joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483b8e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xac
mov eax, 0x5061be
call fcn.00498168
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
mov ebx, esi
mov dword [ebp - 0xac], ebx
test eax, eax
je 0x483bc4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401488
inc ebx
cmp dword [eax + 0x14], 8
jb 0x483bc6
mov eax, dword [eax]
jmp 0x483bc6
mov eax, esi
push esi
push esi
push esi
push esi
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test bl, 1
je 0x483be2
lea ecx, [ebp - 0x2c]
call fcn.0040dc64
mov ecx, edi
sub ecx, esi
je 0x483c82
dec ecx
sub ecx, 1
je 0x483c82
sub ecx, 0xe8
je 0x483c82
test edi, edi
jne 0x483c90
jmp 0x483c82
cmp edi, 2
setne al
call fcn.004980ba
ret 4
push 0x5fa
push 0x532d7c
push edi
push 4
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], esi
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xa8]
push eax
call fcn.004a1a51
int3

Function at 0x484c53
Capabilities:
Set registry value

Disassembly:
push 0xb4
mov eax, 0x506405
call fcn.00498168
mov dword [ebp - 0xb0], ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ebx
test edi, edi
je 0x484c9a
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401488
inc ebx
mov dword [ebp - 0xb4], ebx
cmp dword [eax + 0x14], 8
jb 0x484c9c
mov eax, dword [eax]
jmp 0x484c9c
xor eax, eax
push dword [ebp + 0x14]
push dword [ebp - 0xb8]
push dword [ebp + 0xc]
push 0
push eax
mov eax, dword [ebp - 0xb0]
push dword [eax]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
setne al
mov byte [ebp - 0xa9], al
test bl, 1
je 0x484ce0
and ebx, 0xfffffffe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xb4], ebx
call fcn.0040dc64
mov al, byte [ebp - 0xa9]
test al, al
jne 0x484d6a
jmp 0x484d62
call fcn.004980ba
ret 0x10
and dword [ebp - 4], 0
test edi, edi
je 0x484d91
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401488
or ebx, 2
mov byte [ebp - 4], 1
mov ecx, eax
mov dword [ebp - 0xb4], ebx
call fcn.00487865
jmp 0x484d93
xor eax, eax
mov ecx, dword [ebp - 0xb0]
push 0x33a
push 0x532d7c
push dword [ebp + 0x14]
push dword [ebp - 0xb8]
push dword [ebp + 0xc]
push 0
push eax
call fcn.004878d9
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push eax
push 4
lea ecx, [ebp - 0xa8]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xa8]
push eax
call fcn.004a1a51
int3
Function at 0x487d49
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x134
mov eax, 0x506668
call fcn.00498168
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x11c]
xor ebx, ebx
mov dword [ebp - 0x110], eax
push ebx
push ebx
push ecx
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
inc esi
mov dword [ebp - 0x110], eax
push ebx
mov ecx, eax
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x11c], esi
call fcn.004878dc
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x488053
jmp 0x487e26
add dword [ebp - 0x118], 2
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x120]
mov dword [ebp - 4], 3
push eax
call fcn.00487bae
pop ecx
pop ecx
push ebx
push dword [ebp - 0x118]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x130], ebx
call fcn.004108b9
cmp dword [ebp - 0x18], 8
lea edi, [ebp - 0x2c]
mov ecx, dword [ebp - 0x110]
cmovae edi, dword [ebp - 0x2c]
call fcn.004878dc
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
push ecx
push esi
lea ecx, [ebp - 0x130]
push ecx
push ebx
lea ecx, [ebp - 0x118]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
xorps xmm0, xmm0
mov ecx, ebx
movlpd qword [ebp - 0x128], xmm0
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ecx
mov byte [ebp - 4], 5
test eax, eax
jne 0x487fbd
push ebx
push dword [ebp - 0x118]
lea ecx, [ebp - 0x2c]
call fcn.004108b9
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x110], esi
push eax
lea ecx, [ebp - 0x44]
call fcn.0047f207
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 6
push ecx
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00487b68
add esp, 0x14
lea ecx, [ebp - 0x128]
push eax
call fcn.00487c54
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
je 0x487f3c
call fcn.0040cf26
lea ecx, [ebp - 0x44]
call fcn.0040dc3e
mov ecx, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x128]
mov edi, dword [ebp - 0x12c]
mov dword [edi], ebx
mov dword [edi + 4], ecx
test esi, esi
je 0x487f66
push esi
call fcn.0049848a
pop ecx
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x487fb5
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x110], ecx
cmp eax, 0x1000
jb 0x487fac
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040cc5d
mov eax, dword [ebp - 0x120]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x110]
push eax
push ecx
call fcn.00497ad0
pop ecx
pop ecx
mov eax, edi
call fcn.004980ba
ret
cmp eax, 0x103
je 0x487f50
push 0x51
push 0x533090
push eax
push 4
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 7
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x10c]
jmp 0x488076
push 0x26
push 0x533090
push eax
push 4
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], ebx
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xa8]
push eax
call fcn.004a1a51
int3
Function at 0x48d04f
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x5073f9
call fcn.004980c9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0048d11e
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x48d0c7
push ebx
push ebx
call fcn.004cc926
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x48d095
mov eax, esi
call fcn.00498097
ret 4
push 6
mov dword [edi], ebx
call fcn.004642ea
int3

Function at 0x48d904
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x507584
call fcn.004980c9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0048d9ab
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x48d954
push ebx
push ebx
call fcn.004cc926
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x48d94a
mov eax, esi
call fcn.00498097
ret 4
push 6
mov dword [edi], ebx
call fcn.004642ea
int3

Function at 0x49175a
Capabilities:
Create process on windows

Disassembly:
push 0xe4
mov eax, 0x507c64
call fcn.00498168
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xe8], eax
mov eax, 0x52ce20
cmovne eax, ecx
mov ecx, edi
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00410309
lea ecx, [ebp - 0x44]
xor esi, esi
push ecx
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00426101
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 1
push ecx
push eax
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x533c90
mov dword [eax + 4], 5
lea eax, [ebp - 0x2c]
push eax
call fcn.00490346
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x4917e0
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x4917e8
mov edi, dword [edi]
push dword [ebp - 0xe8]
push dword [ebp - 0xdc]
push ebx
push esi
push esi
push esi
push esi
push esi
push eax
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040dc64
lea ecx, [ebp - 0x44]
call fcn.0040dc64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0040dc64
test esi, esi
je 0x4918a2
jmp 0x49189c
call fcn.004980ba
ret
push 0x312
push 0x533ba4
mov dword [ebp - 4], 2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0xd8]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xd8]
push eax
call fcn.004a1a51
int3
Function at 0x492356
Capabilities:
Accept command line arguments

Disassembly:
push 0x38
mov eax, 0x507dc0
call fcn.004980fc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x575ac4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x575a54]
cmp eax, dword [ecx + 4]
jg 0x492409
test esi, esi
jne 0x492397
mov esi, dword [0x575a50]
cmp dword [esi + 0x14], 0x10
jb 0x492397
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00492c76
add esp, 0xc
mov eax, dword [ebp - 0x30]
test eax, eax
mov dword [ebp - 4], 1
setne bl
test eax, eax
je 0x4923f9
lea eax, [ebp - 0x41]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409f40
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 5
push str.runas
push esi
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0047e6f5
add esp, 0x18
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0040dc3e
lea ecx, [ebp - 0x40]
call fcn.0040dc64
mov al, bl
call fcn.004980ab
ret
mov ebx, 0x575a54
push ebx
call fcn.00497f9b
cmp dword [0x575a54], 0xffffffff
pop ecx
jne 0x492385
and dword [ebp - 4], 0
push 0x50adbf
call fcn.00497e53
pop ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
mov edi, 0x575a58
push eax
mov ecx, edi
call fcn.0040154b
or dword [ebp - 4], 0xffffffff
push ebx
mov dword [0x575a50], edi
call fcn.00497f51
pop ecx
jmp 0x492385

Function at 0x493d75
Capabilities:
Terminate process

Disassembly:
push 0x94
mov eax, 0x508294
call fcn.00498168
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x493e30
jmp 0x493e08
test esi, esi
jne 0x493e10
xor al, al
jmp 0x493e2a
push dword [ebp + 0x10]
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
neg eax
sbb al, al
inc al
call fcn.004980ba
ret
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
push 0x523
push 0x533ba4
push 2
call fcn.004173ff
push 0x5519c4
lea eax, [ebp - 0x90]
push eax
call fcn.004a1a51
int3
Function at 0x499e83
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x5085aa
call fcn.004980c9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0049a108
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x499fee
push ebx
push ebx
call fcn.004cc926
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x499ec9
mov eax, esi
call fcn.00498097
ret 4
push 6
mov dword [edi], ebx
call fcn.004642ea
int3

Function at 0x49bb70
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push 0x118
mov eax, 0x508bd0
call fcn.00498168
mov dword [ebp - 0x110], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
movzx edi, byte [ebp + 0xc]
push eax
xor edi, 1
call fcn.0043ae0e
cmp dword [eax + 0x14], 8
jb 0x49bba0
mov eax, dword [eax]
xor esi, esi
push esi
push esi
push esi
push edi
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
lea ecx, [ebp - 0x2c]
mov ebx, eax
call fcn.0040dc64
test ebx, ebx
je 0x49bdb5
jmp 0x49bc37
mov edi, dword [ebp - 0x110]
push dword [sym.imp.WININET.dll_InternetCloseHandle]
add edi, 4
push ebx
mov ecx, edi
call fcn.0049b3dc
push 4
pop ebx
push ebx
lea eax, [ebp + 0x10]
push eax
push 2
push ecx
push ecx
mov ecx, esp
push edi
mov dword [ecx], esi
mov dword [ecx + 4], esi
call fcn.0049b29d
call fcn.0049b882
add esp, 0x14
lea eax, [ebp + 0x14]
push ebx
push eax
push 6
push ecx
push ecx
mov ecx, esp
push edi
mov dword [ecx], esi
mov dword [ecx + 4], esi
call fcn.0049b29d
call fcn.0049b882
add esp, 0x14
lea eax, [ebp + 0x14]
push ebx
push eax
push 8
push ecx
push ecx
mov ecx, esp
push edi
mov dword [ecx], esi
mov dword [ecx + 4], esi
call fcn.0049b29d
call fcn.0049b882
add esp, 0x14
lea eax, [ebp + 0x14]
push ebx
push eax
push 5
push ecx
push ecx
mov ecx, esp
push edi
mov dword [ecx], esi
mov dword [ecx + 4], esi
call fcn.0049b29d
call fcn.0049b882
add esp, 0x14
lea eax, [ebp + 0x14]
push ebx
push eax
push 7
push ecx
push ecx
mov ecx, esp
push edi
mov dword [ecx], esi
mov dword [ecx + 4], esi
call fcn.0049b29d
call fcn.0049b882
mov eax, dword [ebp - 0x110]
add esp, 0x14
cmp dword [eax + 0x34], esi
je 0x49bcfc
push edi
lea ecx, [eax + 0x10]
push esi
call fcn.0049b7e9
push esi
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x49bdad
push 0x6a
push 0x534758
mov dword [ebp - 4], 2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push ebx
lea ecx, [ebp - 0x10c]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x10c]
jmp 0x49bdde
call fcn.004980ba
ret 0x10
push 0x38
push 0x534758
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0xa8]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xa8]
push eax
call fcn.004a1a51
int3
Function at 0x49e349
Capabilities:
Check os version
Get storage device properties

Disassembly:
push 0x24
mov eax, 0x509056
call fcn.004980fc
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], eax
xor ebx, ebx
call fcn.0049d986
xor eax, eax
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersion]
push dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push 0x534ab8
push eax
call fcn.0049e1c6
mov esi, dword [ebp - 0x2c]
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x49e3b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x49e4c7
push 0x1001
call fcn.004ad1f4
mov edi, eax
pop ecx
test edi, edi
jne 0x49e3d1
push 8
jmp 0x49e4bd
push 0x1001
push ebx
push edi
call fcn.004a1820
add esp, 0xc
lea eax, [ebp - 0x24]
push ebx
push eax
push 0x1000
push edi
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x2d1400
push dword [ebp - 0x30]
call dword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
test eax, eax
jne 0x49e410
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x49e4be
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x49e4bb
cmp ecx, dword [ebp - 0x24]
jae 0x49e4bb
mov eax, dword [ebp - 0x20]
cmp al, 6
ja 0x49e486
jne 0x49e434
shr eax, 8
cmp al, 2
jae 0x49e486
lea ecx, [ebp - 0x20]
call fcn.0049d8cb
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
sub eax, dword [edi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0049f8cb
mov ecx, dword [edi + 0x18]
push eax
add ecx, edi
push 1
push ecx
call fcn.0049fe1f
add esp, 0xc
lea ecx, [ebp - 0x20]
push 0xffffffffffffffff
call fcn.0049fa7b
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
call fcn.0049dbda
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.0049fa63
jmp 0x49e4aa
lea eax, [ecx + edi]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x49e494
mov ecx, ebx
jmp 0x49e4a0
push eax
call fcn.004ad200
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x28]
push eax
call fcn.0049fb8d
mov ecx, dword [ebp - 0x28]
call fcn.0049fcf1
mov ecx, eax
call fcn.0049fc8a
jmp 0x49e4be
push 0xd
pop ebx
push dword [ebp - 0x30]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push edi
call fcn.004ad1d7
pop ecx
lea ecx, [esi - 0x10]
call fcn.0049fa63
mov eax, ebx
call fcn.004980ab
ret
Function at 0x49e82f
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x50910a
call fcn.004980c9
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
call fcn.0049d986
and dword [ebp - 4], edi
lea ecx, [ebp - 0x14]
and dword [ebp - 0x28], edi
xor ebx, ebx
and dword [ebp - 0x18], ebx
call fcn.0049d8cb
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push str..Scsi_u:
push eax
call fcn.0049e1c6
mov esi, dword [ebp - 0x1c]
add esp, 0xc
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x49e8a0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x49e9b8
push 0x3c
call fcn.004ad1f4
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x49e8b6
push 8
pop edi
jmp 0x49e9af
push 0x22c
call fcn.004ad1f4
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
test edi, edi
je 0x49e8ae
mov byte [ebp - 0xd], 0
jmp 0x49e8d3
mov edi, dword [ebp - 0x18]
push 0x3c
push 0
push ebx
call fcn.004a1820
push 0x22c
push 0
push edi
call fcn.004a1820
push 8
lea eax, [ebx + 4]
mov dword [ebx], 0x1c
push str.SCSIDISK
push eax
mov dword [ebx + 0xc], 0x1388
mov dword [ebx + 0x18], 0x210
mov dword [ebx + 0x10], 0x1b0501
call fcn.004d1b90
mov al, byte [ebp - 0xd]
add esp, 0x24
mov byte [ebx + 0x28], al
lea eax, [ebp - 0x28]
mov byte [ebx + 0x26], 0xec
push 0
push eax
push 0x22c
push edi
push 0x3c
push ebx
push 0x4d008
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
test eax, eax
jne 0x49e960
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov al, byte [ebp - 0xd]
inc al
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xd], al
cmp al, 2
jb 0x49e8d0
jmp 0x49e9af
add edi, 0x40
push 0x14
push edi
call fcn.0049fdf8
pop ecx
pop ecx
push 0x15
lea ecx, [ebp - 0x14]
call fcn.0049f8cb
push 0x14
push edi
push eax
mov byte [eax + 0x14], 0
call fcn.004d1b90
add esp, 0xc
lea ecx, [ebp - 0x14]
push 0xffffffffffffffff
call fcn.0049fa7b
lea ecx, [ebp - 0x14]
call fcn.0049fcf1
mov ecx, eax
call fcn.0049fc8a
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.0049dbda
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push ebx
call fcn.004ad1d7
push dword [ebp - 0x18]
call fcn.004ad1d7
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0049fa63
lea ecx, [esi - 0x10]
call fcn.0049fa63
mov eax, edi
call fcn.00498097
ret
Function at 0x49f637
Capabilities:
Get common file path
Get disk information
Get disk information via ioctl

Disassembly:
push 0x24
mov eax, 0x5091f2
call fcn.004980fc
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x30], eax
call fcn.0049d986
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0049d986
lea ecx, [ebp - 0x20]
call fcn.0049d986
and dword [ebp - 0x2c], 0
lea edi, [ebp - 0x1c]
xor eax, eax
mov byte [ebp - 4], 2
stosd dword es:[edi], eax
lea ecx, [ebp - 0x24]
push 0x105
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0049f907
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x49f69e
call esi
mov ebx, eax
jmp 0x49f6a0
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.0049faa7
mov edi, dword [ebp - 0x24]
test ebx, ebx
jne 0x49f78b
push 0x105
lea ecx, [ebp - 0x28]
call fcn.0049f907
push 0x104
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
test eax, eax
jne 0x49f6d7
call esi
mov ebx, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.0049faa7
test ebx, ebx
jne 0x49f78b
push 0x105
lea ecx, [ebp - 0x20]
call fcn.0049f907
mov esi, dword [ebp - 0x28]
push 0x104
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x49f712
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.0049faa7
test ebx, ebx
jne 0x49f78e
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.0049fd46
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push eax
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x49f74f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x49f78e
xor edx, edx
lea ecx, [ebp - 0x2c]
push edx
push ecx
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
push edx
push edx
push 0x2d1080
push eax
call dword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
test eax, eax
jne 0x49f778
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x49f780
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x49f78e
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0049fa63
lea ecx, [esi - 0x10]
call fcn.0049fa63
lea ecx, [edi - 0x10]
call fcn.0049fa63
mov eax, ebx
call fcn.004980ab
ret

Function at 0x4a0160
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d5ad4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d56af

Function at 0x4d5adf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5839

Function at 0x4e1286
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e0c3e

Function at 0x4e16f6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e15ca
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47d004]
jne 0x401010
repz ret
jmp fcn.0040169c

Function at 0x4077b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ed2
and dword [ebp - 4], 0
cmp dword [0x47f55c], 0
mov ebx, eax
jne 0x407866
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407917
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407917
push eax
call fcn.00404e60
mov dword [esp], 0x47aa4c
push edi
mov dword [0x47f55c], eax
call esi
push eax
call fcn.00404e60
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47f560], eax
call esi
push eax
call fcn.00404e60
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47f564], eax
call esi
push eax
call fcn.00404e60
pop ecx
mov dword [0x47f56c], eax
test eax, eax
je 0x407866
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e60
pop ecx
mov dword [0x47f568], eax
mov eax, dword [0x47f568]
cmp eax, ebx
je 0x4078be
cmp dword [0x47f56c], ebx
je 0x4078be
push eax
call fcn.00404edb
push dword [0x47f56c]
mov esi, eax
call fcn.00404edb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4078be
test edi, edi
je 0x4078be
call esi
test eax, eax
je 0x4078b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4078b5
test byte [ebp - 0xc], 1
jne 0x4078be
or dword [ebp + 0x10], 0x200000
jmp 0x4078f7
mov eax, dword [0x47f560]
cmp eax, ebx
je 0x4078f7
push eax
call fcn.00404edb
pop ecx
test eax, eax
je 0x4078f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4078f7
mov eax, dword [0x47f564]
cmp eax, ebx
je 0x4078f7
push eax
call fcn.00404edb
pop ecx
test eax, eax
je 0x4078f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47f55c]
call fcn.00404edb
pop ecx
test eax, eax
je 0x407917
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407919
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret