joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e7d3
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
pop esi
push esi
xor ebx, ebx
mov dword [ebp - 0x108], ecx
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0056b050
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.0056b050
push 7
xor eax, eax
mov byte [ebp - 0x24], bl
pop ecx
lea edi, [ebp - 0x23]
mov byte [ebp - 0x44], bl
rep stosd dword es:[edi], eax
push 7
pop ecx
push esi
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc4]
push eax
call fcn.0056b050
mov edi, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
add esp, 0x24
mov ecx, edi
push esi
push eax
push dword [ebp + 8]
call fcn.004395b8
mov ecx, ebx
movsx eax, byte [ecx + str.:2_]
mov al, byte [ebp + eax - 0x105]
mov byte [ebp + ecx - 0x84], al
inc ecx
cmp ecx, esi
jl 0x46e85b
push 0x20
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0056a550
push 0x20
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0056a550
add esp, 0x18
mov esi, ebx
push dword [ebp + 0xc]
mov ecx, edi
push 0xf
pop eax
sub eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0043aca3
inc esi
cmp esi, 0x10
jl 0x46e89b
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0056a550
push 0x20
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0056a550
add esp, 0x18
lea edx, [edi + 0x640]
movsx eax, byte [ebx + 0x6075e0]
mov al, byte [ebp + eax - 0xc5]
mov byte [edx + ebx], al
inc ebx
cmp ebx, 0x40
jl 0x46e8e6
push 0x40
push edx
lea eax, [edi + 0x688]
mov ecx, edi
push eax
call fcn.00439506
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 8
Function at 0x46ed44
Capabilities:
Delete registry key

Disassembly:
push 0x10
mov eax, 0x5cdd0b
call fcn.00506dc7
mov ebx, ecx
xor edi, edi
push edi
push ecx
mov esi, esp
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x14], eax
call fcn.00412393
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.0049d5d8
test eax, eax
jne 0x46ed84
inc edi
jmp 0x46ee4c
push dword [ebp - 0x14]
call fcn.00412393
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
lea ecx, [ebx + 0x10]
mov byte [ebp - 4], 1
mov dword [esp], 0x5f1b30
call fcn.0042e677
test eax, eax
je 0x46edfa
push 0x5f1b04
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0042dfbd
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043910d
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00411f3a
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, dword [ebp - 0x10]
cmp dword [ebx + 0x14], edi
je 0x46ee37
cmp dword [ebx + 4], 0x100
jne 0x46ee37
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x46ee41
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46ee41
push edi
push dword [ebx + 4]
push esi
push dword [ebx + 8]
call eax
test eax, eax
je 0x46ee41
jmp 0x46ee44
push esi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x14]
call fcn.00412ac4
mov eax, edi
call fcn.00506d90
ret 4
Function at 0x46f2bf
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov eax, dword [ecx + 4]
or eax, 2
push eax
push edi
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46f300
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x46f300
inc edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4737ef
Capabilities:
Download url
Receive data

Disassembly:
push 0x2a8
mov eax, 0x5cdf5f
call fcn.00506dfb
call fcn.0041279d
push eax
lea ecx, [ebp - 0x28c]
call fcn.00411d94
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.https:__dat.ruanmei.com_pcmaster_upgrade6s.xml
lea eax, [ebp - 0x28c]
push 0x6016f0
push eax
call fcn.00412690
add esp, 0x10
lea ecx, [ebp - 0x290]
push 0x601734
call fcn.00413f09
mov edi, dword [ebp - 0x28c]
lea eax, [ebp - 0x284]
push esi
push eax
push esi
push esi
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 1
push eax
push edi
mov dword [ebp - 0x284], esi
call fcn.00493959
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4739f6
lea ecx, [ebp - 0x280]
mov dword [ebp - method.CMyUpgrade.virtual_0], vtable.CTiXmlConfig.0
call fcn.00496839
push 0x682aa8
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push 0x40
push eax
call fcn.005a019b
add esp, 0xc
lea ecx, [ebp - 0x280]
push esi
push dword [ebp - 0x284]
push ebx
call fcn.004c326b
push str.UpdateList
lea ecx, [ebp - 0x280]
call fcn.004da342
call fcn.0041279d
push eax
lea ecx, [ebp - 0x284]
call fcn.00411d94
push str.rmup_f
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x280]
call fcn.00489c2b
mov eax, dword [ebp - 0x288]
mov byte [ebp - 4], 4
cmp dword [eax - 0xc], esi
je 0x4739c8
lea ecx, [ebp - 0x2b4]
call fcn.0042ca82
mov esi, dword [ebp - 0x288]
mov byte [ebp - 4], 5
cmp dword [esi - 4], 1
jle 0x473935
push dword [esi - 0xc]
lea ecx, [ebp - 0x288]
call fcn.00412624
mov esi, dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
lea eax, [ebp - 0x284]
push str.https:__d.ruanmei.com_s_skq_d
push eax
call fcn.00412690
add esp, 0x10
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x298], esp
push 0x60179c
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 6
call fcn.0043944c
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00434114
mov esi, dword [ebp - 0x284]
push dword [eax]
push esi
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov ecx, dword [ebp - 0x294]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x2b4]
call fcn.0042e60b
mov ecx, dword [ebp - 0x2a4]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x4739ce
mov esi, dword [ebp - 0x284]
push ebx
call fcn.00506f36
pop ecx
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x280]
call fcn.00456baa
mov ecx, dword [ebp - 0x290]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [edi - 0x10]
call fcn.00412ac4
call fcn.00506da5
ret
Function at 0x4799bc
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x5ce94f
call fcn.00506dc7
xor edi, edi
lea eax, [ebp - 0x60]
push 0x40
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0056b050
add esp, 0xc
mov dword [ebp - 0x64], 0x44
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 5
pop eax
mov word [ebp - 0x34], ax
xor ebx, ebx
mov eax, dword [ebp + 8]
inc ebx
add eax, 0xfffffff0
mov dword [ebp - 0x38], ebx
push eax
call fcn.00412393
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], bl
cmp dword [esi - 4], ebx
jle 0x479a2a
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00412624
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push edi
push edi
push ebx
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x479a58
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x1c]
call edi
mov edi, ebx
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506d90
ret

Function at 0x479a73
Capabilities:
Query environment variable

Disassembly:
push 0x80c
mov eax, 0x5ce994
call fcn.00506dfb
mov esi, dword [ebp + 8]
and dword [ebp - 0x814], 0
mov dword [ebp - 0x818], esi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
add edi, 0xfffffff0
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov dword [esp], 0x800
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 0x814], ebx
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x1f4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x479b03
lea eax, [ebp - 0x810]
push eax
push 0x604b6c
push esi
call fcn.00412690
add esp, 0xc
mov ecx, esi
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
mov ecx, edi
call fcn.00412ac4
mov eax, esi
call fcn.00506da5
ret
Function at 0x479ef9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x479f1f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x479f1f
test al, 0x10
jne 0x479f1f
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x47e487
Capabilities:
Get geographical location

Disassembly:
push 0x68
mov eax, 0x5cf37c
call fcn.00506dfb
mov edi, dword [ebp + 8]
mov ecx, edi
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x54], 0
push ebx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x50], ebx
call fcn.00413f09
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push 0x18
push 0
push eax
mov dword [ebp - 0x54], 1
call fcn.0056b050
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x38]
add esp, 0xc
push 0x13
push eax
push 0xe
push 0x400
call esi
lea eax, [ebp - 0x38]
push 0x13
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x4c]
push eax
push 0xf
push 0x400
call esi
lea eax, [ebp - 0x4c]
push 0x13
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x24]
push eax
push 0x12
push 0x400
call esi
lea eax, [ebp - 0x24]
push eax
call fcn.0058a233
pop ecx
push 0x13
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x24]
push eax
push 0x10
push 0x400
call esi
lea eax, [ebp - 0x24]
push eax
call fcn.0058a233
pop ecx
push 0x13
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x24]
push eax
push 0x1010
push 0x400
call esi
lea eax, [ebp - 0x24]
push eax
call fcn.0058a233
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
pop ecx
cmp esi, 0xffffffff
jne 0x47e591
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call fcn.00413f09
push 0
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.0042ea61
mov edx, eax
mov eax, dword [ebp - 0x58]
cmp edx, esi
jne 0x47e57f
xor esi, esi
jmp 0x47e589
mov ecx, dword [edi]
mov esi, dword [ecx - 0xc]
sub esi, dword [eax - 0xc]
sub esi, edx
lea ecx, [eax - 0x10]
call fcn.00412ac4
push ebx
mov dword [ebp - 0x70], esi
call fcn.0057600b
imul esi, eax, 3
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 0x64]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00506f2d
pop ecx
pop ecx
mov ebx, eax
lea eax, [esi + 0x63]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x50]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
je 0x47e5dd
push ebx
mov ecx, edi
call fcn.0041421f
test ebx, ebx
je 0x47e5e8
push ebx
call fcn.00506f36
pop ecx
xor esi, esi
lea eax, [ebp - 0x50]
inc esi
mov ecx, edi
push esi
push eax
call fcn.0043189c
push 0x602cf0
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0042e677
mov ecx, dword [ebp - 0x50]
mov ebx, eax
neg ebx
mov byte [ebp - 4], 0
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
add bl, 1
je 0x47e64c
push edi
lea eax, [ebp - 0x50]
push 0x602cf8
push eax
call fcn.0042e01c
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.00411f3a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506da5
ret
Function at 0x48024c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 4
mov edi, ecx
call fcn.00506ecd
mov edx, dword [ebp + 8]
mov esi, eax
push 8
mov dword [esi], edx
call fcn.00506ecd
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push 4
push eax
push 0x4e8c92
push edx
mov dword [eax], edi
mov dword [eax + 4], esi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x20
test esi, esi
je 0x48029e
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4806fe
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x5cf79a
call fcn.00506dc7
xor ebx, ebx
push ebx
push SysReAllocString
call fcn.004802ef
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov esi, eax
push edi
call fcn.004802ef
add esp, 0x10
or esi, eax
call fcn.00430f47
test eax, eax
je 0x48073f
push 1
push edi
call fcn.004802ef
pop ecx
pop ecx
or esi, eax
lea ecx, [ebp - 0x34]
call fcn.0042ca82
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x6005b8
mov dword [ebp - 4], ebx
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0043e68b
lea eax, [ebp - 0x10]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x34]
call fcn.00434114
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
cmp dword [eax - 0xc], 0
je 0x480794
push eax
call edi
test eax, eax
je 0x480794
or esi, 1
call fcn.0042fb20
cmp eax, 0x1f
jl 0x4807f9
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x600650
call fcn.00411dbd
push ecx
push esp
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004ed062
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
je 0x4807fc
push eax
call edi
test eax, eax
je 0x4807f9
or esi, 0x40000
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x34]
call fcn.0042e60b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, esi
call fcn.00506d90
ret
Function at 0x480eb3
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.00506ecd
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push 4
push eax
push 0x4e8d14
push edx
mov dword [eax], edi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x480ef4
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4824f9
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x5cfc54
call fcn.00506dc7
and dword [ebp - 0x10], 0
push dword [ebp + 0xc]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x482543
push 0x5c
push dword [ebp + 0xc]
call fcn.0056bc73
pop ecx
pop ecx
test eax, eax
jne 0x48252f
or eax, 0xffffffff
jmp 0x482534
sub eax, dword [ebp + 0xc]
sar eax, 1
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0043189c
jmp 0x482550
mov ecx, dword [ebp + 8]
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, dword [ebp + 8]
call fcn.00506d90
ret 8

Function at 0x482566
Capabilities:
Get disk size

Disassembly:
push 0x20
mov eax, 0x5cfc77
call fcn.00506dc7
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push 2
push 0
push eax
lea ecx, [ebp + 8]
call fcn.004319b1
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4825cb
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.005076f0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x5f1f20]
mulss xmm1, xmm0
mulss xmm1, xmm0
mulss xmm1, xmm0
cvtps2pd xmm0, xmm1
jmp 0x4825ce
xorps xmm0, xmm0
lea ecx, [esi - 0x10]
movsd qword [ebp - 0x14], xmm0
call fcn.00412ac4
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
fld qword [ebp - 0x14]
call fcn.00506d90
ret 4

Function at 0x4830fa
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.00506ecd
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push 4
push eax
push 0x4e8d4d
push edx
mov dword [eax], edi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x48313b
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x483d67
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
xor edx, edx
pop esi
pop ebp
ret
Function at 0x483ecf
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information

Disassembly:
push 0x330
mov eax, 0x5d013a
call fcn.00506dfb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x33c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0041279d
push eax
lea ecx, [ebp - 0x330]
call fcn.00411d94
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 1
push eax
push 0x64
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4840db
lea esi, [ebp - 0xd8]
cmp word [ebp - 0xd8], di
je 0x4840db
push esi
lea ecx, [ebp - 0x334]
call fcn.00413f09
push 0x250
lea eax, [ebp - 0x328]
mov byte [ebp - 4], 2
push ebx
push eax
call fcn.0056b050
push 0x61cfd8
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.0042dfbd
add esp, 0x18
lea ecx, [ebp - 0x328]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x338]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.00412ac4
cmp ebx, 0xffffffff
je 0x4840a1
test byte [ebp - 0x328], 0x10
je 0x484057
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [ebp - 0x32c]
call fcn.00413f09
mov eax, dword [ebp - 0x32c]
mov byte [ebp - 4], 3
cmp dword [eax - 4], 1
jle 0x483fd5
push dword [eax - 0xc]
lea ecx, [ebp - 0x32c]
call fcn.00412624
mov eax, dword [ebp - 0x32c]
push 0x60ce98
push eax
call fcn.0059b558
pop ecx
pop ecx
test eax, eax
je 0x484045
mov eax, dword [ebp - 0x32c]
cmp dword [eax - 4], 1
jle 0x484006
push dword [eax - 0xc]
lea ecx, [ebp - 0x32c]
call fcn.00412624
mov eax, dword [ebp - 0x32c]
push 0x60ce9c
push eax
call fcn.0059b558
pop ecx
pop ecx
test eax, eax
je 0x484045
push dword [ebp + 0xc]
lea eax, [ebp - 0x330]
push dword [ebp - 0x32c]
push esi
push 0x61cfdc
push eax
call fcn.00412690
add esp, 0x14
push dword [ebp - 0x330]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48406f
mov ecx, dword [ebp - 0x32c]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea eax, [ebp - 0x328]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x483f92
jmp 0x484096
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x330]
push eax
call fcn.004366b4
mov ecx, dword [ebp - 0x32c]
xor edi, edi
inc edi
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
jne 0x4840cd
mov ecx, dword [ebp - 0x334]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push esi
call fcn.0057600b
xor ebx, ebx
pop ecx
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], bx
jne 0x483f2d
jmp 0x4840db
mov ecx, dword [ebp - 0x334]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x330]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506da5
ret 8
Function at 0x4840fe
Capabilities:
Check if file exists
Get disk information

Disassembly:
push 0xd0
mov eax, 0x5d0175
call fcn.00506dfb
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0041279d
push eax
lea ecx, [ebp - 0xdc]
call fcn.00411d94
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 1
push eax
push 0x64
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48419b
lea esi, [ebp - 0xd8]
cmp word [ebp - 0xd8], di
je 0x48419b
push dword [ebp + 0xc]
lea eax, [ebp - 0xdc]
push esi
push 0x61cfcc
push eax
call fcn.00412690
add esp, 0x10
push dword [ebp - 0xdc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x484187
lea eax, [ebp - 0xdc]
mov ecx, ebx
push eax
call fcn.004366b4
xor edi, edi
inc edi
push esi
call fcn.0057600b
pop ecx
lea esi, [esi + eax*2]
xor eax, eax
add esi, 2
cmp word [esi], ax
jne 0x48414e
mov ecx, dword [ebp - 0xdc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506da5
ret 8

Function at 0x484991
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d0c
call fcn.00506f00
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
call fcn.004124d1
xor esi, esi
push esi
lea eax, [ebp - 0x204]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4849f8
inc esi
cmp esi, 4
jl 0x4849b7
jmp 0x484a9f
and dword [ebp - 0x2d0c], 0
lea eax, [ebp - 0x2cfc]
mov esi, 0x2710
push esi
push 0
push eax
call fcn.0056b050
push 0xc
lea eax, [ebp - 0x2d08]
push 0
push eax
call fcn.0056b050
xor eax, eax
push esi
push eax
mov dword [ebp - 0x2d08], eax
mov dword [ebp - 0x2d04], eax
lea eax, [ebp - 0x2cfc]
push eax
call fcn.0056b050
add esp, 0x24
lea eax, [ebp - 0x2d0c]
push 0
push eax
push esi
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x484a9f
lea eax, [ebp - 0x5ec]
push eax
push 1
push dword [ebp - 0x2ce4]
lea eax, [ebp - 0x2cfc]
push eax
call fcn.004fe804
add esp, 0x10
lea eax, [ebp - 0x5ec]
mov ecx, ebx
push eax
call fcn.00411f8a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret