0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x483efa
push dword [edi + 0x10]
mov dword [edi + 0x830], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 5
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 9
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebp
ret 4
push 0
push dword [edi + 0x10]
mov dword [edi + 0x830], 1
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebp
ret 4
Function at 0x483f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push esi
call fcn.00484640
mov dword [0x55baf4], eax
test eax, eax
je 0x483f45
call fcn.004cbb40
call fcn.004ba340
jmp 0x483f59
mov dword [0x57f7e8], 1
mov dword [0x55932c], 1
push esi
mov ecx, ebx
call fcn.00484a90
cmp word [0x57ec70], 0
je 0x483f70
call fcn.004c4980
cmp dword [0x559304], 0
je 0x483f8c
cmp dword [0x55bb00], 0
mov dword [0x559304], 1
jne 0x483f96
mov dword [0x559304], 0
cmp dword [0x576ca4], 0
push edi
je 0x483fb4
mov ecx, 0x1c
mov esi, 0x576ca8
mov edi, 0x57f7e0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [0x576490]
test eax, eax
je 0x483fd8
cmp eax, 2
jne 0x483fd4
push 0x51a1b0
push esi
call fcn.0042c560
add esp, 8
test eax, eax
jne 0x483fd8
xor edi, edi
jmp 0x483fe4
mov ecx, ebx
mov edi, 1
call fcn.00484550
mov ecx, ebx
call fcn.004840f0
call fcn.004a3750
mov ecx, ebx
mov dword [0x57f7dc], 1
call fcn.00483d00
mov ecx, ebx
mov dword [0x57f7dc], 0
call fcn.00483c70
cmp dword [0x576d18], 0
mov esi, eax
je 0x48402a
push dword [0x568600]
mov ecx, ebx
call fcn.0048b2e0
cmp dword [ebx + 0x24], 0
je 0x484037
mov ecx, ebx
call fcn.004841e0
cmp dword [0x57648c], 0
je 0x48405e
cmp dword [0x57f7a8], 0
je 0x4840c2
mov ecx, ebx
mov dword [ebx + 0x830], 1
call fcn.0048a050
test eax, eax
jne 0x4840c8
test edi, edi
pop edi
jne 0x48406c
cmp dword [0x576494], 0
je 0x484077
mov ecx, ebx
call fcn.00489d60
test eax, eax
jne 0x4840ce
cmp dword [0x57f7a8], 0
je 0x484094
push dword [ebx + 0x10]
call fcn.004ce3a0
add esp, 4
call fcn.00419e70
test eax, eax
je 0x4840d5
pop esi
mov dword [0x568600], 0
mov dword [0x58d3d8], 0
mov dword [0x58d3d4], 0
mov dword [0x55baf4], 1
pop ebx
pop ebp
ret 4
push esi
call fcn.004f7120
push esi
call fcn.004f7120
push 0
call fcn.004f7120
mov ecx, ebx
call fcn.00489d60
push esi
call fcn.004f7120
int3
Function at 0x4842b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd1dc
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov edx, dword [0x58e8c0]
push esi
push edi
mov edi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x5778cc]
cmp eax, dword [edx + 4]
jle 0x484314
push 0x5778cc
call fcn.004e25b0
add esp, 4
cmp dword [0x5778cc], 0xffffffff
jne 0x484314
mov eax, dword [0x55e020]
push 0x5778cc
mov dword [0x5778c8], eax
call fcn.004e2571
add esp, 4
lea eax, [ebp - 0xd1dc]
push eax
call fcn.00428bc0
mov eax, dword [ebp - 0xd1dc]
add esp, 4
cmp eax, dword [0x5778d0]
jne 0x48433e
mov eax, dword [0x55e020]
cmp eax, dword [0x5778c8]
je 0x4843a0
call fcn.004ce1a0
test eax, eax
je 0x4843a0
mov eax, dword [ebp - 0xd1dc]
mov ecx, dword [0x55e020]
mov dword [0x5778d0], eax
mov dword [0x5778c8], ecx
test eax, eax
je 0x48436b
mov eax, 0x384
test ecx, ecx
jne 0x484370
mov eax, 0x1f5
push eax
push dword [edi + 0x10]
call fcn.004ce2b0
add esp, 8
cmp dword [ebp - 0xd1dc], 0
je 0x484395
cmp dword [0x55e020], 0
je 0x484395
mov eax, 1
jmp 0x484397
xor eax, eax
push eax
call fcn.0047afe0
add esp, 4
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
cmp dword [0x58d380], eax
jne 0x4843e8
mov ecx, 0x5801a8
lea edx, [ebp - 0xd1dc]
mov esi, 0xd1d4
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4843e8
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4843c0
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
call fcn.00421850
push 0
push 0xffffffffffffffff
push 0x80cb
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00421690
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
je 0x4843d1
mov eax, 1
shl eax, cl
test dword [ebp - 0xd1dc], eax
jne 0x4843d1
push ecx
call fcn.00429be0
add esp, 4
test eax, eax
jne 0x4843d1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
Function at 0x4847f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, ecx
call esi
cmp eax, dword [0x577650]
jbe 0x48482a
call esi
sub eax, dword [0x577650]
cmp eax, 0xea60
jb 0x4849b2
push edi
call esi
mov dword [0x577650], eax
xor esi, esi
mov edi, 1
nop dword [eax]
test dword [0x5801a8], edi
je 0x4849a5
lea eax, [ebp - 0x860]
push eax
push esi
call fcn.00429680
add esp, 8
test eax, eax
je 0x4849a5
mov eax, dword [ebp - 0x2a]
cmp dword [esi*8 + 0x577728], eax
mov eax, dword [ebp - 0x1e]
mov ecx, dword [ebp - 0x22]
mov edx, dword [ebp - 0x26]
jne 0x48496b
cmp dword [esi*8 + 0x57772c], edx
jne 0x48496b
cmp dword [esi*8 + 0x5777f8], ecx
jne 0x48496b
cmp dword [esi*8 + 0x5777fc], eax
jne 0x48496b
mov edx, dword [ebp - 0x85c]
cmp dword [esi*4 + 0x577658], edx
mov edx, dword [ebp - 0x26]
jne 0x48496b
inc dword [esi*4 + 0x5776c0]
mov eax, dword [esi*4 + 0x5776c0]
cmp eax, dword [0x55e040]
jl 0x4849a5
push 0
push esi
push 0x8003
call fcn.004ca970
add esp, 0xc
cmp dword [0x55e024], 0
je 0x484909
push esi
call fcn.00415b70
add esp, 4
test eax, eax
je 0x484909
mov eax, dword [ebx]
mov ecx, ebx
push 0xfa
call dword [eax + 0xd0]
push dword [0x55e034]
push esi
push dword [ebx + 0x10]
call fcn.004cab40
add esp, 0xc
test eax, eax
jne 0x4849a5
push eax
push esi
push 0x8004
mov dword [esi*4 + 0x5776c0], eax
call fcn.004ca970
add esp, 0xc
cmp dword [0x55e028], 0
je 0x4849a5
push 0
lea eax, [ebp - 0x864]
push eax
push 0
push 0
push 0
push 0
push 0x222030
push dword [0x559328]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
call fcn.004c2be0
jmp 0x4849a5
mov eax, dword [ebp - 0x2a]
mov dword [esi*8 + 0x577728], eax
mov eax, dword [ebp - 0x1e]
mov dword [esi*8 + 0x5777fc], eax
mov eax, dword [ebp - 0x85c]
mov dword [esi*4 + 0x5776c0], 0
mov dword [esi*8 + 0x57772c], edx
mov dword [esi*8 + 0x5777f8], ecx
mov dword [esi*4 + 0x577658], eax
inc esi
rol edi, 1
cmp esi, 0x1a
jl 0x484840
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret