joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a583
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x48a620
push ebx
push esi
call fcn.0048a54c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00487d9d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x48a5cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48a61f
push edi
push eax
call fcn.00484b29
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x48a5ed
call fcn.00484949
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48a61e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00487d9d
add esp, 0x20
test eax, eax
jne 0x48a60c
push edi
call fcn.00484949
jmp 0x48a614
push ebx
call fcn.00484949
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x48a623
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x48a634
pop esi
ret
push ebx
push edi
push esi
call fcn.0048a54c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00484b29
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48a65c
push ebx
push esi
push edi
call fcn.00469f20
add esp, 0xc
push 0
call fcn.00484949
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x48adb6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048a8d1

Function at 0x48cfa1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0048434d
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x48d010
cmp esi, dword [ebp - 4]
je 0x48d00b
cmp dword [ebp + 0xc], 0
je 0x48d00b
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x48cfe8
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0048caf3
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x48d012
xor eax, eax
inc eax
jmp 0x48d012
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x48d077
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4b14c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0048434d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0048434d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x48d0ee
cmp word [ecx], dx
je 0x48d0ee
mov eax, dword [0x4a7c0c]
push edi
dec eax
push eax
push 0x4a7af8
call fcn.0048d016
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x48d161
cmp word [eax], dx
je 0x48d161
mov eax, dword [edi]
test eax, eax
je 0x48d112
cmp word [eax], dx
je 0x48d112
lea eax, [ebp - 0x10]
push eax
call fcn.0048c9f9
jmp 0x48d11b
lea eax, [ebp - 0x10]
push eax
call fcn.0048ca94
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x48d18b
mov eax, dword [0x4a7af4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4a77e8
call fcn.0048d016
add esp, 0xc
test al, al
je 0x48d18b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x48d156
cmp word [eax], di
je 0x48d156
lea eax, [ebp - 0x10]
push eax
call fcn.0048c9f9
pop ecx
jmp 0x48d18d
lea eax, [ebp - 0x10]
push eax
call fcn.0048ca94
jmp 0x48d153
mov eax, dword [edi]
test eax, eax
je 0x48d178
cmp word [eax], dx
je 0x48d178
lea eax, [ebp - 0x10]
push eax
call fcn.0048c9ae
pop ecx
jmp 0x48d18b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x48d256
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0048ce9b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x48d256
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x48d256
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x48d256
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48d1e3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0048534c
test ebx, ebx
je 0x48d251
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0048534c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x48d256
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x48d256
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00490533
add esp, 0x10
xor eax, eax
inc eax
jmp 0x48d258
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046814f
leave
ret
Function at 0x48fcc9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b14c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x48fd0c
call fcn.004742c0
mov dword [eax], 0xf
call fcn.004742d3
mov dword [eax], 0xd
call fcn.0046f553
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046814f
leave
ret
test eax, eax
jne 0x48fd13
inc eax
jmp 0x48fd00
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x48fcfe
xor eax, eax
cmp ecx, 1
setne al
jmp 0x48fd00

Function at 0x491ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x491eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x491eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4025b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4025d8
call fcn.00403cb4
mov dword [eax], esi
call fcn.00403ca1
push 0x16
pop esi
mov dword [eax], esi
call fcn.00403c16
mov eax, esi
jmp 0x40262d
test dword [ebp + 0xc], 0xfffffff9
jne 0x4025be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402605
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403cc7
pop ecx
call fcn.00403ca1
mov eax, dword [eax]
jmp 0x40262d
test al, 0x10
jne 0x40262b
test al, 1
je 0x40262b
test byte [ebp + 0xc], 2
je 0x40262b
call fcn.00403cb4
mov dword [eax], 5
call fcn.00403ca1
mov dword [eax], 0xd
jmp 0x4025fc
xor eax, eax
pop esi
pop ebp
ret

Function at 0x409dae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424560]
jne 0x409db8
repz ret
jmp fcn.00411b5c
Function at 0x40f7b4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424560]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040856a
and dword [ebp - 0x14], 0
cmp dword [0x425bd4], 0
mov dword [ebp - 0x18], eax
jne 0x40f867
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f90f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40f90f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x425bd4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x425bd8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x425bdc], eax
call edi
push eax
call esi
mov dword [0x425be4], eax
test eax, eax
je 0x40f867
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x425be0], eax
mov eax, dword [0x425be0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f8c0
cmp dword [0x425be4], ecx
je 0x40f8c0
push eax
call esi
push dword [0x425be4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f8c0
test ebx, ebx
je 0x40f8c0
call edi
test eax, eax
je 0x40f8b7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f8b7
test byte [ebp - 8], 1
jne 0x40f8c0
or dword [ebp + 0x10], 0x200000
jmp 0x40f8f3
mov eax, dword [0x425bd8]
cmp eax, dword [ebp - 0x18]
je 0x40f8f3
push eax
call esi
test eax, eax
je 0x40f8f3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f8f3
mov eax, dword [0x425bdc]
cmp eax, dword [ebp - 0x18]
je 0x40f8f3
push eax
call esi
test eax, eax
je 0x40f8f3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x425bd4]
call esi
test eax, eax
je 0x40f90f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f911
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409dae
leave
ret
Function at 0x401350
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00404f60
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00405000
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0044cbcc
add esp, 0x68
ret
Function at 0x401a10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00403ac0
add esp, 8
test eax, eax
jne 0x401a7b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0044cbcc
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x401a90
push esi
lea ecx, [esp + 0x14]
call fcn.00404f60
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00405000
test edi, edi
je 0x401aae
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0044cbcc
add esp, 0x6c
ret

Function at 0x401b40
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00403cb0
add esp, 4
test eax, eax
jne 0x401b9e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0044cbcc
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00405000
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0044cbcc
add esp, 0x64
ret

Function at 0x401bc0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00403d90
add esp, 8
test eax, eax
jne 0x401c3f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0044cbcc
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00404b40
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0044cbcc
add esp, 0x74
ret

Function at 0x402610
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40263b
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x402654
push 0x475f7c
call fcn.00405b10
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x402ef0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x402f23
mov dword [esp + 0x10], 0xffffffff
jmp 0x402f29
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x402f57
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
jmp 0x403037
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402f87
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
jmp 0x403037
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x402fa9
mov eax, 1
push 0x475f7c
call fcn.00405b10
add esp, 4
jmp 0x403037
cmp dword [esp + 0x40], ebx
je 0x402fe5
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x402fcb
mov eax, 5
push 0x475f7c
call fcn.00405b10
add esp, 4
jmp 0x403037
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x40302f
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x402ff3
mov ebx, esi
jmp 0x402fb7
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40301c
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
jmp 0x403037
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00402610
test eax, eax
je 0x403037
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403041
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044cbcc
add esp, 0x28
ret
Function at 0x403920
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [ebx + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor edi, edi
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x403962
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx + 0xb4]
xor edx, edx
sub edi, esi
mov esi, dword [esp + 0x14]
sbb esi, edx
sub edi, 0x298
sbb esi, edx
xor eax, eax
cmp esi, eax
jl 0x403a27
jg 0x403992
cmp edi, ecx
jb 0x403a27
mov ebx, dword [ebx]
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4039c0
push 0x475f7c
mov eax, 0x475f7c
call fcn.00405aa0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x10]
push eax
push 0x298
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4039a5
cmp dword [esp + 0xc], 0x298
je 0x403a01
push 0x475f7c
mov eax, 1
call fcn.00405b10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403a0e
mov dword [eax], edi
mov dword [eax + 4], esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403a34
mov edx, 1
mov word [eax], dx
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403a34
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4042e0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x480900]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x404420
cmp dword [esp + 0x28], ebp
je 0x404420
push ebx
push 0x2800
call fcn.0044d711
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x404343
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044cbcc
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x404350
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.004024a0
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4043f6
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.0044c960
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4043e9
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x4043e9
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00404060
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x404400
inc edi
cmp edi, 0x10
jl 0x404350
push ebx
call fcn.0044d012
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044cbcc
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0044cbcc
add esp, 0x1c
ret
Function at 0x4044d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x40450a
cmp dword [esp + 0x34], esi
je 0x40450a
push 0x200
call fcn.0044d711
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x404515
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404674
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x40460a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40456d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4045e3
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4045d8
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.00404440
cmp edx, edi
jb 0x4045d8
ja 0x4045d2
cmp eax, dword [esp + 0x24]
jbe 0x4045d8
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x404560
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x404620
cmp dword [esp + 0x24], 0
jbe 0x404674
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.004024a0
add esp, 0xc
test eax, eax
jne 0x404659
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0044d012
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.00404060
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.0044d012
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x406ee0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x467cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [0x4864b0], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
mov ecx, 0x41
lea ebx, [ebp]
call fcn.00406c60
add esp, 0xc
xor eax, eax
mov word [ebp + 0x80], ax
xor ebx, ebx
xor esi, esi
lea ecx, [ebp]
push ecx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x40703a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406f84
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.00406cd0
cmp eax, ebx
je 0x406f9a
mov dword [0x4864b0], eax
jmp 0x40701b
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x406fb5
push 0x5c0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x406fc9
push edi
push esi
call fcn.00407360
jmp 0x406fcb
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x4864b0], eax
cmp eax, ebx
jne 0x406fec
mov dword [ebp - 0x1c], 1
push 0x47b0d4
lea edx, [ebp - 0x1c]
push edx
call fcn.0044d4a8
mov esi, 1
mov dword [ebp - 0x24], esi
push eax
call fcn.00406da0
add esp, 4
test eax, eax
jne 0x407016
mov dword [ebp - 0x18], 3
push 0x47b0d4
lea eax, [ebp - 0x18]
push eax
call fcn.0044d4a8
mov eax, dword [0x4864b0]
inc dword [eax + 0x5bc]
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, ebx
jne 0x40703a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4864b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0044cbcc
add ebp, 0x88
mov esp, ebp
pop ebp
ret