joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431600
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
call fcn.0042b175
cmp dword [0x50a0e0], 0x10
je 0x4317fd
push edi
xor edi, edi
cmp dword [0x509b3c], edi
je 0x43162c
push edi
call fcn.00428654
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.CFGMGR32.dll_CM_Enumerate_Classes]
test eax, eax
jne 0x4317e9
push ebx
push esi
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4a1ae0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassImageIndex]
test eax, eax
je 0x4317ce
mov eax, dword [0x4a1b08]
add dword [ebp - 8], eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], edi
call fcn.00427a21
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x290]
push str.SYSTEMCurrentControlSetControlClass_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
lea eax, [ebp - 0x3c]
push eax
push str.NoDisplayClass
lea eax, [ebp - 0x290]
push eax
mov esi, 0x80000002
push esi
call fcn.0042805e
test eax, eax
je 0x4316ce
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
test eax, eax
jg 0x4317ce
push 0x100
lea eax, [ebp - 0x490]
push eax
push 0x4744c8
lea eax, [ebp - 0x290]
push eax
push esi
call fcn.0042805e
test eax, eax
je 0x43179d
push 0x2c
push edi
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, edi
je 0x43179d
lea eax, [esi + 2]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push eax
call fcn.004479b0
mov ebx, eax
xor eax, eax
mov word [esi], ax
mov dword [esp], 0x104
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 2
push edi
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43178f
push 0
push dword [ebp + 8]
movzx eax, bx
push dword [ebp + 8]
push 1
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
test esi, esi
je 0x43178f
push esi
push dword [ebp - 8]
push dword [0x50a1a0]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
cmp dword [ebp - 4], edi
jne 0x4317ce
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiLoadClassIcon]
test eax, eax
je 0x4317ce
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x50a1a0]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyIcon]
inc dword [ebp - 0xc]
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.CFGMGR32.dll_CM_Enumerate_Classes]
test eax, eax
je 0x431645
pop esi
pop ebx
cmp dword [0x509b3c], edi
je 0x4317f7
push edi
call fcn.00428654
call fcn.0042b175
pop edi
leave
ret 4
Function at 0x433047
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x204
lea eax, [ebp - 0x204]
push 0
push eax
mov dword [ebp - 0x208], 0x2d
call fcn.004476fd
add esp, 0xc
cmp dword [ebp + 8], 0x8000
jne 0x4330c4
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0xc]
push str.DBT_DEVTYP_PORT_arrived_port_s_kn_s
push 1
call fcn.0044d31e
mov ax, word [ebp - 0x208]
sub ax, 0x2d
movzx eax, ax
add esp, 0x10
neg eax
sbb eax, eax
lea ecx, [ebp - 0x208]
and eax, ecx
push eax
jmp 0x4330d8
push dword [ebp + 0xc]
push str.DBT_DEVTYP_PORT_removed_port_s
push 1
call fcn.0044d31e
add esp, 0xc
push 0
push dword [ebp + 0xc]
mov ecx, dword [0x50c78c]
call fcn.0040556c
leave
ret 8
Function at 0x434813
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
call fcn.00427c56
test eax, eax
jne 0x434850
push 0x10
push 0x456428
push str.File_not_found
push dword [0x50a13c]
call fcn.0044e971
mov dword [0x50aa90], 1
xor eax, eax
jmp 0x434a74
mov eax, dword [0x50c800]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x434869
push eax
call fcn.0044786c
pop ecx
mov dword [0x50c800], ebx
push 0x50c800
push dword [ebp + 8]
call fcn.0042be16
cmp eax, 0x64
jge 0x43489a
mov eax, dword [0x50c800]
cmp eax, ebx
je 0x434a71
push eax
call fcn.0044786c
pop ecx
mov dword [0x50c800], ebx
jmp 0x434a71
push str.Report
push ebx
push 0x7f02
call fcn.0043401d
push dword [0x50a154]
mov dword [0x50a0e8], 1
call fcn.00433347
push dword [0x50a15c]
call fcn.00433347
push dword [0x50a144]
push dword [0x50c800]
call fcn.0044eb4a
test eax, eax
je 0x434a6b
push esi
push edi
xor eax, eax
push 0x3fe
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x406]
push ebx
push eax
call fcn.004476fd
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x408]
push eax
push dword [0x50a13c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x434971
mov esi, 0x454650
push esi
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
je 0x43493b
xor ecx, ecx
mov word [eax], cx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x408]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 0x408]
push eax
push dword [0x50a13c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x50c7e8]
mov esi, dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
cmp eax, ebx
je 0x434983
push eax
call esi
mov eax, dword [0x50c7ec]
mov dword [0x50c7e8], ebx
cmp eax, ebx
je 0x434995
push eax
call esi
mov ecx, dword [0x50c78c]
mov dword [0x50c7ec], ebx
call fcn.00405261
mov ecx, dword [0x50c788]
call fcn.00407db0
mov ecx, dword [0x50c784]
call fcn.0040ddfd
mov ecx, dword [0x50c790]
call fcn.0044515e
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push ebx
push dword [0x50a13c]
call esi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call edi
push 2
push dword [0x50a13c]
mov dword [ebp - 8], eax
call esi
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x9cae
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
xor edi, edi
push 0x401
push edi
push dword [ebp - 4]
call esi
inc edi
cmp edi, 0xe
jl 0x434a06
push dword [0x5099b4]
push dword [0x509c3c]
push dword [0x50a018]
push dword [0x509410]
push str.Host_Controllers:__i____Root_Hubs:__i____Standard_Hubs:__i____Peripheral_Devices:__i
push ebx
push ebx
push dword [0x50aab4]
call fcn.00405e29
add esp, 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x45cb10
push ebx
push 1
push dword [0x50aab4]
call fcn.00405e29
add esp, 0x14
xor eax, eax
pop edi
inc eax
pop esi
jmp 0x434a73
mov dword [0x50a0e8], ebx
xor eax, eax
pop ebx
leave
ret 4
Function at 0x439b21
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x5168ac], 4
push edi
mov edi, dword [ebp + 0xc]
jl 0x439b8d
lea eax, [esi + 0xd0e]
cmp word [eax], bx
jne 0x439b4c
lea eax, [esi + 0xd64]
mov ecx, edi
cmp edi, ebx
jne 0x439b57
mov ecx, 0x451d1c
push eax
push ecx
push dword [esi + 0x824]
push esi
push str.ChangeLeaf_0x_08Ix__name_s__text_s______s
push 4
call fcn.0044d31e
add esp, 0x18
push dword [esi + 8]
push dword [0x50a144]
call fcn.00435254
push eax
push str._currenttext_s
push 4
call fcn.0044d31e
add esp, 0xc
push dword [esi + 8]
push dword [0x50a144]
call fcn.00429893
test eax, eax
jne 0x439bb9
cmp dword [0x5168ac], 4
jl 0x439c86
push dword [esi + 8]
push str._0x_08Ix_is_not_a_tree_item____abort
jmp 0x439c7c
push 0x34
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.004476fd
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
add esp, 0xc
cmp edi, ebx
setne al
push esi
mov dword [ebp - 0x28], edi
or eax, 0x22
mov dword [ebp - 0x38], eax
call fcn.00439387
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0x113f
push dword [0x50a144]
mov dword [0x50a10c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x439c67
push dword [0x50a144]
mov dword [0x50a10c], ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x50aaa8]
jne 0x439c62
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x515e34]
cmp eax, 0xbb8
jae 0x439c56
push 0x416e83
push 0xa
push 0x12340005
push dword [0x50a13c]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x439c5b
call fcn.00416cab
call esi
mov dword [0x515e34], eax
xor eax, eax
inc eax
jmp 0x439c88
cmp dword [0x5168ac], 4
jl 0x439c86
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TreeView_SetItem_err_u
push 4
call fcn.0044d31e
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x439f94
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0043401d
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push edi
push eax
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push edi
push eax
call fcn.004476fd
add esp, 0x24
push 0x5097a8
mov esi, 0x104
push esi
lea eax, [ebp - 0x410]
push eax
push 0x452148
mov ebx, str.ReportPath
push ebx
mov edi, 0x456480
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00429278
test eax, eax
je 0x43a09c
lea eax, [ebp - 0x208]
push eax
call fcn.00434813
mov esi, eax
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.0042bed8
push 0x5097a8
lea eax, [ebp - 0x208]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0043401d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x43a084
Function at 0x43cc50
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0043401d
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.004476fd
push 0x5094a0
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x5097a8
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x452148
mov ebx, str.ReportPath
push ebx
mov edi, 0x456480
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00429104
test eax, eax
je 0x43cd7a
push dword [0x50a13c]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x20c]
push eax
call fcn.0043cba1
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x43cd7a
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x43cd7a
xor ecx, ecx
push 0x5097a8
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0043401d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43cd93
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0043401d
push dword [0x50aaa8]
call fcn.00433f11
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x43cddd
push 0x40
push 0x456428
push str.No_device_selected
push dword [0x50a13c]
call fcn.0044e971
jmp 0x43cfbc
push ebx
push esi
xor eax, eax
push 0x7fe
mov word [ebp - 0xc18], ax
lea eax, [ebp - 0xc16]
push edi
push eax
call fcn.004476fd
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.004476fd
add esp, 0x24
push 0x5097a8
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x452148
push str.DevReportPath
mov ebx, 0x456480
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x418], di
je 0x43ce84
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.00427a8d
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xfd0]
cmp eax, edi
je 0x43cea5
lea ecx, [eax + 0x1738]
cmp word [ecx], di
jne 0x43cea2
lea ecx, [eax + 0x1838]
push ecx
jmp 0x43ceab
push dword [ecx + 0x824]
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x20
lea eax, [ebp - 0xc18]
push eax
call fcn.00429950
push str..txt
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xc18]
push eax
call fcn.00429104
test eax, eax
je 0x43cfaa
cmp dword [0x50a0e8], edi
jne 0x43cf0c
push edi
push fcn.00416b69
push dword [0x50aaa8]
call fcn.00433bd7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [0x50aaa8]
mov dword [ebp - 4], edi
call fcn.0043a8e1
mov esi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00447831
pop ecx
push edi
xor ecx, ecx
mov dword [0x50c808], eax
mov word [eax], cx
push 0x43474d
push dword [0x50aaa8]
mov dword [0x50c80c], esi
call fcn.00433bd7
lea eax, [ebp - 0xc18]
push eax
call fcn.0040ee4a
push dword [0x50c808]
call fcn.0044786c
pop ecx
lea eax, [ebp - 0xc18]
push eax
mov dword [0x50c808], edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
je 0x43cfaa
xor ecx, ecx
push 0x5097a8
mov word [eax], cx
lea eax, [ebp - 0xc18]
push eax
push str.DevReportPath
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push edi
push 0x7f00
call fcn.0043401d
pop esi
pop ebx
pop edi
leave
ret
Function at 0x43d173
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0043401d
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.004476fd
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.004476fd
push 0x5094a0
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x5097a8
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x452148
mov ebx, str.ReportPath
push ebx
mov edi, 0x456480
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004291be
test eax, eax
je 0x43d2b3
push dword [0x50a13c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0040ec24
push 0
call fcn.0040ec62
lea eax, [ebp - 0x20c]
push eax
call fcn.0043cfbf
mov dword [ebp - 4], eax
call fcn.0040eca2
call fcn.0040ec43
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x43d2b3
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x43d2b3
xor ecx, ecx
push 0x5097a8
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0043401d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x444896
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
push ebx
push dword [ebp + 8]
push str.GetDiskFreeSpaceExTimeout__s___u_
push 3
call fcn.0044d31e
push 0x228
call fcn.00447831
mov esi, eax
add esp, 0x14
push dword [ebp + 8]
xor edi, edi
push esi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
mov dword [esi + 0x214], edi
mov dword [esi + 0x218], edi
mov dword [esi + 0x21c], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x4446f1
push edi
mov dword [esi + 0x224], ebx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x444920
push esi
call fcn.0044786c
pop ecx
jmp 0x444a13
push ebx
push dword [ebp - 4]
push str.thread_GetDiskFreeSpaceEx_ThreadProc_created_ThreadId_04u_wait_i
push 3
call fcn.0044d31e
add esp, 0x10
call fcn.0042b175
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
call fcn.0042b175
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
push edx
push eax
push ebx
push str.waitres_u_after__I64u_ms
push 3
call fcn.0044d31e
add esp, 0x14
mov dword [ebp + 0x18], 0xffff
cmp ebx, edi
jne 0x4449fe
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp + 0x18], edi
jne 0x4449e1
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4449a0
mov ecx, dword [esi + 0x208]
mov dword [eax], ecx
mov ecx, dword [esi + 0x20c]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x4449b8
mov ecx, dword [esi + 0x210]
mov dword [eax], ecx
mov ecx, dword [esi + 0x214]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x4449d0
mov ecx, dword [esi + 0x218]
mov dword [eax], ecx
mov ecx, dword [esi + 0x21c]
mov dword [eax + 4], ecx
push dword [esi + 0x220]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
inc edi
jmp 0x4449ea
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.0044786c
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x444a15
push edi
push esi
push dword [ebp + 8]
call fcn.00444407
push 0x5b4
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x444b64
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
mov dword [ebp - 0xc], ecx
call fcn.004476fd
add esp, 0xc
push 0x23
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], eax
test eax, eax
je 0x444cc4
mov esi, 0x452d54
lea edi, [ebp - 0xa24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3f6
xor esi, esi
lea eax, [ebp - 0xa1a]
push esi
push eax
call fcn.004476fd
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xa1c]
push eax
call ebx
lea eax, [ebp - 0xa24]
push eax
mov eax, dword [ebp - 4]
add eax, 2
push eax
push str.SystemCurrentControlSetControlDeviceClasses
lea eax, [ebp - 0xe24]
push 0x4524d0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xe24]
push eax
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444cc4
cmp dword [ebp - 8], esi
je 0x444cc4
and dword [ebp - 4], esi
mov edi, 0x104
push edi
lea eax, [ebp - 0x624]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x444ca7
cmp word [ebp - 0x624], 0x23
jne 0x444c99
push 0x452d50
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x444cb2
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push 0x5c
pop eax
mov word [ebp - 0x214], ax
inc dword [ebp - 4]
push edi
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call esi
test eax, eax
je 0x444c52
jmp 0x444cbb
xor eax, eax
mov word [ebp - 0x214], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x4550d4
lea edi, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fe
lea eax, [ebp - 0x412]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004476fd
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
lea eax, [ebp - 0x41c]
push eax
call fcn.0042aeeb
mov esi, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov dword [esi], eax
call fcn.0042ae93
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8