joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41debd
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_QueryPerformanceFrequency]
test eax, eax
je 0x41df81
push ebx
push esi
mov esi, dword [sym.imp.___total_physical_size__lu_MB_QueryPerformanceCounter]
push edi
lea eax, [ebp - 0x18]
push eax
call esi
test eax, eax
je 0x41df81
call dword [0x4ac250]
push 0x1e
mov ebx, eax
mov dword [ebp - 0x24], edx
call dword [sym.imp.___total_physical_size__lu_MB_Sleep]
lea eax, [ebp - 0x10]
push eax
call esi
call dword [0x4ac250]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 0
sbb ecx, dword [ebp - 0x14]
push 0xf4240
push ecx
push eax
mov dword [ebp - 4], edx
call fcn.00453310
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edx
push eax
call fcn.00453160
push 0
push 2
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.00453160
sub eax, ebx
sbb edx, dword [ebp - 0x24]
add eax, dword [ebp - 8]
push edi
adc edx, dword [ebp - 4]
push esi
push edx
push eax
call fcn.00453160
or dword [0x4ac248], 0xffffffff
pop edi
pop esi
mov dword [0x4ac244], eax
pop ebx
cmp eax, 0xffffffff
ja 0x41df7d
shr dword [0x4ac248], 1
cmp dword [0x4ac248], eax
jae 0x41df6f
xor eax, eax
leave
ret
push 1
call fcn.00451974
int3

Function at 0x41e084
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
test esi, 0xfff
je 0x41e0b4
mov eax, dword [ebp + 0x14]
cmp ebx, eax
jbe 0x41e0a3
mov eax, ebx
push 4
push 0x1000
push eax
push edi
call dword [sym.imp.___total_physical_size__lu_MB_VirtualAlloc]
mov esi, eax
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.___total_physical_size__lu_MB_SetFilePointer]
push edi
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
mov eax, dword [ebp + 0x14]
cmp ebx, eax
jbe 0x41e0d5
mov eax, ebx
push edi
lea ecx, [ebp + 0x1c]
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
jne 0x41e11e
test byte [0x4cdde0], 0x10
je 0x41e119
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push str.error_reading__d__d__bytes_at__I64d_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x5c
push str.MREISER_INFO
call fcn.0044dc85
add esp, 0x20
or eax, 0xffffffff
jmp 0x41e14d
cmp dword [ebp + 0x18], esi
je 0x41e13f
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x18]
call fcn.00451390
add esp, 0xc
push 0x8000
push edi
push esi
call dword [sym.imp.___total_physical_size__lu_MB_VirtualFree]
mov eax, dword [ebp + 0x1c]
cmp eax, edi
jl 0x41e119
cmp eax, dword [ebp + 0x14]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x41efad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push str.SystemCurrentControlSetControlSnapshot
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x41effc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SystemCurrentControlSetControlSnapshot
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
test eax, eax
je 0x41f01c
xor eax, eax
jmp 0x41f044
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push dword [ebp - 4]
neg eax
sbb esi, esi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
lea eax, [esi + 1]
pop esi
leave
ret 8

Function at 0x41f048
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SystemCurrentControlSetControlSnapshot
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
test eax, eax
je 0x41f068
xor eax, eax
jmp 0x41f09e
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f06e
push esi
sub eax, edx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push dword [ebp - 4]
neg eax
sbb esi, esi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
lea eax, [esi + 1]
pop esi
leave
ret 8

Function at 0x41f0a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push str.SystemCurrentControlSetControlSnapshot
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
test eax, eax
je 0x41f0c8
xor eax, eax
jmp 0x41f0f1
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push dword [ebp + 0x10]
neg eax
sbb esi, esi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
lea eax, [esi + 1]
pop esi
leave
ret 0xc
Function at 0x41f10d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push esi
push 3
pop eax
xor esi, esi
inc esi
push 0x46c02c
push 0x4cd550
mov dword [0x4cd288], 0x30
mov dword [0x4cd28c], 0x400
mov dword [0x4cd290], 0x80
mov dword [0x4cd298], ebx
mov dword [0x4cd294], 0x2004
mov dword [0x4cd29c], eax
mov dword [0x4cd2a0], esi
mov dword [0x4cd2a4], esi
mov dword [0x4cd2a8], esi
mov dword [0x4cd2ac], ebx
mov dword [0x4cd2b0], 0x7fffffff
mov dword [0x4cd2b4], 0x32
mov dword [0x4cd2c0], 0x5d2
mov dword [0x4cd2c8], eax
mov dword [0x4cd2d0], ebx
mov dword [0x4cd544], ebx
mov dword [0x4cd2f4], esi
mov dword [0x4cd300], ebx
mov dword [0x4cd31c], ebx
mov dword [0x4cd318], ebx
mov dword [0x4cd304], ebx
mov dword [0x4cd30c], ebx
mov dword [0x4cd314], ebx
mov byte [0x4cd33c], bl
mov dword [0x4cd310], ebx
mov byte [0x4cd440], bl
mov dword [0x4cd2f8], ebx
mov dword [0x4cd308], eax
mov dword [0x4cd324], esi
mov dword [0x4cd328], ebx
mov dword [0x4cd548], ebx
mov dword [0x4cd54c], ebx
mov dword [0x4cd55c], ebx
mov dword [0x4cd560], ebx
mov dword [0x4cd2f0], ebx
call fcn.00450c76
push 0xa0
push ebx
mov dword [0x4cd558], 2
mov dword [0x4cd320], esi
mov dword [0x4cd604], ebx
mov dword [0x4cd610], ebx
mov dword [0x4cd32c], esi
mov dword [0x4cd330], ebx
mov dword [0x4cd334], ebx
mov dword [0x4cd338], 0x8000000
mov dword [0x4cd644], ebx
mov dword [0x4cd60c], 0x4000
mov dword [0x4cd618], ebx
mov byte [0x4cd64c], 1
mov dword [0x4cd650], ebx
mov dword [0x4cd654], ebx
mov dword [0x4cd658], ebx
mov dword [0x4cd668], ebx
mov dword [0x4cd66c], ebx
mov dword [0x4cd97c], ebx
mov byte [0x4cd670], bl
mov byte [0x4cd774], bl
mov byte [0x4cd878], bl
mov dword [0x4cd664], 0xa
mov dword [0x4cd980], ebx
mov dword [0x4cd61c], esi
mov dword [0x4cd65c], ebx
mov dword [0x4cd62c], ebx
mov dword [0x4cd638], ebx
mov dword [0x4cd63c], ebx
mov dword [0x4cd984], esi
mov dword [0x4cd620], esi
mov dword [0x4cd624], ebx
mov dword [0x4cd628], 0x78
mov dword [0x4cd634], ebx
push 0x4cd564
call fcn.00450230
add esp, 0x14
rdtsc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemInfo]
lea eax, [ebp - 8]
push eax
call fcn.0041e01e
imul eax, dword [ebp - 0x18]
pop esi
pop ebx
cmp eax, 0x7d0
jbe 0x41f337
mov dword [0x4cd290], 0x1000
leave
ret
Function at 0x41fe68
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push 0x100
push esi
call dword [sym.imp.___total_physical_size__lu_MB_GetFullPathNameA]
test eax, eax
je 0x41ff18
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x41febe
movsx eax, byte [esi]
push eax
lea eax, [ebp - 0x84]
push 0x469ef0
push eax
call fcn.00450c76
add esp, 0xc
jmp 0x41ff09
cmp byte [esi], 0x5c
jne 0x41ff18
cmp al, 0x5c
jne 0x41ff18
lea eax, [esi + 2]
push 0x5c
push eax
call fcn.00452670
pop ecx
pop ecx
test eax, eax
je 0x41ff18
inc eax
push 0x5c
push eax
call fcn.00452670
pop ecx
pop ecx
test eax, eax
je 0x41ff18
push edi
mov edi, eax
sub edi, esi
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.00451390
add esp, 0xc
mov byte [ebp + edi - 0x83], 0
pop edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDriveTypeA]
jmp 0x41ff1a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 4
Function at 0x41ffbd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x420120
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41ffe3
push ebx
push 0x5c
pop ebx
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00452730
pop ecx
pop ecx
test eax, eax
je 0x420008
mov byte [eax + 1], 0
push esi
lea esi, [ebp - 0x108]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420014
sub eax, edx
push edi
cmp eax, 1
jbe 0x420053
cmp byte [ebp - 0x108], 0x5c
jne 0x420064
cmp byte [ebp - 0x107], 0x5c
jne 0x42005c
xor edi, edi
push ebx
push esi
call fcn.00452670
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42011a
inc esi
inc edi
cmp edi, 4
jl 0x420037
jmp 0x42008e
cmp byte [ebp - 0x108], 0x5c
jne 0x420064
lea eax, [ebp - 0x107]
jmp 0x420082
cmp byte [ebp - 0x107], 0x3a
jne 0x42008e
cmp byte [ebp - 0x106], 0x5c
lea eax, [ebp - 0x106]
jne 0x420082
inc eax
cmp byte [eax], 0x5c
je 0x42007c
push ebx
push eax
call fcn.00452670
pop ecx
lea esi, [eax + 1]
pop ecx
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.00451260
add esp, 0xc
test esi, esi
je 0x42011a
mov edi, dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00450230
lea ecx, [ebp - 0x108]
mov eax, esi
sub eax, ecx
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00451260
add esp, 0x18
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateDirectoryA]
test eax, eax
jne 0x420109
call edi
mov ebx, eax
cmp ebx, 0xb7
jne 0x42012e
push 0x5c
inc esi
push esi
call fcn.00452670
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4200b3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450b32
leave
ret 4
lea eax, [ebp - 0x20c]
push eax
push str._nCant_create_directory:__s
call edi
push eax
push 0x523
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
push 5
pop eax
cmp ebx, eax
jne 0x420164
cmp dword [0x4cddc8], 0
jne 0x420164
mov dword [0x4cddc8], eax
xor eax, eax
jmp 0x42011d
Function at 0x420b7b
Capabilities:
Check if file exists

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x4cd314], ebx
jne 0x420b8b
xor eax, eax
inc eax
pop ebx
ret
mov ecx, dword [0x4cdfa8]
push esi
call fcn.00446224
mov esi, 0x4cd33c
mov ecx, dword [0x4cdfa8]
push ebx
push 1
push Ordinal_2
call fcn.00446269
push eax
push ebx
call fcn.00418796
test eax, eax
jns 0x420c02
cmp dword [0x4cd638], 1
jne 0x420c67
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
cmp eax, 2
jne 0x420c67
mov ecx, dword [0x4cdfa8]
call fcn.00446269
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x420be5
push esi
push str.Differential_backup_failed_because_the_hash_file__s_is_missing._Starting_a_full_backup
mov dword [0x4cd314], ebx
call fcn.0041c7ee
pop ecx
pop ecx
mov ecx, dword [0x4cdfa8]
call fcn.0044625e
push eax
call fcn.00418101
test eax, eax
jne 0x420c33
call fcn.00417370
mov ecx, dword [0x4cdfa8]
call fcn.00446229
test eax, eax
jne 0x420b9c
inc eax
pop esi
pop ebx
ret
cmp dword [0x4cddcc], ebx
je 0x420c57
push ebx
push 0x30
push str.Image_Name_Error
push str.The_names_of_the_differential_and_original_image_are_identical._nPlease_choose_a_different_image_name.
push 7
push dword [0x4d617c]
call fcn.0041ee88
jmp 0x420c62
push str.The_names_of_the_differential_and_original_image_are_identical._nPlease_choose_a_different_image_name.
call fcn.0041c7ee
pop ecx
call fcn.00417370
xor eax, eax
jmp 0x420c30

Function at 0x420c6b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
inc edi
cmp dword [ebx], edi
jle 0x420d20
push esi
mov eax, dword [ebp + 0xc]
push 7
lea esi, [eax + edi*4]
push str.__exec:
push dword [esi]
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x420cb4
push 7
push 0x46e8ec
push dword [esi]
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x420cc0
and dword [esi], 0
mov dword [ebx], edi
mov dword [ebp - 4], 1
inc edi
cmp edi, dword [ebx]
jl 0x420c84
cmp dword [ebp - 4], 0
je 0x420d1f
call dword [sym.imp.___total_physical_size__lu_MB_GetCommandLineA]
mov esi, eax
jmp 0x420cfe
push 7
push 0x46e8ec
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x420d03
push 7
push str.__exec:
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x420d03
inc esi
cmp byte [esi], 0
jne 0x420cd5
add esi, 7
push esi
push str.DIAG:execstring_is_____s_n
call fcn.00450f5c
push esi
call fcn.004503c5
add esp, 0xc
mov dword [0x4cd2cc], eax
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x421edb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapshot
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DriverPath
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x4222c2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.004430cb
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleHandleA]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleFileNameA]
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_FindFirstFileA]
mov esi, eax
call fcn.004430e1
cmp esi, 0xffffffff
je 0x422336
cmp dword [ebp - 0x228], 0x61a8d
ja 0x422336
push esi
call dword [sym.imp.___total_physical_size__lu_MB_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret
push 0
push 0x10
push 0x469ec0
push str._s_Virus_Warning
call fcn.0042f614
pop ecx
pop ecx
push eax
push str.www.drivesnapshot.de
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push str.The_file___s__seems_to_be_modified._nThis_may_be_due_to_a_virus._nThe_last_windows_error_was__x_nPlease_download_an_unmodified_version_from__s
call fcn.0042f614
add esp, 0x10
push eax
push 0x32
push dword [0x4d617c]
call fcn.0041ee88
push 1
call dword [sym.imp.___total_physical_size__lu_MB_ExitProcess]

Function at 0x422383
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x20000000
push 2
push 0
push 3
push 3
push dword [ebp + 8]
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4223ce
push dword [ebp + 8]
push 0x46e72c
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1391
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
push 1
call fcn.00451974
mov eax, dword [ebp + 0xc]
xor ecx, ecx
shld ecx, eax, 0x14
push 0
push ecx
shl eax, 0x14
push eax
push esi
call fcn.0044df99
push esi
call dword [sym.imp.___total_physical_size__lu_MB_SetEndOfFile]
push esi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
pop esi
pop ebp
ret 8
Function at 0x4223f7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.___total_physical_size__lu_MB_GetSystemTimeAsFileTime]
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
call ebx
mov eax, dword [ebp + 0x10]
xor edi, edi
neg eax
push edi
sbb eax, eax
and eax, 0x4000000
or eax, 0x20000000
push eax
push 2
push edi
push 3
push 3
push dword [ebp + 8]
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [0x4cce98], eax
cmp eax, 0xffffffff
jne 0x422463
push dword [ebp + 8]
push 0x46e72c
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x13b1
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
push 1
call fcn.00451974
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
push eax
call fcn.00455881
pop ecx
push 4
push 0x1000
mov esi, 0x200000
push esi
push edi
mov dword [ebp + 0x10], esi
call dword [sym.imp.___total_physical_size__lu_MB_VirtualAlloc]
push esi
push edi
push eax
mov dword [ebp - 8], eax
call fcn.00450230
add esp, 0xc
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x18], edi
call fcn.00451e7f
test eax, eax
jne 0x422532
cmp dword [ebp + 0xc], edi
je 0x4224ce
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0x10], edi
jbe 0x4224ce
call fcn.00455893
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4224b7
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [0x4cce98]
call dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
test eax, eax
mov eax, dword [ebp - 4]
je 0x4224f1
cmp eax, dword [ebp + 0x10]
je 0x4224f4
shr dword [ebp + 0x10], 1
add esi, eax
adc dword [ebp - 0x18], edi
push 0x3e8
lea eax, [ebp - 0x14]
push eax
call fcn.004430f8
test eax, eax
je 0x422527
push 0xc
push dword [ebp - 0x18]
push esi
call fcn.0040c6f5
push eax
push dword [ebp + 8]
push str._rwriting__s____s
call fcn.00450f5c
add esp, 0xc
cmp dword [ebp + 0x10], edi
jne 0x42249d
jmp 0x422542
push str.stopped_by_keypress_n
call fcn.00450f5c
pop ecx
call fcn.00451e03
add esi, dword [ebp - 4]
push dword [0x4cce98]
adc dword [ebp - 0x18], edi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
or dword [0x4cce98], 0xffffffff
push 0xc
push dword [ebp - 0x18]
push esi
call fcn.0040c6f5
push eax
push dword [ebp + 8]
push str._rwritten_to__s____s
call fcn.00450f5c
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call ebx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
sbb ecx, dword [ebp - 0x28]
push edi
push 0x2710
push ecx
push eax
call fcn.004544c0
push edx
mov ebx, eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
push esi
call fcn.004544c0
push edx
push eax
push dword [ebp - 0xc]
push ebx
push str._ntime_to_write___I64ums__rate___I64uKB_sec_n
call fcn.00450f5c
add esp, 0x14
push 0x8000
push edi
push dword [ebp - 8]
call dword [sym.imp.___total_physical_size__lu_MB_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
Function at 0x42267c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x110], edi
cmp eax, ebx
je 0x4226bb
push eax
lea eax, [ebp - 0x108]
push 0x469a48
push eax
call fcn.00450c76
add esp, 0xc
jmp 0x4226c0
call fcn.00422b8e
push 0x46c02c
lea eax, [ebp - 0x108]
push eax
call fcn.00442cad
push eax
call fcn.00421d63
mov esi, eax
cmp esi, ebx
jne 0x4226f7
lea eax, [ebp - 0x108]
push eax
push str.Cant_get_MBR_or_partition_info_from__s_n
call fcn.00450f5c
pop ecx
pop ecx
push 1
call fcn.00451974
push esi
call fcn.00436e08
test eax, eax
je 0x42270c
push str._nrestore_partition_structure_or_MBR_is_not_applicable_for_dynamic_disks_n
call fcn.0043c16a
pop ecx
mov dword [ebp - 0x10c], 1
cmp dword [ebp + 0x10], ebx
jne 0x422721
push esi
call fcn.004372c4
cmp dword [0x4cdddc], ebx
jne 0x422741
lea eax, [edi + 1]
push eax
push str._ndo_you_really_want_to_overwrite_HD_u__
call fcn.0043c117
pop ecx
pop ecx
test eax, eax
je 0x4227e2
push 0x46a57c
call fcn.00450f5c
pop ecx
push dword [0x4cd620]
push dword [ebp + 0x10]
push esi
push edi
push 0x469d6c
call fcn.0042f614
pop ecx
pop ecx
push eax
call fcn.004373e1
mov dword [ebp - 0x10c], eax
cmp eax, ebx
jne 0x4227e2
cmp dword [ebp + 0x10], ebx
je 0x422785
push str.MBR_successfully_restored__n
call fcn.00450f5c
pop ecx
jmp 0x4227e2
call fcn.0040c699
test eax, eax
jne 0x4227d5
push ebx
push 5
call fcn.0044dfdf
test eax, eax
je 0x4227d5
push 0xffffffffffffffff
call fcn.00411431
mov esi, dword [sym.imp.___total_physical_size__lu_MB_GetLogicalDrives]
call esi
cmp eax, ebx
je 0x4227c6
inc ebx
cmp ebx, 0xf
jae 0x4227c6
push 0x3e8
mov edi, eax
call dword [sym.imp.___total_physical_size__lu_MB_Sleep]
call esi
cmp edi, eax
jne 0x4227ad
push 0xffffffffffffffff
call fcn.00411431
mov edi, dword [ebp - 0x110]
jmp 0x4227db
push edi
call fcn.00411431
push edi
push eax
call fcn.0040eedb
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0xc