joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ab0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
lea esi, [eax + 1]
push esi
call fcn.00406a2a
push esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.00406a87
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x40916b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4091c4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4091b5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4091b1
cmp esi, ecx
jae 0x4091b5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40919f
cmp esi, ecx
jb 0x4091b9
xor eax, eax
jmp 0x4091c3
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40ee4f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x40ee75
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40ee61
pop esi
mov eax, ecx
ret
Function at 0x412f3f
Capabilities:
Reference sql statements

Disassembly:
push 0x4c
mov eax, 0x4f93b0
call fcn.004d0d27
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, str.InstallerAnalytics.dll
push 7
mov dword [edi + 0xc], eax
xor eax, eax
pop ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.004d635d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004087b1
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0044eda0
pop ecx
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
push eax
mov ecx, esi
call fcn.0040c6f8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.00404a7e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a7e
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov ebx, str.SELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x40], ax
cmp word [str.SELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll], ax
je 0x412fe7
push ebx
call fcn.004d635d
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004087b1
mov dword [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [ebp + 8]
push esi
call fcn.004a5d26
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.00404a7e
cmp dword [esi + 0x14], 8
jb 0x41301d
mov esi, dword [esi]
mov ecx, esi
call fcn.00412eb4
mov ebx, eax
test ebx, ebx
je 0x413050
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeEmbeddedUI
push ebx
call esi
push str.ShutdownEmbeddedUI
push ebx
mov dword [edi], eax
call esi
push str.EmbeddedUIHandler
push ebx
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x41305f
push 0
push 0
push dword [edi + 0xc]
call eax
call fcn.004d0cd1
ret 8

Function at 0x41c3ee
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x2e4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
test eax, 0x10000000
je 0x41c44d
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41c44d
push 0xfffffffffffffff0
push esi
call edi
shr eax, 0x10
test al, 1
je 0x41c44d
push 0
push 0
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41c44d
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x41c47f
push 0
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov edi, eax
test edi, edi
je 0x41c47d
cmp edi, esi
je 0x41c47d
push 0
push 0
push 0x87
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41c47d
push edi
jmp 0x41c443
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x41ce40
Capabilities:
Get disk size

Disassembly:
push 0x78
mov eax, 0x4fb612
call fcn.004d0d95
mov esi, ecx
mov dword [ebp - 0x5c], esi
cmp dword [ebp + 8], 1
je 0x41ce65
and dword [esi + 0x1a4], 0
xor eax, eax
jmp 0x41cfec
xor ebx, ebx
mov dword [ebp - 4], ebx
wait
mov ecx, dword [esi + 0x258]
cmp ecx, dword [esi + 0x25c]
jne 0x41ce82
xor eax, eax
inc eax
wait
jmp 0x41cfec
mov edi, ebx
mov dword [ebp - 0x6c], edi
mov eax, dword [esi + 0x25c]
sub eax, dword [esi + 0x258]
cdq
push 0x30
pop ecx
idiv ecx
cmp edi, eax
jae 0x41cf92
imul ecx, edi, 0x30
add ecx, dword [esi + 0x258]
mov dword [ebp - 0x68], ecx
mov eax, dword [ecx + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x53b920]
lahf
test ah, 0x44
jnp 0x41cf8c
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
cmp dword [ecx + 0x14], 8
jb 0x41cee3
mov ecx, dword [ecx]
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x60]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
call fcn.004f5f70
mulsd xmm0, qword [0x53b940]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x41cf8c
push 0x5259e4
lea ecx, [ebp - 0x48]
call fcn.00408844
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x30]
call fcn.00408844
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00404a7e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404a7e
jmp 0x41ce79
inc edi
jmp 0x41ce84
push 0x527f1c
lea ecx, [ebp - 0x30]
call fcn.00408844
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x48]
call fcn.00408844
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404a7e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00404a7e
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
call fcn.004d0ce2
ret 4
Function at 0x41f51c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x18
mov eax, 0x4fbba0
call fcn.004d0cf3
mov esi, ecx
test esi, esi
je 0x41f536
lea ebx, [esi - 0x28]
mov dword [ebp - 0x10], ebx
jmp 0x41f53a
and dword [ebp - 0x10], 0
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
mov eax, dword [ebp + 0x14]
je 0x41f551
and dword [eax], 0
jmp 0x41f62a
and dword [eax], 0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
test eax, eax
push 2
pop edx
cmovne ecx, edx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
seta cl
xor ebx, ebx
xor edi, edi
inc ebx
inc edi
cmp byte [esi + 0x18], 0
je 0x41f589
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0xc], 8
jne 0x41f59b
xor ebx, ebx
test cl, cl
setne bl
add ebx, 2
jmp 0x41f5b0
cmp dword [ebp + 0xc], 0x14
jne 0x41f5b9
xor eax, eax
test cl, cl
setne al
add eax, 2
mov dword [ebp - 0x14], eax
mov edi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [ebp + 0x14], eax
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
push 0
push ebx
xor ebx, ebx
mov edx, dword [ecx]
push ebx
push eax
call dword [edx + 0x18]
mov ecx, dword [esi + 0x14]
mov esi, dword [ebp + 0x14]
push ebx
push edi
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 0x18]
cmp dword [ebp + 0xc], 8
je 0x41f5f7
cmp dword [ebp + 0xc], 0x14
jne 0x41f618
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], 0x12
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TrackMouseEvent]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41f62a
push esi
mov dword [ebp + 0x14], ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.004d0cbc
ret 0x10
Function at 0x4236c9
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x4c
mov eax, 0x4fc681
call fcn.004d0d27
lea ecx, [ebp - 0x28]
call fcn.00463a20
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00457990
mov byte [ebp - 4], 1
mov edx, 0x5285e0
push eax
lea ecx, [ebp - 0x58]
call fcn.0040d9b7
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.004238fd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00404a7e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00404a7e
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00464c00
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x423747
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404a7e
add bl, 1
je 0x4237a9
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00464c00
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x423781
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404a7e
add bl, 1
je 0x4237a9
xor bl, bl
jmp 0x4237b9
lea eax, [ebp - 0x28]
mov ecx, 0x57055c
push eax
call fcn.0046cee0
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a7e
mov al, bl
call fcn.004d0cd1
ret
Function at 0x42c1cf
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x56a078]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 4
mov eax, 0x4fe28f
call fcn.004d0cf3
mov esi, ecx
mov edi, 0x105
lea eax, [ebp]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42c250
cmp eax, edi
jae 0x42c250
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.004093f6
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x52940c
call fcn.004072a1
push esi
lea ecx, [ebp - 0x10]
call fcn.004072a1
mov ecx, dword [ebp - 0x10]
call fcn.00412eb4
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406dd3
mov eax, esi
jmp 0x42c252
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d014c
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x433308
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x433354
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x43337f
shr ecx, 2
test cl, 1
je 0x433387
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4333b6
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x4333b6
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433cfd
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x56a078]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
push edi
push 0x30
pop edi
push edi
mov ebx, ecx
push ebp
push ebx
call fcn.004d1f70
push 0x110
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x114
push ebp
push eax
call fcn.004d1f70
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x433d5c
cmp dword [esp + 0x14], 6
jae 0x433d5f
push 0x2c
pop edi
mov eax, dword [esp + 0x134]
mov dword [ebx], edi
mov dword [ebx + 4], ebp
test eax, eax
jne 0x433d82
push esi
call dword [sym.imp.USER32.dll_GetParent]
or dword [ebx + 4], 1
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], esi
jmp 0x433d88
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], eax
mov esi, dword [esp + 0x138]
test esi, esi
je 0x433d9a
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x56f438]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x134]
mov dword [ebx + 0x28], ebp
pop ebp
mov dword [ebx + 0x24], eax
pop ebx
xor ecx, esp
call fcn.004d014c
add esp, 0x118
ret 0x18
Function at 0x443d01
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x501f92
call fcn.004d0d95
mov eax, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [edi], 0
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 4], 0x200
jb 0x443d70
cmp dword [ebx + 4], 0x20e
ja 0x443d70
push 0x10
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
mov ecx, 0x8000
test cx, ax
jne 0x443d64
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x443d64
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x443d76
xor ebx, ebx
inc ebx
mov dword [edi], ebx
mov eax, ebx
jmp 0x443e5e
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebx + 4], 0x100
jb 0x443e58
cmp dword [ebx + 4], 0x109
ja 0x443e58
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x443db0
cmp dword [ebx + 8], 0x58
je 0x443db0
cmp dword [ebx + 8], 0x43
je 0x443db0
cmp dword [ebx + 8], 0x56
jne 0x443d64
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x443dca
cmp dword [ebx + 8], 0x25
je 0x443d64
cmp dword [ebx + 8], 0x27
je 0x443d64
cmp dword [ebx + 4], 0x100
jne 0x443e58
cmp dword [ebx + 8], 8
jne 0x443e42
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 0x168]
call fcn.0044aa20
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x443dfa
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
test esi, esi
je 0x443e25
mov dl, bl
mov ecx, esi
call fcn.0044aabd
test al, al
je 0x443e25
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x443e45
mov dword [edi], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x443d69
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x443d69
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], 0x70
jb 0x443e58
cmp dword [eax + 8], 0x7b
jbe 0x443d67
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004d0ce2
ret 0x10
Function at 0x444ec5
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x5024fc
call fcn.004d0cf3
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x444ee3
xor al, al
jmp 0x444f9e
mov eax, dword [0x57059c]
mov ecx, esi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.004450c5
and dword [ebp - 4], 0
mov ecx, 0x57059c
push dword [eax]
call fcn.004453c8
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406dd3
add bl, 1
je 0x444f63
mov eax, dword [0x57059c]
mov ecx, esi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00445170
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444fa6
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x444fa6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push 1
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.00445117
mov dword [ebp - 4], 6
mov ecx, eax
push 0x52bf38
call fcn.004453c8
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406dd3
add bl, 1
sete al
call fcn.004d0cbc
ret 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.00406dd3
jmp 0x444edc
Function at 0x44e703
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x50411e
call fcn.004d0cf3
mov ebx, ecx
call fcn.0044e6be
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp edi, 0xffffffff
jne 0x44e749
mov bl, al
jmp 0x44e7a3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp + 8], 0
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
push esi
call fcn.0044ec3e
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44e790
cmp dword [ebp - 0x10], 0
je 0x44e790
push dword [ebp - 0x10]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 8]
call dword [eax + 8]
mov bl, al
jmp 0x44e792
xor bl, bl
mov byte [ebp - 4], 0
push dword [ebp + 8]
call fcn.004d0771
and dword [ebp + 8], 0
pop ecx
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x44e7b6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x18], 0
mov al, bl
call fcn.004d0cbc
ret 4

Function at 0x44ee6d
Capabilities:
Get disk information

Disassembly:
push 0x1c
mov eax, 0x50422e
call fcn.004d0d27
mov ebx, ecx
push dword [ebx + 4]
push dword [ebx]
call fcn.00408e68
mov eax, dword [ebx]
xor ecx, ecx
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
lea ecx, [ebp - 0x28]
push 0
push esi
call fcn.0044f16c
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x44eed5
xor bl, bl
jmp 0x44eef9
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push ebx
cmovae ecx, dword [ebp - 0x28]
mov edx, eax
call fcn.00465f40
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00404a7e
mov al, bl
call fcn.004d0cd1
ret
Function at 0x45098e
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504761
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
push edi
mov eax, dword [0x56a078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xc
lea ecx, [esi + 0x48]
call fcn.00450af9
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x3c]
call fcn.00451f90
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ecx]
push 0x10
pop edi
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 9
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 8
lea ecx, [esi + 0x2c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 7
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 6
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 5
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 4
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 3
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 2
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 1
lea ecx, [esi + 8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
mov byte [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
sub ecx, edi
call fcn.00406dd3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret