joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fe72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000fd62
test eax, eax
jne 0x1000ffb2
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x53abfd8]
push dword [esi + 0x53abfdc]
mov dword [ebp - 8], edi
call fcn.100164cd
push edi
mov dword [ebp - 4], eax
call fcn.100164cd
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000ffa3
test edi, edi
je 0x1000ff9a
push edi
push ebx
call dword [esi + 0x53ac02c]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000ff78
cmp dword [esi + 0x53abfdc], eax
jbe 0x1000fefe
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x53abfdc]
jb 0x1000fee3
push ebx
call dword [esi + 0x53ac024]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000ff78
push dword [esi + 0x53abfdc]
push dword [ebp - 4]
push ebx
call dword [esi + 0x53ac028]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000ff78
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x53ac028]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000ff78
push dword [ebp - 4]
push ebx
call dword [esi + 0x53ac02c]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000ff78
cmp dword [ebp - 8], ecx
jbe 0x1000ff71
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000ff71
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000ff5a
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.100163f0
push dword [ebp - 0xc]
call fcn.100163f0
push dword [ebp - 4]
call fcn.100163f0
add esp, 0xc
mov eax, edi
jmp 0x1000ffb1
push dword [ebp - 4]
call fcn.100163f0
pop ecx
test edi, edi
je 0x1000ffae
push edi
call fcn.100163f0
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000ffb5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000fd62
test eax, eax
jne 0x1000fff0
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x53abfd8]
push dword [esi + 0x53abfdc]
mov dword [ebp - 4], eax
call fcn.100164cd
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000fff3
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x53abfdc]
call fcn.100164cd
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x10010019
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.100163f0
pop ecx
mov eax, ebx
jmp 0x1000ffef
mov ecx, dword [esi + 0x53abfdc]
cmp ecx, 0x10
jae 0x10010061
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x53a9f80
mov eax, ebx
call fcn.1000f078
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100100e1
mov eax, dword [esi + 0x53abfdc]
cmp dword [ebp - 4], eax
jae 0x10010091
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x10010089
push 0x10
push 0x53a9f80
push eax
call fcn.1001ced0
mov eax, dword [esi + 0x53abfdc]
add esp, 0xc
cmp eax, 0x10
jbe 0x10010091
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000fd2f
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x53abfdc], eax
jbe 0x100100b6
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x53abfdc]
jb 0x1001009b
push edi
call dword [esi + 0x53ac024]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100100e1
push dword [esi + 0x53abfdc]
push dword [ebp - 8]
push edi
call dword [esi + 0x53ac028]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1001000c
push dword [edi + 0xe8]
call fcn.100163f0
pop ecx
jmp 0x1001000c
Function at 0x404f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5b84
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push 0x20
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049109a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x404fff
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x44]
call fcn.00404dc0
push eax
mov byte [ebp - 4], 4
call fcn.00439bf0
int3

Function at 0x406ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5df0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.00468790
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x406f34
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x406f45
push 0x48
push esi
call fcn.0049143c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5df0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xb4]
mov dword [esi], vtable.CryptoPP::AuthenticatedDecryptionFilter.0
mov dword [esi + 4], vtable.CryptoPP::AuthenticatedDecryptionFilter.1.0
call fcn.00406fc0
lea ecx, [esi + 0x4c]
call fcn.004070d0
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.00468790
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x407254
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408ae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d616a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x18], esi
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], 0
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov dword [ebp - 0x2c], edi
mov eax, dword [edi + 0xc]
test al, 1
jne 0x408ba1
or eax, 1
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 1
call fcn.004797d0
mov ecx, eax
mov dword [edi + 0x139c], 0xffffffff
mov dword [edi + 0x1c], ecx
lea esi, [edi + 0x20]
mov edx, 1
nop dword [eax]
mov eax, ecx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [esi - 4], ecx
cmp edx, 0x270
jl 0x408b70
mov eax, dword [edi + 0xc]
mov esi, dword [ebp - 0x18]
mov dword [edi + 0x18], 0x270
test al, 2
jne 0x408bc2
or eax, 2
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x14], 0x32
xor eax, eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov dword [ebp - 4], eax
mov ecx, ebx
push esi
mov dword [ebp - 0x24], 1
call fcn.004316e0
test esi, esi
je 0x408c94
lea ecx, [edi + 0x18]
mov dword [ebp - 0x28], ecx
nop dword [eax + eax]
mov eax, dword [edi + 0x10]
dec esi
mov dword [ebp - 0x18], esi
mov esi, dword [edi + 0x14]
sub esi, eax
mov dword [ebp - 0x14], eax
cmp esi, 0xffffffff
jne 0x408c23
call fcn.00440880
mov edx, eax
jmp 0x408c6c
lea ebx, [esi + 1]
mov dword [ebp - 0x20], ebx
jmp 0x408c33
lea ebx, [esi + 1]
xor edi, edi
xor eax, eax
test esi, esi
je 0x408c45
call fcn.00440880
mov edi, eax
or eax, 0xffffffff
xor edx, edx
div ebx
mov ecx, eax
mov ebx, edx
xor edx, edx
mov eax, edi
div dword [ebp - 0x20]
cmp eax, ecx
jb 0x408c5f
mov ecx, dword [ebp - 0x28]
cmp ebx, esi
jne 0x408c30
mov ebx, dword [ebp - 0x1c]
mov eax, edi
mov edi, dword [ebp - 0x2c]
xor edx, edx
div dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
movsx ax, byte [edx + eax + str.0123456789abcdefghijklmnopqrstuvwxyzABCDFGHIJKLMNOPQRSTUVWXYZ]
movzx eax, ax
push eax
call fcn.00437160
mov esi, dword [ebp - 0x18]
lea ecx, [edi + 0x18]
test esi, esi
jne 0x408c00
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x408c9e
mov ecx, dword [ebx]
mov esi, ebx
jb 0x408ca4
mov esi, dword [ebx]
mov eax, dword [ebx + 0x10]
lea eax, [esi + eax*2]
mov esi, ebx
jb 0x408cb0
mov esi, dword [ebx]
mov ebx, eax
xor edx, edx
sub ebx, esi
xor edi, edi
inc ebx
shr ebx, 1
cmp esi, eax
cmova ebx, edx
test ebx, ebx
je 0x408cec
sub ecx, esi
mov dword [ebp - 0x14], ecx
nop dword [eax]
movzx eax, word [esi]
push eax
call fcn.004b1d48
mov ecx, dword [ebp - 0x14]
lea esi, [esi + 2]
inc edi
add esp, 4
mov word [ecx + esi - 2], ax
cmp edi, ebx
jne 0x408cd0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
Function at 0x413d50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d72b2
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x104
mov dword [ebp - 0x23c], esi
push eax
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413dd0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00437430
mov dword [ebp - 4], 0
xor eax, eax
mov ecx, 1
mov word [ebp - 0x234], ax
cmp dword [esi + 0x10], ecx
mov eax, esi
mov dword [ebp - 0x21c], 1
cmovb ecx, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
jb 0x413e32
mov eax, dword [esi]
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00437430
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.004319a0
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x413e89
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413e7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413ea5
push edx
push ecx
call fcn.0049143c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.004b5942
int3
Function at 0x413eb0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d72f6
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x101
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov dword [ebp - 0x21c], 0
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 7
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413f20
sub eax, edx
lea ecx, [ebp - 0x22c]
sar eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00437430
mov dword [ebp - 4], 0
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 8
mov ecx, 0x51fc48
push dword [ebp - 0x21c]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.00437430
cmp dword [ebp - 0x218], 8
lea ecx, [ebp - 0x22c]
mov eax, dword [ebp - 0x21c]
cmovae ecx, dword [ebp - 0x22c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x22c]
cmovae ecx, dword [ebp - 0x22c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x248]
call fcn.0043ace0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 0x10
mov ecx, 0x520070
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.00431fd0
mov edx, dword [ebp - 0x234]
cmp edx, 0x10
jb 0x414005
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413ffb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414075
push edx
push ecx
call fcn.0049143c
add esp, 8
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
cmp edx, 8
jb 0x41405c
mov ecx, dword [ebp - 0x22c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414052
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414075
push edx
push ecx
call fcn.0049143c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.004b5942
int3
Function at 0x414be0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x78
mov eax, dword [0x51f164]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
mov esi, ecx
mov dword [esp + 0x34], 0x40
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], esi
push eax
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
call fcn.00491cf0
xorps xmm1, xmm1
sub esp, 8
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x505698]
mulss xmm1, xmm0
mulss xmm1, xmm0
mulss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push 0x4f8208
movsd qword [esp + 0x3c], xmm0
call fcn.00402120
add esp, 0xc
mov dword [esi + 0x10], 0
mov edi, eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov byte [esi], 0
push 0
push edi
call fcn.00437680
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x414c80
mov eax, dword [esi]
movsd xmm0, qword [esp + 0x30]
lea ecx, [edi + 1]
sub esp, 8
movsd qword [esp], xmm0
push 0x4f8208
push ecx
push eax
call fcn.004020c0
mov ecx, dword [esp + 0x90]
add esp, 0x14
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret

Function at 0x414cc0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d74a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
xor edi, edi
push 2
push edi
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x414d41
cmp ebx, 0xea
je 0x414d41
mov ecx, dword [ebp - 0x24]
jmp 0x414dbb
mov ecx, dword [ebp - 0x24]
mov esi, ecx
test esi, esi
je 0x414dcf
xor ebx, ebx
cmp ebx, dword [ebp - 0x18]
jae 0x414db8
test esi, esi
je 0x414db8
mov dword [ebp - 4], 0
mov edx, dword [esi]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414d70
sub eax, dword [ebp - 0x30]
sar eax, 1
push eax
lea eax, [ebx + ebx*2]
push edx
lea ecx, [eax*8 + 0x5296c0]
call fcn.00437430
inc edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
add esi, 4
mov dword [ebp - 0x2c], edi
inc ebx
jmp 0x414d50
mov ebx, dword [ebp - 0x28]
test ecx, ecx
je 0x414dcf
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
push ecx
call esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
jmp 0x414dd5
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp ebx, 0xea
je 0x414dd5
test ecx, ecx
je 0x414de4
push ecx
call esi
push 7
lea eax, [edi + edi*2]
push 0x4ffa38
lea ecx, [eax*8 + 0x5296c0]
call fcn.00437430
lea eax, [edi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
Function at 0x4160e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7688
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
lea eax, [edx + edx*2]
cmp dword [eax*8 + 0x51fde4], 8
lea edx, [eax*8 + 0x51fdd0]
mov ecx, edx
jb 0x41612f
mov ecx, dword [edx]
mov eax, dword [edx + 0x10]
lea eax, [ecx + eax*2]
jb 0x416139
mov edx, dword [edx]
push ecx
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.0043ace0
push 0x4fab14
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00432110
cmp dword [ebp - 0x24], 0x10
lea ebx, [ebp - 0x38]
cmovae ebx, dword [ebp - 0x38]
push ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathA]
test eax, eax
setne byte [ebp - 0x39]
test ebx, ebx
je 0x4161bf
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416180
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x4161bf
lea eax, [ebx + ebx]
call fcn.00491e60
mov esi, esp
test esi, esi
je 0x4161bf
push ebx
push esi
push 0xffffffffffffffff
push dword [ebp - 0x40]
xor eax, eax
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x4161c1
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x18]
test eax, eax
mov edx, dword [ebp - 0x14]
mov eax, ecx
setne bl
or eax, edx
je 0x41621e
test edx, edx
jl 0x41621e
jg 0x4161ed
test ecx, ecx
jb 0x41621e
test bl, bl
je 0x41621e
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov esi, dword [ebp - 0x1c]
mov bl, byte [ebp - 0x39]
sbb edx, esi
test bl, bl
jne 0x416214
mov ebx, dword [ebp - 0x44]
add dword [ebx], eax
mov eax, dword [ebp - 0x48]
adc dword [ebx + 4], esi
add dword [eax], ecx
adc dword [eax + 4], edx
jmp 0x41621e
cmp bl, 1
jne 0x41621e
add dword [edi], ecx
adc dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
cmp edx, 0x10
jb 0x41624e
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x416244
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41626d
push edx
push ecx
call fcn.0049143c
add esp, 8
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.004b5942
int3
Function at 0x41e140
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8631
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], edi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
push 0x104
mov dword [ebp - 0x1c], 1
call fcn.0049144a
mov esi, eax
mov dword [ebp - 0x14], eax
add esp, 4
test esi, esi
je 0x41e1d1
push 0x104
push 0
push esi
call fcn.004a9190
add esp, 0xc
jmp 0x41e1d6
xor esi, esi
mov dword [ebp - 0x14], esi
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebp - 0x14]
xor esi, esi
nop word [eax + eax]
mov al, byte [esi + ecx]
test al, al
je 0x41e2a2
mov byte [ebp - 0x18], al
movzx eax, byte [esi + ecx + 1]
mov byte [ebp - 0x17], al
movzx eax, byte [esi + ecx + 2]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x18]
push 3
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.00431fd0
mov dword [ebp - 4], 1
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x41e25d
movups xmm0, xmmword [ebp - 0x34]
mov byte [ebp - 0x34], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
mov eax, 0xf
add dword [edi + 4], 0x18
jmp 0x41e26c
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, edi
call fcn.0043bc30
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x41e29f
mov ecx, dword [ebp - 0x34]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e295
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e2d4
push edx
push ecx
call fcn.0049143c
add esp, 8
mov ecx, dword [ebp - 0x14]
add esi, 4
cmp esi, 0x64
jl 0x41e1f0
push ecx
call fcn.00490dcc
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.004b5942
int3