joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6755d4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x675718
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.0063ed80
cmp ebx, eax
jl 0x675632
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x8c24d8]
call fcn.00410254
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41d20c]
call fcn.0042b008
call fcn.00409e94
mov eax, dword [esi + 0x30]
mov edx, ebx
call fcn.0063ed68
mov ebx, eax
movzx eax, byte [ebx + 0x6a]
sub al, 2
jne 0x675657
mov dl, 1
mov eax, dword [0x6354d0]
call fcn.00637f20
call fcn.00409e94
cmp byte [ebx + 0x6a], 1
jne 0x6756ad
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x675673
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x67567c
mov al, 1
jmp 0x675698
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00672e4c
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x675692
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x6756ad
mov dl, 1
mov eax, dword [0x6354d0]
call fcn.00637f20
call fcn.00409e94
mov eax, dword [ebx + 0xac]
shl eax, 9
cdq
push edx
push eax
mov eax, dword [ebx + 0xa0]
mov edx, dword [ebx + 0xa4]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [esi + 4]
call fcn.004a2200
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x6756e8
cmp eax, 0
je 0x6756fd
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004a26f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67571f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x67da3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x67da55
add esp, 0xfffffff0
call fcn.0040906c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x67dae6
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00424148
mov ecx, dword [ebp - 8]
lea eax, [esi + 0x10]
mov edx, 0x67db18
call fcn.0040ba64
lea eax, [esi + 0x33]
call fcn.0040a790
lea eax, [esi + 0xc]
mov edx, dword [ebp - 4]
call fcn.0040ab70
xor eax, eax
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x37], 0
mov byte [esi + 0x30], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67daed
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret
Function at 0x67fa94
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x67faed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004253d8
test al, al
jne 0x67fad7
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004253d8
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67faf4
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x682634
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x682659
test eax, 0x10
ja 0x682659
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x6aafc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6ab037
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x6ab006
push 0
movzx ecx, word [0x6ab044]
mov dl, 3
mov eax, 0x6ab054
call fcn.00660fe8
cmp eax, 6
jne 0x6ab021
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push 0x6ab068
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ab03e
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x6bdd10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x40
lea eax, [ebp - 4]
push eax
push esi
mov edi, dword [ebx + 4]
mov eax, edi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [edi + 4]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6bef98
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x50]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 1], dl
lea eax, [ebp - 0x50]
mov edx, dword [0x6bee3c]
call fcn.0040c374
xor eax, eax
push ebp
push 0x6bf077
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp - 0x48], 0
je 0x6bf05b
cmp byte [ebp - 0x2b], 0
je 0x6bf05b
lea eax, [ebp - 0x10]
push eax
push 0x40
xor eax, eax
mov al, byte [ebp - 0x2b]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_VirtualProtect
cmp byte [ebp - 1], 0
je 0x6bf01e
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x6bf044
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x2b]
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
xor eax, eax
mov al, byte [ebp - 0x2b]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bf07e
lea eax, [ebp - 0x50]
mov edx, dword [0x6bee3c]
call fcn.0040c1e0
ret
Function at 0x6c347c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6c352e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp byte [ebx + 4], 0
je 0x6c3518
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
jne 0x6c34cb
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
jmp 0x6c3518
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov edi, eax
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
test edi, edi
je 0x6c3512
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
push edi
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3535
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x6c3eac
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6c3f72
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
cmp byte [ebx + 4], 0
je 0x6c3f5c
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
jne 0x6c3efb
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
jmp 0x6c3f5c
push 5
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov edi, eax
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
test edi, edi
je 0x6c3f4f
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6c3f38
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
jmp 0x6c3f47
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 9], eax
mov dword [ebp - 8], 0xfffffffd
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x6c3f56
mov dword [ebp - 8], 0xfffffffe
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3f79
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x6c9754
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a874
mov eax, dword [ebp - 8]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6c97b9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.0040b7f8
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c97c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret

Function at 0x6cecb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6ced09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6ceced
test al, 0x10
jne 0x6cecf1
xor ebx, ebx
jmp 0x6cecf3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ced10
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x6f42cc
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov eax, dword [0x8c2890]
cmp dword [eax], 1
jne 0x6f43be
push 0x6f446c
push 0x6f449c
call sub.user32.dll_FindWindowW
test eax, eax
je 0x6f42ff
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x6f4460
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00407f88
mov dword [ebp - 0x54], 0x44
mov eax, dword [0x8bcc70]
call fcn.004070f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6f43b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x8bcc70]
push eax
push 0
push 0x6f44bc
push 0
call sub.KERNEL32.DLL_SearchPathW
test eax, eax
jne 0x6f435a
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f43a1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x6f438a
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f43a1
mov eax, dword [ebp - 0x64]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f4460
mov eax, dword [ebp - 8]
call fcn.00407110
ret
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x6f43dc
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f4460
push 0x14
push 0x6f44d4
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jne 0x6f43ff
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f4460
lea eax, [ebp - 0x80]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x6f441d
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f4460
cmp dword [ebp - 0x7c], 4
jne 0x6f4430
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x6f4460
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x6f4455
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebp - 4], eax
jmp 0x6f4460
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x73479c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7347f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0040b7f8
push eax
mov eax, ebx
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7347fe
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x73e554
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a790
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x73e585
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a918
add esp, 0x24
pop ebx
ret

Function at 0x75dcc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx esi, word [edx]
add esi, esi
movzx edi, cl
shr edi, 7
or si, di
mov word [edx], si
test bl, bl
je 0x75dced
xor word [edx], 0x1021
add ecx, ecx
and cl, 0xff
dec eax
jne 0x75dccc
pop edi
pop esi
pop ebx
ret
Function at 0x7948c4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x794a76
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x794a20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xe42
call fcn.00407638
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
fstp xword [ebp - 0x38]
wait
call fcn.00428164
fld xword [ebp - 0x38]
fsubp st(1)
fstp xword [ebp - 0x38]
wait
mov eax, 0x64
call fcn.00407638
inc eax
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
fld1
fdivrp st(1)
fld xword [ebp - 0x38]
faddp st(1)
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.00428034
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_SystemTimeToFileTime
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push ebp
push 0x794a0f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0xc0000100
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_CreateFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x7949c6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
je 0x7949bb
mov edx, dword [ebp - 4]
mov eax, 0x794a90
call fcn.0079476c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FlushFileBuffers
jmp 0x7949f2
call sub.KERNEL32.DLL_GetLastError_2
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00424148
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x794ac0
call fcn.0040ba64
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 4]
call fcn.0079476c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x794a16
cmp dword [ebp - 8], 0xffffffff
je 0x794a0e
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
Function at 0x794b48
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x794cfd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x794ca7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xe42
call fcn.00407638
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
fstp xword [ebp - 0x38]
wait
call fcn.00428164
fld xword [ebp - 0x38]
fsubp st(1)
fstp xword [ebp - 0x38]
wait
mov eax, 0x64
call fcn.00407638
inc eax
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
fld1
fdivrp st(1)
fld xword [ebp - 0x38]
faddp st(1)
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.00428034
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_SystemTimeToFileTime
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push ebp
push 0x794c96
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x2000000
push 3
push 0
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_CreateFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x794c4d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
je 0x794c42
mov edx, dword [ebp - 4]
mov eax, 0x794d18
call fcn.0079476c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FlushFileBuffers
jmp 0x794c79
call sub.KERNEL32.DLL_GetLastError_2
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00424148
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x794d44
call fcn.0040ba64
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 4]
call fcn.0079476c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x794c9d
cmp dword [ebp - 8], 0xffffffff
je 0x794c95
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
Function at 0x794f64
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x795048
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x20
push 0
push 0x100000
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.0040cba4
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x794fa9
cmp dword [ebp + 8], 1
jb 0x794fb0
jmp 0x794fab
jl 0x794fb0
mov ebx, 0x40
cmp dword [ebp + 0xc], 0
jne 0x794fbe
cmp dword [ebp + 8], 5
jb 0x794fc5
jmp 0x794fc0
jl 0x794fc5
mov ebx, 0x80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
mov ecx, 3
mov edx, 1
call fcn.0040bc34
mov eax, dword [ebp - 0x14]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
test eax, eax
je 0x795032
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
shr ecx, 0xa
cmp ecx, 0x40
jbe 0x795014
mov ecx, 0x40
mov eax, ebx
cdq
push edx
push eax
mov eax, ecx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x79502c
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x795032
jmp 0x795030
pop edx
pop eax
jle 0x795032
mov ebx, ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79504f
lea eax, [ebp - 0x14]
call fcn.0040a790
ret
Function at 0x795c1c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x795da2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x795d44
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov dl, 1
mov eax, dword [0x794628]
call fcn.00797ad4
mov dword [ebp - 4], eax
mov ebx, 0x4000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 3
mov edx, 1
call fcn.0040bc34
mov eax, dword [ebp - 0x24]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
test eax, eax
je 0x795ccf
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
cmp ebx, 0xc800
jle 0x795cc2
mov ebx, 0xc800
cmp ebx, 0x800
jge 0x795ccf
mov ebx, 0x800
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
call fcn.0040cc84
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
cdq
sub eax, dword [ebp - 0x20]
sbb edx, dword [ebp - 0x1c]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.004a226c
xor eax, eax
push ebp
push 0x795d30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_FlushFileBuffers
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x795d3a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x795d7a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], edx
call fcn.00408ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x795da9
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040a7f0
ret