joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460b20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
add eax, 0x41
mov dword [ebp - 0x12], 0x5c003a
push esi
mov word [ebp - 0x14], ax
xor eax, eax
push str.fmifs.dll
mov word [ebp - 0xe], ax
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x460b79
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push ebx
push str.FormatEx
push str.fmifs.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x460bb0
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov byte [0x56fb50], 0
mov ecx, str.exFat
lea esi, [eax - 3]
neg esi
sbb esi, esi
add esi, 0xc
xor edi, edi
cmp byte [0x56fb50], 0
jne 0x460c0f
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 0x14]
cmp dword [ebp - 0x18], 2
push 0x45f1f0
push eax
push 1
push 0x516968
mov eax, str.NTFS
cmovne eax, ecx
push eax
push esi
lea eax, [ebp - 0x14]
push eax
call ebx
inc edi
mov ecx, str.exFat
cmp edi, 3
jl 0x460bd3
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
movzx eax, byte [0x56fb50]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x461090
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
push 0
push 0
movlpd qword [ebp - 0x200c], xmm0
push dword [ebp - 0x2008]
push dword [ebp - 0x200c]
push esi
call edi
test eax, eax
je 0x46122b
push 0
lea eax, [ebp - 0x2010]
push eax
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x46122b
movups xmm1, xmmword [0x521d20]
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x2004]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x2004], xmm0
movups xmm0, xmmword [ebp + eax - 0x1ff4]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x1ff4], xmm0
add eax, 0x20
cmp eax, 0x2000
jl 0x461110
push 0
push 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x200c], xmm0
push dword [ebp - 0x2008]
push dword [ebp - 0x200c]
push esi
call edi
test eax, eax
je 0x46122b
push 0
lea eax, [ebp - 0x2010]
push eax
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x461240
call dword [sym.imp.KERNEL32.DLL_GetLastError]
movups xmm1, xmmword [0x521d20]
mov dword [ebp - 0x2014], eax
xor ecx, ecx
movups xmm0, xmmword [ebp + ecx - 0x2004]
pandn xmm0, xmm1
movups xmmword [ebp + ecx - 0x2004], xmm0
movups xmm0, xmmword [ebp + ecx - 0x1ff4]
pandn xmm0, xmm1
movups xmmword [ebp + ecx - 0x1ff4], xmm0
add ecx, 0x20
cmp ecx, 0x2000
jl 0x4611a1
xorps xmm0, xmm0
movlpd qword [ebp - 0x200c], xmm0
nop
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push dword [ebp - 0x2008]
push dword [ebp - 0x200c]
push esi
call edi
test eax, eax
je 0x4611e0
push 0
lea eax, [ebp - 0x2018]
push eax
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4611e0
push dword [ebp - 0x2014]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x461260
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00415b70
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
add esp, 4
mov esi, 0x12c
push 0
push eax
push 0
push 0
push 0
push 0
push 0x90018
push edi
call ebx
test eax, eax
jne 0x461313
nop word [eax + eax]
test esi, esi
jle 0x4612c9
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 4]
dec esi
push eax
push 0
push 0
push 0
push 0
push 0x90018
push edi
call ebx
test eax, eax
je 0x4612a0
jmp 0x461313
test eax, eax
jne 0x461313
cmp dword [ebp + 0x10], eax
jne 0x4612f3
cmp dword [ebp + 0x18], 0
jne 0x4612e7
push 1
push str.INPLACE_ENC_CANT_LOCK_OR_DISMOUNT_FILESYS
call fcn.004636a0
add esp, 8
pop edi
pop esi
mov eax, 0x1c
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
je 0x461313
cmp dword [ebp + 0x18], 0
jne 0x461313
push 0
push str.VOL_LOCK_FAILED_OFFER_FORCED_DISMOUNT
call fcn.00419720
add esp, 8
cmp eax, 7
je 0x4612e7
push 0
lea eax, [ebp - 4]
mov esi, 0x12c
push eax
push 0
push 0
push 0
push 0
push 0x90020
push edi
call ebx
test eax, eax
jne 0x46136a
test esi, esi
jle 0x461362
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 4]
dec esi
push eax
push 0
push 0
push 0
push 0
push 0x90020
push edi
call ebx
test eax, eax
je 0x461332
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4612d2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4633b0
Capabilities:
Get volume information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x68]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0
push ecx
push 0x60
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0x90064
push eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x463413
cmp dword [ebp + 0x18], eax
jne 0x4633fe
push dword [0x5685fc]
call fcn.00417c00
add esp, 4
or eax, 0xffffffff
pop edi
or edx, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0
push dword [ebp - 0x3c]
call fcn.004e2b40
push 0
push dword [ebp - 0x3c]
sub eax, 0x40000
sbb edx, 0
push edx
push eax
call fcn.004e1fc0
mov ecx, eax
test edx, edx
jg 0x463443
jl 0x4633fe
test ecx, ecx
je 0x4633fe
test edi, edi
je 0x463452
mov eax, dword [ebp - 0x54]
mov dword [edi], eax
mov eax, dword [ebp - 0x50]
mov dword [edi + 4], eax
test ebx, ebx
je 0x46345b
mov eax, dword [ebp - 0x38]
mov dword [ebx], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x463790
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 8], eax
call fcn.004f1588
mov edi, eax
add esp, 4
test edi, edi
jne 0x4637bf
lea eax, [edi + 2]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x4637e1
mov esi, 1
jmp 0x46387a
mov eax, ebx
cdq
push edx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004e1fc0
mov dword [ebp - 0x10], edx
mov ebx, eax
test edx, edx
jl 0x463878
jg 0x463800
test ebx, ebx
je 0x463878
mov esi, dword [ebp + 0x20]
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x46385c
push dword [ebp + 0x1c]
push eax
push edi
call fcn.004e46b0
add esp, 0xc
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x4637d7
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4637d7
add dword [esi], 1
adc dword [esi + 4], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
adc dword [ebp - 8], 0
add ebx, 0xffffffff
adc dword [ebp - 0x10], 0xffffffff
js 0x463878
jg 0x463803
test ebx, ebx
jne 0x463803
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
mov ebx, eax
call fcn.004ec0b7
add esp, 4
test esi, esi
je 0x463896
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464420
Capabilities:
Get file size
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
movlpd qword [ebp - 0x14], xmm0
call esi
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4645b4
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x4645b4
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
je 0x4645b4
push ebx
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x4645b4
push esi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
je 0x4645b4
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
jne 0x4645b4
push 0x10000
call fcn.004f1588
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x4644e9
lea ebx, [eax + 2]
jmp 0x4645b9
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00459cb0
add esp, 8
lea eax, [ebp - 4]
push 0
push eax
push 0x10000
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x46457d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
nop dword [eax]
mov eax, dword [ebp - 4]
test eax, eax
je 0x46457d
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4645b4
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jne 0x4645b4
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
adc eax, 0
push eax
push ecx
mov dword [ebp - 0x18], eax
call fcn.00459cd0
mov eax, dword [ebp + 0x10]
add esp, 8
cmp dword [eax], ebx
jne 0x4645ad
push 0
lea eax, [ebp - 4]
push eax
push 0x10000
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x464520
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00459c90
add esp, 8
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
jmp 0x4645b9
mov ebx, 0x21
jmp 0x4645b9
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x20]
call fcn.004ec0b7
add esp, 4
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4649d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1814
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x100c]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
sub edx, ebx
mov dword [ebp - 0x1814], eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x464a03
lea edx, [ebp - 0x808]
mov ecx, edi
sub edx, edi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x464a20
lea ecx, [ebp - 0x100c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464a40
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x100e], 0x5c
jne 0x464a77
lea ecx, [ecx*2 - 2]
cmp ecx, 0x802
jae 0x464b76
xor eax, eax
mov word [ebp + ecx - 0x100c], ax
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464a80
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x80a], 0x5c
jne 0x464ab7
lea ecx, [ecx*2 - 2]
cmp ecx, 0x802
jae 0x464b76
xor eax, eax
mov word [ebp + ecx - 0x808], ax
lea esi, [ebp - 0x808]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x464ac0
lea eax, [ebp - 0x1810]
sub esi, ecx
push eax
push ebx
sar esi, 1
call fcn.0041ecd0
push eax
lea eax, [ebp - 0x808]
lea eax, [eax + esi*2]
push 0x521e00
push eax
call fcn.004054c0
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x464b33
test al, 0x10
je 0x464b49
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x464b49
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
mov esi, eax
call fcn.00414f30
add esp, 4
test eax, eax
jne 0x464b49
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1814]
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x100c]
push eax
call fcn.004645f0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
call fcn.004e2a5f
int3
Function at 0x464fa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x464fba
xor eax, eax
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x464fd7
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1000
mov dword [eax + 4], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00427d40
add esp, 8
test eax, eax
je 0x464fb4
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004e23c0
mulsd xmm0, qword [0x521e08]
sub esp, 8
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call fcn.004f7290
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
mulsd xmm0, qword [0x521e10]
call fcn.004e2260
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 1
add dword [ecx], 0x1000
mov dword [ecx + 4], edx
adc dword [ecx + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x465490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50eca8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x55e2f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5703ac], 0
mov dword [ebp - 4], 0
jne 0x46553b
cmp dword [0x5703b0], 0
jne 0x46553b
lea eax, [ebp + 0xc]
mov ecx, 0x56fb9c
push eax
call fcn.00438e10
mov eax, dword [ebp + 0x18]
mov edx, 0x56fba8
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4654e5
mov dword [0x56fb98], 0
mov dword [0x5703ac], 0
mov dword [0x5703b0], 1
mov dword [0x564274], 0x51d7c4
call fcn.00420eb0
push dword [ebp + 8]
push 0
push 0x465590
call fcn.004f1e00
add esp, 0xc
mov edi, 1
jmp 0x46553d
xor edi, edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x46557a
push dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call fcn.00403d30
mov ecx, dword [ebp + 0x14]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp + 0xc]
add esp, 0x10
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00405300
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4667f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50fe50
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
call fcn.0042c810
mov ecx, dword [0x56aac8]
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 4], 0
call fcn.004af0c0
movaps xmm0, xmmword [0x521d20]
mov esi, eax
mov ecx, 0x17
mov edi, 0x56aad0
rep movsd dword es:[edi], dword [esi]
push 0x570410
push 0
push 0
push 5
movsw word es:[edi], word [esi]
push 0
movups xmmword [0x5703e8], xmm0
mov dword [0x5703f8], 0xffffffff
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, 0x570410
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x466882
mov ecx, 0xc
mov esi, 0x521e18
rep movsd dword es:[edi], dword [esi]
mov eax, 1
movsw word es:[edi], word [esi]
jmp 0x4668ca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x467b50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5703d0], 0
push esi
je 0x467bb4
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
sub eax, dword [0x5703d8]
push 0
push eax
call fcn.0041efe0
add esp, 8
call esi
sub eax, dword [0x5703d8]
cmp eax, 0x3a980
jbe 0x467bad
call esi
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0x3a980
push dword [0x56aba4]
mov dword [0x5703d8], eax
call fcn.0041ef50
add esp, 0x24
pop esi
pop ebp
jmp fcn.00420eb0
mov esi, dword [ebp + 8]
push 0x103
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x3a980
call fcn.0041efe0
add esp, 8
push 0x5dc
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x5703d4], 0
je 0x467bf4
push esi
push str.SYS_DRIVE_SIZE_PROBE_TIMEOUT
call fcn.00419c20
add esp, 8
push 6
push esi
call fcn.004505a0
add esp, 8
pop esi
pop ebp
ret

Function at 0x469130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x570c30], 0
jne 0x469185
cmp dword [0x570c34], 0
jne 0x469185
cmp dword [0x570c2c], 0
jne 0x469185
push dword [ebp + 8]
mov dword [0x570c2c], 0
push 0
mov dword [0x570c34], 1
push 0x4697d0
mov dword [0x570c30], 0
call fcn.004f1e00
add esp, 0xc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x469190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x570c30], 0
jne 0x4691e5
cmp dword [0x570c34], 0
jne 0x4691e5
cmp dword [0x570c2c], 0
jne 0x4691e5
push dword [ebp + 8]
mov dword [0x570c2c], 0
push 0
mov dword [0x570c34], 1
push 0x469aa0
mov dword [0x570c30], 0
call fcn.004f1e00
add esp, 0xc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x46b800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510326
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x46b8ac
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x46b8ac
call fcn.0046a880
mov esi, eax
jmp 0x46b99c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x46b8cf
call fcn.0046a880
jmp 0x46b98f
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x46b8ed
call fcn.0046a880
jmp 0x46b98f
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x46b90e
mov esi, 0x8007000e
jmp 0x46b991
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0046a6b0
jmp 0x46b938
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x46b94f
mov esi, 0x8007000e
jmp 0x46b991
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x46b96f
call fcn.0046a880
jmp 0x46b98f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0046b460
mov esi, eax
test edi, edi
je 0x46b99c
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x46b9c0
lea ecx, [ebp - 0x418]
call fcn.0046acf0
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 0x10