joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x18]
push esi
push 0
lea eax, [ebx + 4]
push eax
call fcn.0042daf0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
test esi, esi
je 0x414fe5
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x414fe5
push edi
xor edi, edi
cmp byte [esi], 0
je 0x414fe4
mov eax, dword [ebp + 0x10]
cmp edi, ecx
jge 0x414fe4
test eax, eax
jle 0x414fa0
cmp edi, eax
jg 0x414fe4
cmp byte [ebx + 0x60], 0
mov eax, esi
je 0x414fba
mov ecx, dword [ebx + 0x28]
lea eax, [ebp + 0xb]
push 1
push eax
push esi
call fcn.00415790
lea eax, [ebp + 0xb]
push dword [ebx]
push 1
push 1
push eax
call fcn.004415e3
add esp, 0x10
cmp eax, 0xffffffff
je 0x414fdd
mov eax, dword [ebp + 0x10]
inc esi
mov ecx, dword [ebp + 0xc]
inc edi
cmp byte [esi], 0
jne 0x414f94
jmp 0x414fe4
mov dword [ebp - 0x10], 0xffffffff
pop edi
lea ecx, [ebp - 0x18]
call fcn.0042dbb0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x415790
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
push esi
xor esi, esi
mov ebx, ecx
test edx, edx
jle 0x415847
mov ecx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp edx, 0x20
jb 0x41582b
movsx eax, byte [ebx]
push ebp
lea ebp, [ecx - 1]
add ebp, edx
movd xmm0, eax
lea eax, [edi - 1]
punpcklbw xmm0, xmm0
add eax, edx
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
cmp ecx, eax
ja 0x4157d7
cmp ebp, edi
jae 0x41582a
cmp ecx, ebx
ja 0x4157df
cmp ebp, ebx
jae 0x41582a
mov eax, edx
and eax, 0x8000001f
jns 0x4157ed
dec eax
or eax, 0xffffffe0
inc eax
mov ebp, edx
mov edx, ecx
sub ebp, eax
sub edx, edi
mov dword [esp + 0x18], edx
mov eax, edi
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [edi + eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movups xmmword [ecx + esi + 0x10], xmm0
add esi, 0x20
cmp esi, ebp
jl 0x415803
mov edi, dword [esp + 0x14]
pop ebp
cmp esi, edx
jge 0x415846
sub edi, ecx
lea eax, [esi + ecx]
sub edx, esi
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [ebx]
mov byte [eax - 1], cl
sub edx, 1
jne 0x415836
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x415f50
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
test edi, edi
je 0x4160ca
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x24]
nop dword [eax]
mov al, byte [ebp]
lea ebp, [ebp + 1]
mov byte [esp + esi + 0x18], al
dec edi
mov ah, byte [esp + 0x1a]
inc esi
mov dl, byte [esp + 0x19]
mov cl, byte [esp + 0x18]
mov byte [esp + 0x14], ah
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], cl
cmp esi, 3
jne 0x416003
mov al, cl
and cl, 3
shr al, 2
mov byte [esp + 0x1c], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [esp + 0x1d], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], al
xor esi, esi
mov eax, dword [0x4a70e4]
movzx ecx, byte [esp + esi + 0x1c]
push 1
mov al, byte [ecx + eax]
mov ecx, ebx
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2c]
push eax
call fcn.004123d0
inc esi
cmp esi, 4
jl 0x415fd0
mov dl, byte [esp + 0x12]
xor esi, esi
mov cl, byte [esp + 0x13]
mov ah, byte [esp + 0x14]
test edi, edi
jne 0x415f70
test esi, esi
je 0x4160c8
mov ebp, 3
cmp esi, ebp
jge 0x416041
mov ecx, ebp
lea edi, [esp + 0x18]
sub ecx, esi
xor eax, eax
mov edx, ecx
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, ebp
rep stosb byte es:[edi], al
mov ah, byte [esp + 0x1a]
mov dl, byte [esp + 0x19]
mov cl, byte [esp + 0x18]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [esp + 0x1c], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ah
mov byte [esp + 0x1d], cl
shr al, 6
and ah, 0x3f
add dl, al
mov byte [esp + 0x1f], ah
lea eax, [esi + 1]
mov byte [esp + 0x1e], dl
test eax, eax
jle 0x4160a9
lea ebp, [esi + 1]
nop
mov eax, dword [0x4a70e4]
movzx ecx, byte [esp + edi + 0x1c]
push 1
mov al, byte [ecx + eax]
mov ecx, ebx
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push eax
call fcn.004123d0
inc edi
cmp edi, ebp
jl 0x416080
mov ebp, 3
cmp esi, 3
jge 0x4160c8
sub ebp, esi
push 1
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0x3d
push eax
mov ecx, ebx
call fcn.004123d0
sub ebp, 1
jne 0x4160b0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x416650
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret
Function at 0x417a60
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, 0x20
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [ecx + 4]
mov eax, dword [ebp + 4]
push esi
mov esi, dword [ebp]
mov dword [esp + 0x20], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [esp + 0x20]
push edi
mov edi, 0xc6ef3720
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
nop
mov edx, esi
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [esp + 0x10]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, dword [esp + 0x14]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [esp + 0x18]
sub esi, edx
sub ebx, 1
jne 0x417aa0
mov ebp, dword [esp + 0x20]
pop edi
mov dword [ebp], esi
pop esi
mov dword [ebp + 4], eax
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x417b70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dl, cl
and dl, 7
mov ebx, ecx
push edi
mov byte [esi], dl
jbe 0x417b99
mov al, 8
sub al, dl
movzx ebx, al
mov byte [esi], al
add ebx, ecx
push ebx
call fcn.00431a63
push ebx
mov edi, eax
push 0
push edi
mov dword [esp + 0x38], edi
call fcn.00434830
push dword [esp + 0x34]
push dword [esp + 0x34]
push edi
call fcn.004342b0
shr ebx, 3
xor ebp, ebp
add esp, 0x1c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebp
test ebx, ebx
je 0x417c6c
mov esi, dword [edi + ebp*8]
lea eax, [edi + ebp*8]
mov dword [esp + 0x20], eax
lea eax, [ebp*8 + 4]
mov ebp, dword [esp + 0x10]
add eax, edi
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [eax]
lea ebx, [edi + 0x20]
nop word [eax + eax]
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 8]
shl ecx, 4
add ecx, dword [ebp + 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp + 0x10]
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
sub ebx, 1
jne 0x417c00
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
inc ebp
mov dword [esp + 0x24], ebp
mov dword [ecx], esi
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
cmp ebp, dword [esp + 0x18]
jb 0x417bd4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x417d40
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480a9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
lea edi, [esi + 0x428]
mov dword [esi], 0
mov dword [esi + 0x404], 0
mov dword [esi + 0x420], 0
mov dword [esi + 0x424], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x417da7
mov eax, dword [edi]
jmp 0x417da9
mov eax, edi
push 0
push 0x486490
mov ecx, edi
mov byte [eax], 0
call fcn.00403ef0
push 0x104
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00434830
lea eax, [ebp - 0x12c]
push 0x103
push eax
call fcn.00442df6
xorps xmm0, xmm0
neg eax
movq qword [esi + 0x418], xmm0
sbb al, al
and byte [ebp - 0x12c], al
push 0x400
movups xmmword [esi + 0x408], xmm0
add esi, 4
push 0
push esi
call fcn.00434830
push 0x3ff
push dword [ebp + 8]
push esi
call fcn.004428f0
add esp, 0x2c
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x404], eax
call fcn.0043f9cb
mov eax, dword [eax]
mov dword [esi + 0x424], eax
test eax, eax
je 0x417ea8
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00420820
mov ecx, eax
add esp, 8
mov dword [ebp + 8], ecx
cmp edi, ecx
je 0x417e93
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x417e6e
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00404120
mov ecx, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x417e86
mov eax, dword [edi]
jmp 0x417e88
mov eax, edi
push ecx
mov ecx, edi
mov byte [eax], 0
call fcn.00403700
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x417ea8
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404120
lea eax, [ebp - 0x12c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417eb1
sub eax, edx
je 0x417ecb
lea eax, [ebp - 0x12c]
push eax
call fcn.004493ab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x418610
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480b49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x30]
lea eax, [edi + 0xc]
push eax
call fcn.0042daf0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
sete al
test al, al
je 0x418685
push 0
push 0x486490
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x60], 0
call fcn.00403ef0
lea esi, [ebp - 0x60]
mov ebx, 1
jmp 0x418698
push ecx
lea eax, [ebp - 0x78]
mov ecx, edi
push eax
call fcn.0041e620
mov esi, eax
mov ebx, 2
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp dword [esi + 0x14], 0x10
jae 0x4186c8
mov eax, dword [esi + 0x10]
add eax, 1
je 0x4186d3
push eax
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004338f0
add esp, 0xc
jmp 0x4186d3
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x34], eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
jb 0x4186f5
mov esi, dword [esi]
mov byte [esi], 0
mov dword [ebp - 4], 2
test bl, 2
je 0x41872e
mov eax, dword [ebp - 0x64]
and ebx, 0xfffffffd
cmp eax, 0x10
jb 0x41871c
inc eax
lea ecx, [ebp - 0x78]
push eax
push dword [ebp - 0x78]
call fcn.00404120
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
mov byte [ebp - 4], 3
test bl, 1
je 0x41875e
mov eax, dword [ebp - 0x4c]
cmp eax, 0x10
jb 0x41874c
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.00404120
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x60], 0
cmp dword [ebp - 0x38], 0
jne 0x418768
xor eax, eax
jmp 0x418773
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
mov ecx, dword [edi + 0x1f0]
test ecx, ecx
je 0x4187a6
lea edx, [ebp - 0x28]
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x18]
push edx
push eax
call ecx
push 0
push 0x100000
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00432080
mov dword [edi + 0xc4], edx
jmp 0x4187d5
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp + 8]
imul eax, dword [ebp - 0x10]
mov dword [edi + 0xc4], 0
imul eax, dword [ebp - 0x14]
shr eax, 0x14
mov dword [edi + 0xc0], eax
mov esi, eax
mov eax, dword [ebp - 0x34]
mov edi, dword [edi + 0xc4]
cmp eax, 0x10
jb 0x4187f8
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00404120
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.0042dbb0
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418830
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x40
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], edx
pop esi
add esp, 0x40
ret

Function at 0x418870
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x10]
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x14]
adc ecx, dword [esp + 0x34]
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
xor edx, edx
add esp, 0x40
ret 4

Function at 0x418c50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [ebp - 0x2c]
push edi
push 0
lea eax, [esi + 0xc]
push eax
call fcn.0042daf0
cmp dword [esi + 0xb4], 0
mov dword [ebp - 4], 0
jg 0x418d15
jl 0x418c9c
cmp dword [esi + 0xb0], 0
ja 0x418d15
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x10], ecx
je 0x418cb2
cmp dword [eax + 0x14], 0x10
jb 0x418cb0
mov ecx, dword [eax]
jmp 0x418cb2
mov ecx, eax
mov eax, dword [esi + 0x1f0]
test eax, eax
je 0x418ce0
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x14]
push edx
push ecx
call eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov dword [esi + 0xb4], ecx
jmp 0x418d0f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp + 8]
imul eax, dword [ebp - 0x10]
mov dword [esi + 0xb4], 0
imul eax, dword [ebp - 0x18]
shr eax, 0x14
mov dword [esi + 0xb0], eax
mov edi, dword [esi + 0xb0]
lea ecx, [ebp - 0x2c]
mov esi, dword [esi + 0xb4]
call fcn.0042dbb0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov edx, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4199b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x18]
lea eax, [esi + 0xc]
push eax
call fcn.0042daf0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00419ab0
lea ecx, [esi + 0x30]
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push ecx
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00403de0
lea ecx, [ebp - 0x18]
call fcn.0042dbb0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x41aaf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480e26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [ecx + 0x1b0], 0
push esi
push edi
lea edi, [ecx + 0x1a0]
mov dword [ebp - 0x14], 0
sete al
test al, al
je 0x41ac4f
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41abb6
push dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push str._08X
push eax
call fcn.00409960
add esp, 0xc
mov esi, eax
cmp edi, esi
je 0x41ab9a
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x41ab75
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00404120
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x41ab8d
mov eax, dword [edi]
jmp 0x41ab8f
mov eax, edi
push esi
mov ecx, edi
mov byte [eax], 0
call fcn.00403700
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x41abb6
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00404120
call fcn.0040c290
cmp dword [eax + 0x4a0], 2
jne 0x41ac4f
lea eax, [ebp - 0x2c]
mov ecx, 0x4a9a88
push eax
call fcn.004046a0
mov dword [0x4a9f24], 2
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 2
jb 0x41abef
mov eax, dword [eax]
push eax
push 0x48649c
push 0x4a9a88
call fcn.0040e7e0
push str.DEBUG:_Volume_ID:
push 0x48649c
push eax
call fcn.0040e7e0
add esp, 0x18
cmp dword [edi + 0x14], 0x10
jb 0x41ac1c
mov ecx, dword [edi]
jmp 0x41ac1e
mov ecx, edi
push ecx
push 0x48649c
push eax
call fcn.0040e7e0
push eax
call fcn.0040d5b0
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x41ac4f
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00404120
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xffffffffffffffff
push 0
push edi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00403de0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41cf90
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0x487bc8
push str.Shell_TrayWnd
push 0
push eax
call esi
push 0x487bc8
push str.TrayNotifyWnd
push 0
push eax
call esi
push 0x487bc8
push str.SysPager
push 0
push eax
call esi
push str.Notification_Area
push str.ToolbarWindow32
push 0
push eax
call esi
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x41d08e
lea eax, [ebp - 0x3c]
mov ecx, 0x4a9a88
push eax
call fcn.004046a0
mov dword [0x4a9f24], 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x41d026
mov eax, dword [eax]
push eax
push 0x48649c
push 0x4a9a88
call fcn.0040e7e0
push str.WARNING:_FindWindow_for_tray_failed___Error:
push 0x48649c
push eax
call fcn.0040e7e0
add esp, 0x18
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x486544
push esi
call fcn.0040e7e0
push eax
call fcn.0040d5b0
mov eax, dword [ebp - 0x28]
add esp, 0x10
cmp eax, 0x10
jb 0x41d182
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.00404120
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
push ecx
push eax
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
jne 0x41d133
lea eax, [ebp - 0x54]
mov ecx, 0x4a9a88
push eax
call fcn.004046a0
mov dword [0x4a9f24], 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 1
jb 0x41d0cf
mov eax, dword [eax]
push eax
push 0x48649c
push 0x4a9a88
call fcn.0040e7e0
push str.WARNING:_GetClientRect_failed___Error:
push 0x48649c
push eax
call fcn.0040e7e0
add esp, 0x18
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x486544
push esi
call fcn.0040e7e0
push eax
call fcn.0040d5b0
mov eax, dword [ebp - 0x40]
add esp, 0x10
cmp eax, 0x10
jb 0x41d182
inc eax
lea ecx, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
call fcn.00404120
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test edx, edx
jle 0x41d182
mov eax, dword [ebp - 0x18]
push edi
xor edi, edi
test eax, eax
jle 0x41d177
mov esi, ecx
nop dword [eax + eax]
push esi
push 0
push 0x200
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x18]
add edi, 5
add esi, 0x50000
cmp edi, eax
jl 0x41d150
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov dword [ebp - 0x10], ecx
cmp ecx, edx
jl 0x41d143
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41d5a0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x41d5f5
push ebx
push 0xf01ff
push dword [esp + 0x30]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x41d5ed
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x41d600
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41d6b8
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x41d66b
mov eax, dword [esp + 4]
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [esp + 0xc]
push eax
push str.SeTcbPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x41d6b8
mov eax, dword [esp + 0xc]
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add esp, 0x24
ret
Function at 0x41e2b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4825e0
push eax
mov dword fs:[0], esp
sub esp, 0x30
call fcn.0040c290
push str.debug_threads
lea ecx, [eax + 0x520]
call fcn.0040c0e0
mov ecx, 0x4a9a88
test al, al
jne 0x41e350
lea eax, [ebp - 0x24]
push eax
call fcn.004046a0
mov dword [0x4a9f24], 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x41e30b
mov eax, dword [eax]
push eax
push 0x48649c
push 0x4a9a88
call fcn.0040e7e0
push str.ERROR:_Uncaught_exception_occurred._Restarting.
push 0x48649c
push eax
call fcn.0040e7e0
push eax
call fcn.0040d5b0
mov eax, dword [ebp - 0x10]
add esp, 0x1c
cmp eax, 0x10
jb 0x41e349
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00404120
push 0xe
call fcn.004430c4
lea eax, [ebp - 0x3c]
push eax
call fcn.004046a0
mov dword [0x4a9f24], 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 1
jb 0x41e372
mov eax, dword [eax]
push eax
push 0x48649c
push 0x4a9a88
call fcn.0040e7e0
push str.ERROR:_Uncaught_exception_occurred._Leaving_engine_as_is_for_DEBUGGER_attchment.
push 0x48649c
push eax
call fcn.0040e7e0
push eax
call fcn.0040d5b0
mov eax, dword [ebp - 0x28]
add esp, 0x1c
cmp eax, 0x10
jb 0x41e3b0
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.00404120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret