joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033300
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x100816f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.10037240
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.100327c0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1003336a
mov al, byte [edi + ecx]
test al, al
je 0x1003336a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10033351
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1003338b
inc eax
sub ecx, 1
jne 0x10033380
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x100333e0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x100333d5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x100333d4
mov bl, byte [edi + ecx]
test bl, bl
je 0x100333d4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x100333c0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.10037240
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x1006cccc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1003349a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10033464
test cl, cl
je 0x10033460
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10033464
add eax, 2
add esi, 2
test cl, cl
jne 0x10033444
xor eax, eax
jmp 0x10033469
sbb eax, eax
or eax, 1
test eax, eax
je 0x1003349a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10033476
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100334a3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x1006cccc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002be91
mov esp, ebp
pop ebp
ret
Function at 0x100358f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.10035a20
add esp, 8
test al, al
je 0x10035915
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10035915
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x10035a20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x10035da0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10035dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10035dcb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x100520ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10051d6e
Function at 0x4013b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x414b00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4013e8
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edi
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x402616
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410020]
jne 0x402620
repz ret
jmp fcn.0040318e

Function at 0x407d5d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040538a
xor ebx, ebx
cmp dword [0x415564], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x407e32
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x407d9d
xor eax, eax
jmp 0x407ef6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x407d96
push eax
call fcn.00405327
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x415564], eax
call esi
push eax
call fcn.00405327
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415568], eax
call esi
push eax
call fcn.00405327
mov dword [0x41556c], eax
lea eax, [ebp - 8]
push eax
call fcn.004041eb
test eax, eax
pop ecx
pop ecx
je 0x407e00
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040758c
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x407e32
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00405327
cmp eax, ebx
pop ecx
mov dword [0x415574], eax
je 0x407e32
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405327
pop ecx
mov dword [0x415570], eax
mov eax, dword [0x415570]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x407eab
cmp dword [0x415574], esi
je 0x407eab
push eax
call fcn.00405393
pop ecx
call eax
cmp eax, ebx
je 0x407e78
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x415574]
call fcn.00405393
pop ecx
call eax
test eax, eax
je 0x407e78
test byte [ebp - 0x18], 1
jne 0x407eab
lea eax, [ebp - 0xc]
push eax
call fcn.00404222
test eax, eax
pop ecx
je 0x407e93
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040758c
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x407ea2
or dword [ebp + 0x10], 0x200000
jmp 0x407edc
or dword [ebp + 0x10], 0x40000
jmp 0x407edc
mov eax, dword [0x415568]
cmp eax, esi
je 0x407edc
push eax
call fcn.00405393
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x407edc
mov eax, dword [0x41556c]
cmp eax, esi
je 0x407edc
push dword [ebp - 4]
push eax
call fcn.00405393
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x415564]
call fcn.00405393
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x9fe9c7
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x9feb8c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x130]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x9feb88
mov edx, esi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x9fea32
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.009f7142
add esp, 0xc
test ebx, ebx
je 0x9feb32
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x9feb1b
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x9fea77
movzx ebx, ax
jmp 0x9fea7c
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x9feaf3
cmp dword [0xa03eac], 1
jne 0x9feaf3
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.009f7142
lea eax, [esp + 0x34]
push eax
call fcn.009fec74
lea eax, [esp + 0x38]
push 0x9f6204
push eax
call fcn.009f7170
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.009f7170
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.009f7197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0xa03e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x9fea70
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x9fe9f9
jmp 0x9feb88
lea eax, [esp + 0x28]
push eax
call fcn.009fec74
lea eax, [esp + 0x2c]
mov dword [esp], 0x9f61e8
push eax
call fcn.009f7170
lea eax, [esp + 0x30]
push edi
push eax
call fcn.009f7170
add esp, 0x10
cmp dword [0xa03eac], 1
jne 0x9feb88
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.009f7197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0xa03e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
add esp, 0x11c
ret
Function at 0x9febc2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.009fec40
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0xa03d24], eax
push 0
push 0
push 0
push 2
push 0
push dword [0xa03d24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0xa03d28], eax
push 0
push 0
push 0
push 4
push dword [0xa03d28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0xa03eb4]
mov esp, ebp
pop ebp
ret
Function at 0x9feccc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x9fecdf
xor eax, eax
jmp 0x9fee63
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x9fed1d
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x9fed36
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x9fed36
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x9fed43
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x9fed7c
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x9fed3c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x9fee1c
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x9fedac
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x9fee0b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x9fedc4
jmp 0x9feda5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x9fedfc
jmp 0x9fee09
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x9feda5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x9fed7c
and dword [ebp - 0x14], 0
jmp 0x9fee29
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x9fee61
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x9fee22
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x9ff00a
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x6c
mov eax, dword [esp + 0x70]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.009fefcd
push esi
call fcn.009ff1bb
push dword [esp + 0x84]
mov esi, eax
call fcn.009ff1bb
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.009f7142
lea eax, [esp + 0x34]
push eax
push 5
push esi
call fcn.009feee7
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x9ff1a2
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.009ff1f0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x9ff1a2
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x9ff185
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x9ff16a
xor edx, edx
lea ecx, [edi + 0x2c]
test ebx, ebx
je 0x9ff0eb
mov ebp, esi
sub ebp, ecx
mov al, byte [ecx + ebp]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, ebx
jb 0x9ff0d5
mov ebp, dword [esp + 0x20]
lea ecx, [edi + 0x2c]
lea eax, [ebx + esi]
push eax
lea eax, [ecx + ebx]
push eax
call fcn.009fef88
mov edx, dword [esp + 0x20]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x9ff134
lea eax, [edi + 0xc]
push edx
push eax
call fcn.009fef88
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x9ff136
mov eax, edx
push eax
push esi
call fcn.009fef88
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x9ff196
mov ecx, dword [esp + 0x7c]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x9ff1a2
push 1
push edi
call fcn.009ff2e4
pop ecx
pop ecx
xor edi, edi
push 0xa03d40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x6c
ret
Function at 0x9ff1f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0xa03d34], 0x40
jae 0x9ff2dd
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x9ff2da
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x9ff2b5
cmp dword [esp + 0x20], 0x10000
jne 0x9ff2a7
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x9ff2ab
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x9ff2ab
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x9ff2b9
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x9ff258
test ebx, ebx
je 0x9ff2da
xor eax, eax
cmp dword [eax*4 + 0xa03d58], 0
je 0x9ff2cd
inc eax
cmp eax, 0x40
jb 0x9ff2bb
jmp 0x9ff2da
inc dword [0xa03d34]
mov dword [eax*4 + 0xa03d58], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0xa0094c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x118]
push edi
lea edi, [eax + ebp]
cmp eax, 8
ja 0xa0096f
push 0xffffffffffffffe2
pop eax
jmp 0xa00b04
push ebx
mov ebx, dword [esp + 0x11c]
push esi
push 0x800
lea esi, [ebp + 8]
lea eax, [ebx + 0x5410]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + 0x140c]
push esi
push eax
call fcn.00a02c43
add esp, 0x14
cmp eax, 0xffffff88
ja 0xa00aff
add esi, eax
mov dword [esp + 0x18], 0x1c
mov eax, edi
sub eax, esi
push eax
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00a00b6e
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0xa00aff
cmp dword [esp + 0x14], 8
ja 0xa00aff
push dword [esp + 0x14]
lea eax, [esp + 0x30]
push dword [esp + 0x1c]
push eax
lea eax, [ebx + 0x804]
push eax
call fcn.00a01029
add esp, 0x10
cmp eax, 0xffffff88
ja 0xa00aff
add esi, dword [esp + 0x10]
mov eax, edi
sub eax, esi
mov dword [esp + 0x20], 0x34
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.00a00b6e
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0xa00aff
cmp dword [esp + 0x1c], 9
ja 0xa00aff
push dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push dword [esp + 0x24]
push eax
lea eax, [ebx + 0xc08]
push eax
call fcn.00a01029
add esp, 0x10
cmp eax, 0xffffff88
ja 0xa00aff
add esi, dword [esp + 0x10]
mov eax, edi
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.00a00b6e
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0xa00aff
cmp dword [esp + 0x24], 9
ja 0xa00aff
push dword [esp + 0x24]
lea eax, [esp + 0x6c]
push dword [esp + 0x14]
push eax
push ebx
call fcn.00a01029
add esp, 0x10
cmp eax, 0xffffff88
ja 0xa00aff
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, edi
ja 0xa00aff
sub edi, esi
xor edx, edx
sub edi, 0xc
add ebx, 0x5c10
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0xa00aff
cmp ecx, edi
jae 0xa00aff
mov dword [ebx], ecx
inc edx
add ebx, 4
cmp edx, 3
jl 0xa00ae1
sub esi, ebp
mov eax, esi
jmp 0xa00b02
push 0xffffffffffffffe2
pop eax
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x10c
ret
Function at 0x409880
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac758
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4de310]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042bff5
add esp, 4
mov dword [ebp - 0x10], eax
push eax
push esi
call edi
mov eax, dword [ebp - 0x10]
mov esi, eax
cmp word [eax], 0
je 0x409966
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [ecx]
push esi
call edi
test eax, eax
je 0x40994e
cmp eax, 1
je 0x40994e
cmp eax, 2
je 0x40994e
cmp eax, 4
je 0x40994e
cmp eax, 5
je 0x40994e
cmp eax, 6
je 0x40994e
mov ecx, esi
call fcn.00409740
test al, al
jne 0x40994e
push esi
lea ecx, [ebp - 0x28]
call fcn.00405330
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.0040bcd0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x40994e
push dword [ebp - 0x28]
call fcn.004781a0
add esp, 4
push 0
push esi
call fcn.00478cdc
add esp, 8
cmp word [eax + 2], 0
lea esi, [eax + 2]
jne 0x4098f0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00478d8a
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409990
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac788
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
xor eax, eax
mov dword [ebp - 0x18], 7
push str.._
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00405200
mov dword [ebp - 4], 0
cmp word [esi], 0
jne 0x4099f0
xor ecx, ecx
jmp 0x409a04
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4099f5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00406750
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409a75
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push 0xc
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], 8
push ecx
push 0xc
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], 0
push ecx
push 0x2d1400
push eax
mov byte [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [ebp - 0x3c], 1
jne 0x409a75
mov bl, 1
jmp 0x409a77
xor bl, bl
cmp dword [ebp - 0x18], 8
jb 0x409a88
push dword [ebp - 0x2c]
call fcn.004781a0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret