joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44708e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x314], eax
xor esi, esi
lea eax, [ebp - 0x368]
push esi
push eax
call fcn.00450230
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
mov dword [ebp - 0x36c], 0x44
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleHandleA]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleFileNameA]
mov dword [0x4d617c], esi
mov esi, 0x4a301c
mov ecx, esi
call fcn.0040d125
test eax, eax
je 0x44715b
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447104
sub eax, edx
je 0x44715b
cmp dword [0x4cd984], 0
mov ecx, str.__VDiskGenErrors
je 0x447122
mov ecx, 0x469fcc
cmp dword [ebp + 0x14], 0
mov eax, 0x47a44c
jne 0x447132
mov eax, 0x47a448
push ebx
push ecx
push eax
mov ecx, esi
call fcn.0040d125
push eax
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push str.__s____s___w__g__pw__s___s__s__s
push eax
call fcn.00450c76
add esp, 0x20
jmp 0x44719d
cmp dword [0x4cd984], 0
mov ecx, str.__VDiskGenErrors
je 0x44716e
mov ecx, 0x469fcc
cmp dword [ebp + 0x14], 0
mov eax, 0x47a44c
jne 0x44717e
mov eax, 0x47a448
push ebx
push ecx
push eax
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push str.__s____s___w__g__s__s__s
push eax
call fcn.00450c76
add esp, 0x1c
mov eax, dword [ebp - 0x314]
xor ebx, ebx
cmp eax, ebx
je 0x4471e4
cmp byte [eax], bl
je 0x4471e4
push eax
push str.___SearchFull:__s_
call fcn.0042f614
pop ecx
pop ecx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4471bc
lea edi, [ebp - 0x310]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4471cc
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x36c]
push eax
push 0x469ef8
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateProcessA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0x10

Function at 0x447416
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
mov eax, dword [ebp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447431
sub eax, edx
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push dword [ebp + 8]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
pop ebp
ret 0x10
Function at 0x4478b2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
mov esi, dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push 8
push 0x49f080
push 3
xor ebx, ebx
push ebx
push str.DialogSettings
push dword [ebp - 0x1c]
call esi
cmp dword [0x4cd2e4], ebx
je 0x447911
push 8
push 0x4d7524
push 3
push ebx
push str.DialogSettingsTiny
push dword [ebp - 0x1c]
call esi
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push str.RecentFile_d
push eax
call fcn.00450c76
mov ecx, dword [edi*4 + 0x49efd8]
mov eax, ecx
lea edx, [eax + 1]
add esp, 0xc
mov dword [ebp - 0x20], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x447934
sub eax, dword [ebp - 0x20]
inc eax
push eax
push ecx
push 1
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call esi
inc edi
cmp edi, 0xa
jb 0x447913
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push str.RecentHashFile_d
push eax
call fcn.00450c76
mov ecx, dword [edi*4 + 0x49f000]
mov eax, ecx
lea edx, [eax + 1]
add esp, 0xc
mov dword [ebp - 0x20], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x447976
sub eax, dword [ebp - 0x20]
inc eax
push eax
push ecx
push 1
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call esi
inc edi
cmp edi, 0xa
jb 0x447955
push 4
push 0x4d638c
push 1
push ebx
push str.RecentVirtualDrive
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x1c]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret

Function at 0x4479c1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
mov esi, dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push 4
pop edi
push edi
push 0x4d67ac
push edi
xor ebx, ebx
push ebx
push str.MinClusterSizeToUseByteMode
push dword [ebp - 4]
call esi
push edi
push 0x4d5974
push edi
push ebx
push str.MaxImageSizeMB
push dword [ebp - 4]
call esi
push edi
push 0x4d5f6c
push edi
push ebx
push str.Maintenancemode
push dword [ebp - 4]
call esi
push edi
push 0x49f02c
push edi
push ebx
push str.GenerateHashFile
push dword [ebp - 4]
call esi
push edi
push 0x4d751c
push edi
push ebx
push str.BeepWhenReady
push dword [ebp - 4]
call esi
push edi
push 0x4d7520
push edi
push ebx
push str.CreateDirectory
push dword [ebp - 4]
call esi
push edi
push 0x49f028
push edi
push ebx
push str.VssOptions
push dword [ebp - 4]
call esi
push edi
push 0x4d5760
push edi
push ebx
push str.VssAllWriters
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447ca6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 0xc

Function at 0x447ced
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447d0b
sub eax, edx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [ebp + 0xc]
leave
ret 8

Function at 0x447d39
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x447d88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
leave
ret 8
Function at 0x448b93
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.___total_physical_size__lu_MB_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
cmp ax, 7
mov eax, 0x4769e0
je 0x448bca
mov eax, 0x47a89c
push esi
push eax
push str._s_s.htm
call fcn.0042f614
push eax
push str.help_s
mov dword [ebp - 0x210], eax
call fcn.0042f614
mov edi, eax
push 4
push edi
call fcn.00450d79
add esp, 0x1c
xor ebx, ebx
test eax, eax
je 0x448cc2
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleHandleA]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleFileNameA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetFullPathNameA]
mov eax, dword [ebp - 0x214]
mov cl, byte [edi]
inc edi
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x448c3b
lea edi, [ebp - 0x108]
mov eax, edi
push 4
push eax
call fcn.00450d79
pop ecx
pop ecx
test eax, eax
je 0x448caf
cmp dword [0x4d7580], ebx
jne 0x448c95
push 4
push str.Snaphot___Help_not_found
mov eax, edi
push eax
push str.The_Helpfile___s__could_not_be_found_nDo_you_want_to_search_on_the_internet_for_this_File__n
call fcn.0042f614
pop ecx
pop ecx
push eax
push dword [0x4d617c]
call dword [sym.imp.e_to_open__s_MessageBoxA]
cmp eax, 6
jne 0x448cd3
mov dword [0x4d7580], 1
push dword [ebp - 0x210]
push str.www.drivesnapshot.de
push str.http:___s__s
call fcn.0042f614
add esp, 0xc
mov edi, eax
mov eax, edi
cmp byte [edi], bl
je 0x448cc2
cmp byte [eax], 0x5c
jne 0x448cbd
mov byte [eax], 0x2f
inc eax
cmp byte [eax], bl
jne 0x448cb5
push 1
push ebx
push ebx
push edi
push str.open
push ebx
call dword [sym.imp._byte_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 4

Function at 0x448e8c
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x448ea4
push dword [0x4d6284]
call fcn.00448b93
pop ebp
ret 4
pop ebp
jmp fcn.00448b93
Function at 0x449908
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor esi, esi
push 0x54
lea eax, [ebp - 0x54]
push esi
push eax
mov dword [ebp - 0x58], esi
call fcn.00450230
add esp, 0xc
push esi
push 5
call fcn.0044dfdf
neg eax
sbb eax, eax
and eax, 0xc
add eax, 0x4c
cmp dword [0x4cd32c], 1
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
jne 0x4499a8
mov edi, dword [ebp + 0x1c]
cmp edi, esi
je 0x4499a8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449955
sub eax, edx
cmp eax, 5
jbe 0x449968
push 5
pop eax
jmp 0x449976
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44996d
sub eax, edx
push eax
push edi
push str..sna
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x4499a8
mov eax, dword [0x4d5a7c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], 0x449500
mov dword [ebp - 0x10], str.FILEOPENEX
mov dword [ebp - 0x24], 0xa80062
jmp 0x4499b8
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 0x200002
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0x104
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x1c], edi
cmp dword [ebp + 0xc], esi
jne 0x449a00
or dword [ebp - 0x24], 0x1000
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x449a39
test al, 0x10
je 0x449a39
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449a15
sub eax, edx
cmp byte [eax + ebx - 1], 0x5c
je 0x449a39
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x449a28
mov esi, 0x469ef8
movsw word es:[edi], word [esi]
xor esi, esi
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449a3e
sub eax, edx
cmp byte [eax + ebx - 1], 0x5c
je 0x449a67
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449a53
sub eax, edx
cmp eax, 2
jne 0x449a92
cmp byte [ebx + 1], 0x3a
jne 0x449a92
mov eax, dword [ebp + 0x1c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449a6c
sub eax, edx
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x449a78
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp + 0xc], esi
pop edi
pop esi
pop ebx
lea eax, [ebp - 0x58]
push eax
je 0x449aaa
call dword [sym.imp._MB_GetSaveFileNameA]
test eax, eax
jne 0x449ab2
jmp 0x449ab5
call dword [sym.imp._MB_GetOpenFileNameA]
jmp 0x449aa4
xor eax, eax
inc eax
leave
ret 0x18
Function at 0x44a729
Capabilities:
Get graphical window text
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call fcn.00447a85
push 0x47ac04
push 0
call dword [sym.imp.___total_physical_size__lu_MB_GetModuleHandleA]
push eax
call dword [sym.imp.e_to_open__s_LoadIconA]
push eax
push 1
push 0x80
push esi
call dword [sym.imp.e_to_open__s_PostMessageA]
push esi
call fcn.00447dc3
push edi
push 0x3f6
push esi
call dword [sym.imp.e_to_open__s_SetDlgItemTextA]
push 0xc8
lea eax, [ebp - 0xcc]
push eax
push esi
call dword [sym.imp.e_to_open__s_GetWindowTextA]
push 8
mov edi, 0x469ec0
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x44a7ca
lea eax, [ebp - 0xcc]
push eax
push edi
push str._s____s
call fcn.0042f614
add esp, 0xc
push eax
push esi
call dword [sym.imp.e_to_open__s_SetWindowTextA]
cmp dword [0x4cd65c], 1
pop edi
mov dword [0x4d617c], esi
pop esi
jne 0x44a7ed
push 0
push 0xa
call fcn.00447e18
push 0
push 9
call fcn.00447e18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450b32
leave
ret 8

Function at 0x44a7fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x104
mov esi, 0x4d7200
push esi
push 0x3ed
push ebx
call dword [sym.imp.e_to_open__s_GetDlgItemTextA]
cmp dword [ebp + 0xc], 0
mov edi, 0x4d70f8
jne 0x44a853
mov ecx, esi
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44a84a
test dl, dl
je 0x44a846
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44a84a
add eax, 2
add ecx, 2
test dl, dl
jne 0x44a82a
xor eax, eax
jmp 0x44a84f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44a879
push 0x41
pop ecx
push 1
push 8
rep movsd dword es:[edi], dword [esi]
call fcn.00450903
mov ecx, dword [ebp + 0xc]
push eax
push 0
push 0x4492c2
mov dword [eax], ebx
mov dword [eax + 4], ecx
call fcn.0045552f
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44a880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x10c], eax
call dword [sym.imp.___total_physical_size__lu_MB_SetErrorMode]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
mov edi, 0x3ed
push edi
push ebx
call dword [sym.imp.e_to_open__s_GetDlgItemTextA]
push 6
lea eax, [ebp - 0x108]
push str.ftp:__
push eax
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x44a8f3
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemDirectoryA]
mov byte [ebp - 0x105], 0
push dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.00449ab9
test eax, eax
je 0x44a92c
push esi
lea eax, [ebp - 0x108]
push eax
push 0xa
mov esi, 0x49efd8
push esi
call fcn.00447281
push 0xa
push esi
push edi
push ebx
call fcn.00447222
push 1
call dword [sym.imp.___total_physical_size__lu_MB_SetErrorMode]
push 1
push ebx
call fcn.0044a7fb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0xc
Function at 0x44af65
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0x10
push ebx
push esi
push edi
je 0x44b1b0
dec eax
je 0x44b152
sub eax, 0x42
je 0x44b145
sub eax, 0xbd
je 0x44b097
dec eax
je 0x44afb7
sub eax, 0x27
jne 0x44b15b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x138
push dword [ebp + 8]
call dword [sym.imp.e_to_open__s_DefWindowProcA]
jmp 0x44b1c6
movzx esi, word [ebp + 0x10]
mov eax, 0x3f8
cmp esi, eax
jg 0x44b020
je 0x44aff1
test esi, esi
jle 0x44b15b
cmp esi, 2
jle 0x44b038
xor edi, edi
add esi, 0xfffffff7
inc edi
cmp esi, edi
ja 0x44b15b
push dword [0x4d6284]
call fcn.00448b93
jmp 0x44b13e
mov ebx, dword [sym.imp.e_to_open__s_GetKeyState]
xor edi, edi
inc edi
push 0xa0
mov dword [0x4d659c], edi
call ebx
test ax, ax
jns 0x44b050
push 0xa2
call ebx
test ax, ax
jns 0x44b050
mov dword [0x4cd634], edi
jmp 0x44b050
mov eax, 0x420
cmp esi, eax
je 0x44b06b
lea eax, [esi - 0x518]
cmp eax, 1
ja 0x44b15b
push 0x3e8
push 0x4d5a80
push 0x421
push dword [ebp + 8]
call dword [sym.imp.e_to_open__s_GetDlgItemTextA]
cmp dword [0x4d7514], 0
jne 0x44b15b
push esi
push dword [ebp + 8]
call fcn.00448b17
jmp 0x44b15b
xor edi, edi
inc edi
cmp dword [0x4d6494], edi
jne 0x44b13e
push eax
push dword [0x4d617c]
call dword [sym.imp.e_to_open__s_IsDlgButtonChecked]
push eax
push str.TestImageAfterBackup
call fcn.00447d88
jmp 0x44b13e
push dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ebx
call fcn.0044a729
push ebx
call fcn.00448eaa
mov edi, dword [sym.imp.e_to_open__s_GetDlgItem]
mov esi, 0x519
push esi
push ebx
call edi
test eax, eax
je 0x44b0eb
xor eax, eax
cmp dword [0x4d5764], eax
sete al
push eax
push 2
call fcn.00447e18
push dword [0x4d5764]
push 0x518
call fcn.00447e18
push dword [0x4d5764]
push esi
call fcn.00447e18
cmp dword [0x4d5764], 0
je 0x44b109
push esi
push ebx
call edi
push eax
call dword [sym.imp.e_to_open__s_SetFocus]
push 0x4d70f8
call fcn.0044779c
and dword [0x4d5764], 0
xor edi, edi
inc edi
cmp dword [0x4d6494], edi
jne 0x44b126
push edi
push 0x420
call fcn.00447e18
cmp dword [0x4cd2e8], edi
jne 0x44b13e
and dword [0x4cd2e8], 0
push 6
push ebx
call dword [sym.imp.e_to_open__s_ShowWindow]
mov eax, edi
jmp 0x44b1c6
push dword [0x4d6284]
call fcn.00448b93
jmp 0x44b1c3
cmp dword [0x4a3004], 0
jne 0x44b15f
xor eax, eax
jmp 0x44b1c6
push 0
push 0x50004
mov esi, 0x469ec0
push esi
push str._s___logoff_message
call fcn.0042f614
pop ecx
pop ecx
push eax
push esi
push str._s_is_busy_saving_your_data_nare_you_sure_to_logoff_now___nthis_will_make_your_backup_invalid
call fcn.0042f614
pop ecx
pop ecx
push eax
push 0x28
push dword [0x4d617c]
call fcn.0041ee88
cmp eax, 6
jne 0x44b1c3
push 0x3e8
mov dword [0x4d659c], 1
call dword [sym.imp.___total_physical_size__lu_MB_Sleep]
jmp 0x44b15b
cmp dword [0x4d7514], 0
jne 0x44b1c3
push 0
push dword [ebp + 8]
call fcn.00448b17
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x44b591
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push 0x44a202
mov dword [ebp - 0x14], esi
mov dword [0x4d659c], edi
call fcn.0045552f
xor ecx, ecx
mov dword [0x49efd4], eax
mov eax, dword [0x4d6494]
inc ecx
add esp, 0xc
mov dword [0x4d7514], ecx
cmp eax, ecx
jne 0x44b5f4
push edi
push fcn.0044af65
push str.back3
push str.PROGRESSVOL2FILEVSS
jmp 0x44b620
cmp esi, edi
jne 0x44b605
push edi
push fcn.0044af65
push str.rest1
jmp 0x44b5ed
cmp eax, 2
mov eax, str.rest3
je 0x44b614
mov eax, str.back3
push edi
push fcn.0044af65
push eax
push 0x46d014
call fcn.00448ce4
mov dword [0x4d66a4], eax
mov eax, dword [0x49efd4]
mov dword [0x4d7514], edi
pop edi
pop esi
cmp eax, 0xffffffff
je 0x44b648
push 0x7d0
push eax
call dword [sym.imp.___total_physical_size__lu_MB_WaitForSingleObject]
mov eax, dword [ebp - 0xc]
leave
ret 0x10
Function at 0x44e0da
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp eax, ebx
jne 0x44e1ac
push 0x5c
pop eax
mov word [ebp - 0x108], ax
mov word [ebp - 0x108], 0x5c
push edi
xor eax, eax
mov dword [ebp - 0x174], ebx
lea edi, [ebp - 0x170]
stosd dword es:[edi], eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceExA]
pop edi
cmp esi, ebx
je 0x44e190
push 0x64
lea eax, [ebp - 0x16c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
call dword [sym.imp.___total_physical_size__lu_MB_GetVolumeInformationA]
test eax, eax
je 0x44e190
push 3
lea eax, [ebp - 0x16c]
push 0x472574
push eax
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x44e190
mov dword [esi], 0xff000000
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 8
push 0x103
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00451260
add esp, 0xc
cmp byte [ebp - 0x108], 0x5c
jne 0x44e1ef
cmp byte [ebp - 0x107], 0x5c
jne 0x44e1fb
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00452730
pop ecx
pop ecx
cmp eax, ebx
je 0x44e1ef
mov byte [eax + 1], bl
jmp 0x44e112
cmp byte [ebp - 0x108], bl
je 0x44e109
cmp byte [ebp - 0x107], 0x3a
jne 0x44e109
mov word [ebp - 0x106], 0x5c
jmp 0x44e112