joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100461bf
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100461d5
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
jmp 0x100461eb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100461eb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret

Function at 0x10046727
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10046795
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x100467ae
push 0
push 0
push 0
push 0
push 0
push 0
push 0x199
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret

Function at 0x10047347
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004738e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x10047396
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x1007d375
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10087330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006e17c
mov dword [ebp - 0x14], eax
cmp dword [0x10673cc4], esi
jne 0x1007d468
push 0x800
push esi
push 0x1000799c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007d3f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007d548
push esi
push esi
push 0x1000799c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007d548
push 0x100079b4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007d548
push eax
call ebx
push 0x100079c0
push edi
mov dword [0x10673cc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079d0
push edi
mov dword [0x10673cc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079e4
push edi
mov dword [0x10673ccc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10673cd4], eax
test eax, eax
je 0x1007d465
push 0x10007a00
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10673cd0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007d48d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007d480
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007d4a2
push 4
pop eax
jmp 0x1007d54a
cmp dword [ebp - 0x14], esi
je 0x1007d4a2
push dword [0x10673cc4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007d487
mov eax, dword [0x10673cd0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007d500
cmp dword [0x10673cd4], edi
je 0x1007d500
push eax
call ebx
push dword [0x10673cd4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007d500
test eax, eax
je 0x1007d500
call ecx
test eax, eax
je 0x1007d4f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007d4f5
test byte [ebp - 8], 1
jne 0x1007d500
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007d530
mov eax, dword [0x10673cc8]
cmp eax, edi
je 0x1007d52d
push eax
call ebx
test eax, eax
je 0x1007d52d
call eax
mov esi, eax
test esi, esi
je 0x1007d52d
mov eax, dword [0x10673ccc]
cmp eax, edi
je 0x1007d52d
push eax
call ebx
test eax, eax
je 0x1007d52d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10673cc4]
call ebx
test eax, eax
je 0x1007d548
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007d54a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x404300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [0x41660c]
test edi, edi
je 0x404340
push esi
push edi
call fcn.00405a0d
mov esi, eax
push edi
push esi
call fcn.00404770
push esi
mov edi, eax
call fcn.004059d3
add esp, 0x10
pop esi
test edi, edi
jle 0x40433b
sub dword [0x41660c], edi
je 0x404340
xor eax, eax
pop edi
pop ebp
ret
mov eax, edi
pop edi
pop ebp
ret
pop edi
pop ebp
jmp fcn.00404770

Function at 0x4055c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4156c0]
jne 0x4055ce
repz ret
jmp fcn.004099cc

Function at 0x40cb29
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4156c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040680e
and dword [ebp - 0x14], 0
cmp dword [0x417280], 0
mov dword [ebp - 0x18], eax
jne 0x40cbdc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40cc84
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40cc84
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x417280], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x417284], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x417288], eax
call edi
push eax
call esi
mov dword [0x417290], eax
test eax, eax
je 0x40cbdc
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41728c], eax
mov eax, dword [0x41728c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cc35
cmp dword [0x417290], ecx
je 0x40cc35
push eax
call esi
push dword [0x417290]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cc35
test ebx, ebx
je 0x40cc35
call edi
test eax, eax
je 0x40cc2c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cc2c
test byte [ebp - 8], 1
jne 0x40cc35
or dword [ebp + 0x10], 0x200000
jmp 0x40cc68
mov eax, dword [0x417284]
cmp eax, dword [ebp - 0x18]
je 0x40cc68
push eax
call esi
test eax, eax
je 0x40cc68
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cc68
mov eax, dword [0x417288]
cmp eax, dword [ebp - 0x18]
je 0x40cc68
push eax
call esi
test eax, eax
je 0x40cc68
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x417280]
call esi
test eax, eax
je 0x40cc84
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cc86
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004055c4
leave
ret
Function at 0x11671174
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x117d3ed8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
test eax, eax
jne 0x116711b4
mov esi, str.Wtsapi32.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1167119f
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x117d3ed8], eax
je 0x11671202
push ebx
push dword [ebp + 8]
call eax
mov edi, eax
test edi, edi
jne 0x11671202
call fcn.116db1f0
cmp eax, dword [ebp + 8]
je 0x11671202
push 1
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.116c7ae0
call fcn.11671dd4
push eax
call fcn.116c8730
add esp, 0x10
mov esi, eax
push ebx
push dword [ebp + 8]
call dword [0x117d3ed8]
test esi, esi
mov edi, eax
je 0x11671202
call fcn.116c8a40
xor eax, eax
cmp dword [0x117e1700], eax
je 0x11671230
cmp ebx, eax
je 0x11671212
mov eax, dword [ebx]
push eax
push dword [ebp + 8]
push edi
push str.CAdminTokenMgr::UseWTSQueryUserToken__Ret___d__dwSessionId__d__hToken__08x_
push str.AdminToken
push 0xffffffffffffffff
push 0x117e0e6c
call fcn.116deab0
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x11671346
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
je 0x11671429
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 8]
push eax
push 2
push dword [ebp + 8]
call fcn.116710b2
add esp, 0x10
test eax, eax
je 0x11671418
cmp dword [ebp - 8], ebx
je 0x11671418
lea eax, [ebp - 4]
mov byte [ebp - 0x1c], bl
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x1c]
push 2
push eax
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x11671418
push esi
push edi
mov edi, dword [ebp - 8]
xor esi, esi
cmp dword [edi], ebx
jbe 0x11671416
lea eax, [edi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x116713f6
add dword [ebp - 0xc], 8
inc esi
cmp esi, dword [edi]
jb 0x116713d9
jmp 0x11671416
test byte [edi + esi*8 + 8], 8
push 1
lea eax, [edi + esi*8 + 8]
pop ecx
mov dword [ebp - 0x10], ecx
je 0x1167140c
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
test byte [eax], 4
je 0x11671416
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
pop edi
pop esi
cmp dword [ebp - 4], ebx
je 0x11671429
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call fcn.116710a0
cmp dword [0x117e1700], ebx
pop ecx
pop ebx
je 0x11671464
mov eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
push dword [ebp - 0x10]
push str.CAdminTokenMgr::IsInAdminGroup__bIsAdmin___d__hToken__08x__bOwner___d___bEnabled__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117e0e6c
call fcn.116deab0
add esp, 0x20
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x116716f2
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
je 0x11671784
cmp dword [ebp + 0x18], edi
je 0x11671784
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1167164d
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
je 0x11671784
mov esi, dword [ebp + 0x14]
cmp esi, 0xffffffff
je 0x11671742
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push ebx
call fcn.116c60c0
pop ecx
test eax, eax
pop ecx
je 0x1167177b
cmp dword [ebp - 8], esi
jne 0x1167177b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 1
push ebx
call fcn.116710b2
add esp, 0x10
test eax, eax
je 0x1167177b
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x1167177b
push dword [eax]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1167177b
push ebx
call fcn.116712db
cmp dword [ebp + 0x18], eax
pop ecx
jbe 0x11671784
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push dword [ebp - 4]
call fcn.116710a0
cmp dword [0x117e1700], 0
pop ecx
mov edi, str.CAdminTokenMgr::IsMatchProcessToken__Match___d___hNewToken__08x___dwTargetProcessId___d____hTargetHandle__08x____dwSessionId__d_
mov esi, 0x117e0e6c
je 0x116717c3
push dword [ebp + 0x14]
xor eax, eax
test ebx, ebx
push dword [ebp + 0xc]
setne al
push dword [ebp + 8]
push ebx
push eax
push edi
push str.AdminTokenAll
push 0xffffffffffffffff
push esi
call fcn.116deab0
add esp, 0x24
test ebx, ebx
je 0x116717ed
cmp dword [0x117e1700], 0
je 0x116717ed
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 1
push edi
push str.AdminToken
push 0xffffffffffffffff
push esi
call fcn.116deab0
add esp, 0x24
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x11676a5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1178bea4
call fcn.116e0880
sub esp, 0x434
cmp dword [0x117defd4], 0
je 0x11676a7f
mov eax, dword [0x117defd0]
jmp 0x11676c2d
push ebx
push esi
push edi
push 1
pop eax
mov esi, 0x20019
mov dword [0x117defd4], eax
mov dword [0x117defd0], eax
call fcn.116f3a70
test eax, eax
je 0x11676aa2
mov esi, 0x20219
lea ecx, [ebp - 0x18]
call fcn.116b5210
and dword [ebp - 4], 0
push esi
push str.softwareTECOcular.3Agent
push SysStringLen
lea ecx, [ebp - 0x18]
call fcn.116b5380
push 4
test eax, eax
pop ebx
je 0x11676b23
mov esi, str.RunAs
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.116b7850
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.116b5520
movzx eax, al
test eax, eax
jne 0x11676af3
and dword [0x117defd0], eax
jmp 0x11676b13
push 2
pop ecx
cmp eax, ecx
jne 0x11676b02
mov dword [0x117defd0], ecx
jmp 0x11676b13
push 3
pop ecx
cmp eax, ecx
je 0x11676afa
cmp eax, ebx
jne 0x11676b13
mov dword [0x117defd0], ebx
lea ecx, [ebp - 0x18]
call fcn.116b53d0
test edi, edi
jne 0x11676c16
and word [ebp - 0x238], 0
mov edx, 0x81
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x236]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x43e]
mov word [ebp - 0x440], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x440]
push 0x104
push eax
call fcn.116cbd00
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], esi
add esp, 0xc
mov dword [ebp - 0x24], str.ingress_sdm.exe
mov dword [ebp - 0x20], str.ist.exe
mov dword [ebp - 0x1c], str.OGuard.exe
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 3
lea esi, [ebp - 0x24]
mov ebx, 0x103
push dword [esi]
lea eax, [ebp - 0x440]
push eax
push 0x117b01ec
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.116e1000
add esp, 0x14
lea eax, [ebp - 0x238]
push eax
call edi
cmp eax, 0xffffffff
je 0x11676bfc
lea eax, [ebp - 0x440]
push str.winrdlv3.exe
push eax
push 0x117b01ec
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.116e1000
add esp, 0x14
lea eax, [ebp - 0x238]
push eax
call edi
cmp eax, 0xffffffff
je 0x11676c0a
inc dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 3
jb 0x11676ba1
jmp 0x11676c16
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [0x117defd0], eax
mov esi, dword [0x117defd0]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.116b5300
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x1167700e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1178bf10
call fcn.116e0880
sub esp, 0x22c
and dword [ebp - 0x20], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [ebp - 0x1c], ecx
je 0x11677250
mov ecx, dword [ebp + 0xc]
push esi
call fcn.116a6a10
push esi
call fcn.116e0997
cmp eax, 1
pop ecx
jl 0x11677250
mov ax, word [esi]
cmp ax, 0x61
jb 0x1167705b
cmp ax, 0x7a
jbe 0x1167706f
cmp ax, 0x41
jb 0x11677250
cmp ax, 0x5a
ja 0x11677250
cmp word [esi + 2], 0x3a
jne 0x11677250
mov ecx, dword [0x11794eec]
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
movzx eax, ax
push eax
lea eax, [ebp - 0x14]
push 0x117b247c
push eax
call fcn.116a9710
mov eax, dword [0x11794eec]
add esp, 0xc
mov dword [ebp - 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov byte [ebp - 4], 1
mov ebx, 0x103
and word [ebp - 0x238], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x236]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
push ebx
push eax
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x238]
push eax
call fcn.116e0997
test eax, eax
pop ecx
jbe 0x1167710a
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x14]
push eax
call fcn.116a6a10
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x10]
push eax
call fcn.116a6a10
jmp 0x116770b3
lea ecx, [ebp - 0x30]
call fcn.11677481
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp dword [eax - 8], 0
jne 0x116771b4
lea eax, [ebp - 0x14]
push 0x5c
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.116a7de0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.116774bc
lea ecx, [ebp - 0x30]
call fcn.116775ac
test eax, eax
je 0x11677220
and word [ebp - 0x238], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x236]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
push ebx
push eax
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x238]
push eax
call fcn.116e0997
test eax, eax
pop ecx
jbe 0x116771a8
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x14]
push eax
call fcn.116a6a10
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x10]
push eax
call fcn.116a6a10
jmp 0x11677151
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.116a6790
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.116a5d90
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
call fcn.11677264
test eax, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
je 0x116771f1
call fcn.116a6790
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.116a5d90
jmp 0x116771c0
call fcn.116a6790
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x1167722c
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push eax
push 0x117b2470
push dword [ebp + 0xc]
call fcn.116a9710
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x1167722c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.116a6790
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.116774b1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.116a6790
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.116a6790
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x11677425
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x1167747b
push esi
call fcn.116e0997
cmp eax, 2
pop ecx
jb 0x1167747b
mov ax, word [esi]
cmp ax, 0x5c
jne 0x11677450
cmp word [esi + 2], ax
je 0x11677478
mov word [ebp - 8], ax
mov ax, word [esi + 2]
mov word [ebp - 6], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 4], di
mov word [ebp - 2], di
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x11677478
cmp eax, 1
jne 0x1167747b
push 1
pop edi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1167b046
Capabilities:
Find taskbar
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebx + ebx]
xor esi, esi
push eax
push esi
push dword [ebp + 8]
call fcn.116e0420
add esp, 0xc
call fcn.116f3b00
test eax, eax
je 0x1167b118
push 0x31
xor eax, eax
pop ecx
lea edi, [ebp - 0xc6]
mov word [ebp - 0xc8], si
push esi
rep stosd dword es:[edi], eax
push str.Shell_TrayWnd
push esi
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, esi
je 0x1167b0a9
lea ecx, [ebp - 0xc8]
push ecx
push eax
call fcn.1167b180
lea eax, [ebp - 0xc8]
push eax
call fcn.116e0997
test eax, eax
pop ecx
jne 0x1167b0f1
push 0x41
push esi
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov edi, eax
cmp edi, esi
jne 0x1167b0d7
xor eax, eax
jmp 0x1167b17b
lea eax, [ebp - 0xc8]
push eax
push fcn.1167b180
push edi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea eax, [ebp - 0xc8]
push eax
call fcn.116e0997
cmp eax, ebx
pop ecx
jae 0x1167b0d0
lea eax, [ebp - 0xc8]
push eax
push dword [ebp + 8]
call fcn.116e0f2f
pop ecx
pop ecx
push 1
pop eax
jmp 0x1167b17b
push 0x31
xor eax, eax
pop ecx
lea edi, [ebp - 0xc6]
mov word [ebp - 0xc8], si
mov dword [ebp + 0xc], 0x64
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
cmp edi, esi
je 0x1167b169
lea eax, [ebp - 0xc8]
push eax
call fcn.116e0997
cmp eax, ebx
pop ecx
jae 0x1167b0d0
lea eax, [ebp - 0xc8]
jmp 0x1167b108
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x1167b179
push 1
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret