joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fee0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x104
push edi
mov ecx, esi
call fcn.004465d3
mov eax, dword [esi]
and word [eax], 0
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push dword [esp + 0x18]
call edi
mov ebx, eax
test ebx, ebx
jle 0x44ff2d
mov eax, dword [esi]
cmp word [eax], 0
jne 0x44ff2d
lea eax, [ebx + 2]
push eax
mov ecx, esi
call fcn.004465d3
inc ebx
push ebx
push dword [esi]
push dword [esp + 0x18]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x44ffef
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 8], ebx
push 3
pop eax
jge 0x4500a3
cmp cx, 0x61
jb 0x45001a
cmp cx, 0x7a
ja 0x45001a
and ecx, 0xffdf
push 0x5c
pop eax
push ebx
push ebx
push 3
push ebx
push 3
mov word [ebp - 0x14], ax
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], ax
mov word [ebp - 0x22], ax
push ebx
lea eax, [ebp - 0x28]
push eax
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], 0x3a
mov word [ebp - 0x12], bx
mov word [ebp - 0x24], 0x2e
mov word [ebp - 0x20], cx
mov word [ebp - 0x1e], 0x3a
mov word [ebp - 0x1c], bx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4500bd
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push 0x2d1080
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
pop edi
je 0x450099
mov eax, dword [ebp - 0x34]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp dword [ebp + 8], 0xffffffff
je 0x4500bd
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call fcn.004459ec
add esp, 0xc
cmp eax, ebx
jne 0x4500c5
xor eax, eax
inc eax
jmp 0x450164
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov eax, dword [ebp - 0x10]
shr eax, 0xe
and al, 1
mov byte [ebp + 0xb], al
mov dword [ebp - 4], 1
mov esi, 0x208
push ebx
push esi
cmp al, bl
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov word [ebp - 0x240], bx
je 0x450129
call dword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x45012f
call dword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, ebx
jne 0x450138
cmp dword [ebp - 0xc], ebx
je 0x450157
push ebx
push ebx
push 0xc8
mov ecx, 0x4e3110
call fcn.0041195d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jg 0x450159
mov al, byte [ebp + 0xb]
jmp 0x450106
mov bl, 1
neg bl
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
inc ebx
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x451b31
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push 4
push 0x2001b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00440fbc
add esp, 0x14
cmp eax, esi
jne 0x451c7f
test byte [ebp + 0x10], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x451b7e
push 0x4c6a64
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x451bac
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004465ac
cmp dword [ebp - 0xc], esi
jne 0x451c6b
test byte [ebp + 0x10], 4
push ebx
push edi
mov edi, dword [ebp - 0x1c]
je 0x451c1b
mov ebx, dword [ebp - 0x14]
dec ebx
cmp ebx, esi
jl 0x451c1b
mov eax, dword [ebp - 8]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
mov word [edi], si
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x451c15
cmp word [edi], si
je 0x451c18
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x451c18
mov dword [ebp - 0xc], eax
dec ebx
jns 0x451bdb
test byte [ebp + 0x10], 2
je 0x451c69
mov ebx, dword [ebp - 0x18]
dec ebx
cmp ebx, esi
jl 0x451c69
mov eax, dword [ebp - 8]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
mov word [edi], si
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x451c63
cmp word [edi], si
je 0x451c66
push edi
push dword [ebp - 4]
call dword [0x4e3284]
cmp eax, esi
je 0x451c66
mov dword [ebp - 0xc], eax
dec ebx
jns 0x451c29
pop edi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.0043fe25
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x451c82
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0x4e2e78], 0
push esi
push edi
je 0x451cd4
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00450621
mov esi, dword [eax]
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.00450621
push dword [eax]
push esi
push str._r_nRegSetDHCP__s__s__r_n
push 0x4e3110
call fcn.00411365
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0043fe25
lea ecx, [ebp - 8]
call fcn.0043fe25
mov esi, str.0.0.0.0
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 4
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc]
push eax
push 4
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push str.EnableDHCP
push dword [ebx]
xor edi, edi
inc edi
mov dword [ebp - 0xc], edi
call esi
push 9
lea eax, [ebp - 0x18]
push eax
push 7
push 0
push str.IPAddress
push dword [ebx]
call esi
push 9
lea eax, [ebp - 0x18]
push eax
push 7
push 0
push str.SubnetMask
push dword [ebx]
call esi
push edi
mov edi, 0x4c78c2
push edi
push 7
push 0
push str.DefaultGateway
push dword [ebx]
call esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x451d66
cmp byte [eax], 0x2d
jne 0x451d47
mov dword [ebp + 0xc], edi
cmp byte [eax], 0
je 0x451d66
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push 1
push 0
push str.NameServer
push dword [ebx]
call esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret
Function at 0x454150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp byte [0x4e3438], bl
jne 0x4542ce
push esi
push edi
push 0x1122
lea ecx, [ebp - 0x18]
call fcn.004465ac
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [esi], ebx
push str.TIPSDUMMY
mov dword [esi + 4], ebx
mov word [esi], bx
push str.SOFTWAREPELOGON
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xc], 0x1ffe
call fcn.00441077
add esp, 0x18
mov edi, eax
neg edi
sbb edi, edi
inc edi
jne 0x4541c3
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4541c6
mov eax, dword [ebp - 0xc]
shr eax, 1
mov word [esi + eax*2], bx
cmp word [esi], bx
jne 0x4542b2
lea eax, [esi + 0x2000]
push 0x104
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..USRCFG.INI
lea eax, [esi + 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
lea eax, [esi + 0x2000]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00405c6d
push ebx
lea eax, [ebp - 8]
push eax
push 0x1ffe
push esi
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_ReadFile]
shr dword [ebp - 8], 1
mov eax, 0xffe
cmp dword [ebp - 8], eax
jbe 0x454249
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov word [esi + eax*2], bx
cmp word [esi], 0xfeff
jne 0x45428c
add esi, 2
mov dword [ebp - 4], esi
jmp 0x45428c
lea eax, [ebp - 4]
push eax
call fcn.0043fe57
mov esi, dword [ebp - 4]
push 0xd
lea eax, [ebp - 4]
push 0xa
push eax
call fcn.004403c2
push 0xa
push str.TIPSDUMMY:
push esi
call fcn.00402d7a
add esp, 0x1c
test al, al
jne 0x454296
mov eax, dword [ebp - 4]
cmp word [eax], bx
jne 0x45425f
jmp 0x4542aa
mov eax, dword [ebp - 4]
add esi, 0x14
cmp word [eax], bx
je 0x4542a4
mov word [eax], bx
xor edi, edi
mov dword [ebp - 0x14], esi
inc edi
lea ecx, [ebp - 0x10]
call fcn.00402d2b
xor eax, eax
cmp edi, ebx
setne al
push eax
push dword [ebp - 0x14]
call fcn.004540ca
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.0043fe25
pop edi
pop esi
mov eax, dword [0x4e3d2c]
pop ebx
leave
ret
Function at 0x454896
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push edi
xor ebx, ebx
inc ebx
xor edi, edi
push 0x100000
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov word [ebp - 0x21c], di
call fcn.004465ac
cmp dword [ebp + 0x14], edi
jne 0x4548ea
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
cmp ebx, edi
lea eax, [ebp - 0x21c]
mov dword [ebp + 0x14], eax
je 0x454a1d
cmp dword [ebp - 4], edi
push esi
mov esi, 0xa0000000
mov dword [ebp - 0xc], edi
je 0x4548fd
mov esi, 0xe0000000
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 3
push esi
push dword [ebp + 0xc]
call dword [0x4e32b8]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jne 0x454954
cmp dword [ebp - 4], 1
jne 0x45494a
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 3
and esi, 0xbfffffff
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], 2
call dword [0x4e32b8]
test eax, eax
mov dword [ebp - 8], eax
je 0x45491c
cmp dword [ebp - 8], 0
jne 0x454954
call edi
xor ebx, ebx
test ebx, ebx
je 0x454a0d
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [0x4e32bc]
mov ebx, eax
test ebx, ebx
jne 0x454971
call edi
inc ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [0x4e32c0]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x454988
call edi
xor ebx, ebx
test ebx, ebx
je 0x4549fe
cmp dword [ebp - 4], 0
mov esi, 0x400
jne 0x45499c
mov esi, 0x600
push esi
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [0x4e32c4]
mov ebx, eax
call edi
test ebx, ebx
jne 0x4549fe
test esi, 0x400
je 0x4549d9
cmp eax, 0x57
jne 0x4549d9
and esi, 0xfffffbff
push esi
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [0x4e32c4]
mov ebx, eax
call edi
test ebx, ebx
je 0x4549b1
test ebx, ebx
jne 0x4549fe
cmp dword [ebp - 4], 2
jne 0x4549fc
or esi, 0x200
push esi
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [0x4e32c4]
mov ebx, eax
test ebx, ebx
jne 0x4549fe
call edi
cmp dword [ebp + 0x14], 0
je 0x454a0d
push dword [ebp + 0x14]
call dword [0x4e32c8]
cmp dword [ebp - 8], 0
pop esi
je 0x454a1d
push dword [ebp - 8]
call dword [0x4e32c8]
lea ecx, [ebp - 0x10]
call fcn.0043fe25
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x454f6b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
jne 0x454f9d
mov ax, word [esi]
mov word [ebp - 0xc], ax
mov ax, word [esi + 2]
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x5c
mov word [ebp - 6], bx
mov dword [ebp + 0x10], eax
push 0x209
lea ecx, [ebp - 4]
call fcn.004465ac
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
push 8
push edi
push str.Device_
mov word [eax], bx
call fcn.00441277
add esp, 0xc
test al, al
jne 0x454ff6
push 0xc
push edi
push str.DosDevices_
call fcn.00441277
add esp, 0xc
test al, al
jne 0x454ff6
cmp word [edi], bx
je 0x454ffa
cmp word [edi + 2], bx
je 0x454ffa
push 0x3a
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x454ffa
or dword [ebp + 0x14], 1
push 0xb
push edi
push 0x4cfaa4
call fcn.00441277
mov ebx, dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
add esp, 0xc
test al, al
je 0x45501e
and dword [ebp + 0x14], 0xfffffffe
cmp byte [ebp + 0x18], 0
jne 0x455045
cmp byte [ebp + 0x18], 0
je 0x455030
xor eax, eax
mov ax, word [esi]
push eax
call fcn.0044377a
pop ecx
push edi
push esi
push dword [ebp + 0x14]
call ebx
mov esi, eax
test esi, esi
jne 0x455056
cmp byte [ebp + 0x18], al
jl 0x4550a2
mov byte [ebp + 0x18], al
push 0x208
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x45507e
cmp byte [ebp + 0x18], 0
jle 0x4550a2
push 0x208
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x4550a2
mov eax, dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
or eax, 0xe
push eax
call ebx
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
cmp byte [ebp + 0x18], 0
mov esi, eax
jl 0x4550a2
test esi, esi
jne 0x4550a2
mov esi, dword [ebp + 0xc]
mov byte [ebp + 0x18], 0xff
jmp 0x45501e
lea ecx, [ebp - 4]
call fcn.0043fe25
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45668b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov esi, 0x200
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004b4630
and dword [ebp - 0xc], 0
push esi
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
call fcn.004438ac
cmp eax, esi
pop ecx
pop ecx
jl 0x4566c7
mov esi, eax
mov dword [ebp - 8], esi
jmp 0x4566ca
mov dword [ebp - 8], esi
lea eax, [esi + esi + 0x200]
push eax
lea ecx, [ebp - 4]
call fcn.00446437
mov edi, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
add edi, 0x200
push dword [ebp + 0xc]
and edi, 0xfffffe00
push dword [ebp + 8]
lea ebx, [edi + esi]
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x4567a5
cmp edx, dword [ebp + 0x10]
jne 0x4567a5
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4567a5
push esi
push ebx
push edi
call fcn.00414839
mov esi, dword [ebp + 0x18]
add esp, 0xc
cmp esi, 1
jne 0x45674d
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x1ce]
push eax
call fcn.00414839
add esp, 0xc
dec esi
push 0
push dword [ebp + 0x10]
neg esi
push dword [ebp + 0xc]
sbb esi, esi
push dword [ebp + 8]
and esi, 0xffff55ab
add esi, 0xaa55
mov word [ebx + 0x1fe], si
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x4567a5
cmp edx, dword [ebp + 0x10]
jne 0x4567a5
push dword [ebp - 8]
push ebx
push edi
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x4567a5
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 4]
call fcn.0043fe25
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x4572b3
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
and word [eax], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4572f6
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4572ef
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.0045066c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x457de1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
movzx esi, word [ebp + 0x1c]
lea eax, [esi - 1]
cdq
push edi
not eax
not edx
push 0xa0000
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
call fcn.00446437
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add edi, 0x20000
xor ebx, ebx
and edi, 0xfffe0000
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
jne 0x457e5c
mov dword [ebp + 0x18], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 0x14], ebx
jl 0x457f4f
jle 0x457f46
cmp dword [ebp + 0x18], ebx
jne 0x457e82
mov eax, dword [ebp - 8]
cdq
cmp dword [ebp + 0x14], edx
jl 0x457e82
jg 0x457e58
cmp dword [ebp + 0x10], eax
jbe 0x457e82
xor cl, cl
jmp 0x457e84
mov eax, dword [ebp + 0x18]
cdq
add eax, ecx
adc edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
mov eax, esi
cdq
push edx
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004b6920
mov dword [ebp - 8], eax
jmp 0x457e34
mov cl, 1
cmp dword [ebp + 0x14], ebx
jl 0x457e9b
jg 0x457e94
cmp dword [ebp + 0x10], 0x10000000
jbe 0x457e9b
mov esi, 0x10000000
jmp 0x457e9e
mov esi, dword [ebp + 0x10]
cmp cl, bl
mov edx, dword [ebp + 0xc]
mov eax, esi
je 0x457f12
movzx esi, word [ebp + 0x1c]
sub esi, dword [ebp + 0x18]
cmp ebx, dword [ebp + 0x14]
jl 0x457ebd
jg 0x457eba
cmp esi, dword [ebp + 0x10]
jbe 0x457ebd
mov esi, dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.00441183
add esp, 0x10
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
movzx eax, word [ebp + 0x1c]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
add eax, edi
push eax
mov dword [ebp - 0x10], edi
call fcn.00414839
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00441183
movzx eax, word [ebp + 0x1c]
add esp, 0x1c
mov edx, edi
jmp 0x457f1c
cmp dword [ebp + 0x1c], ebx
je 0x457f1c
and esi, dword [ebp - 0x28]
mov eax, esi
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp + 0x10], esi
mov dword [ebp + 0x18], ebx
sbb dword [ebp + 0x14], ebx
add dword [ebp + 0xc], esi
cmp dword [ebp + 0x14], ebx
jg 0x457e43
jl 0x457f4f
cmp dword [ebp + 0x10], ebx
ja 0x457e43
lea ecx, [ebp - 0xc]
call fcn.0043fe25
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45937c
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x92], 0
jne 0x459394
test byte [ecx + 9], 0xf
jne 0x459394
pop ebp
jmp fcn.00459284
pop ebp
jmp fcn.00457f62

Function at 0x45939a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x45945d
cmp esi, edi
je 0x4593c0
mov dword [ebp - 4], esi
jmp 0x4593c6
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp word [eax], di
mov esi, eax
je 0x459456
push ebx
mov ebx, esi
jmp 0x4593dc
cmp ax, 0x3d
je 0x4593e6
inc esi
inc esi
mov ax, word [esi]
cmp ax, di
jne 0x4593d6
cmp dword [ebp + 0xc], edi
je 0x459403
mov ecx, dword [ebp + 8]
mov eax, esi
sub eax, ebx
push 0xffffffffffffffff
sar eax, 1
push eax
lea eax, [esi + 2]
push eax
push ebx
call fcn.0041556a
jmp 0x459446
mov edi, esi
sub edi, ebx
sar edi, 1
push edi
push ebx
lea ecx, [ebp - 8]
call fcn.00450608
mov ecx, dword [ebp - 4]
push 0
push 0xffffffffffffffff
push 0
push dword [ebp - 8]
call fcn.00411019
test eax, eax
jne 0x459438
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edi
lea eax, [esi + 2]
push eax
push ebx
call fcn.0041556a
lea ecx, [ebp - 8]
call fcn.0043fe25
xor edi, edi
jmp 0x459446
inc esi
inc esi
cmp word [esi], di
jne 0x459444
inc esi
inc esi
cmp word [esi], di
jne 0x4593d2
mov eax, dword [ebp - 0xc]
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop edi
pop esi
leave
ret
Function at 0x459a41
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.0044ffef
cmp dword [ebp + 8], 0
pop ecx
mov ebx, eax
jge 0x459abb
and word [ebp - 0xc], 0
and word [ebp - 2], 0
lea eax, [ebp - 8]
push eax
mov word [ebp - 0x18], 0x20
mov word [ebp - 0x16], 0x2a
mov word [ebp - 0x14], 0x20
mov word [ebp - 0x12], si
mov word [ebp - 0x10], 0x3a
mov word [ebp - 0xe], 0x2c
mov word [ebp - 8], si
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x459aab
cmp ebx, 2
je 0x459abb
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4e3110
call fcn.004550b1
pop ebx
leave
ret
Function at 0x45a644
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
cmp ebx, esi
mov dword [ebp - 4], esi
jne 0x45a6f1
cmp dword [ebp + 0xc], esi
jne 0x45a66e
mov eax, 0x80070057
jmp 0x45a7fc
cmp dword [0x4e3514], esi
jle 0x45a7fa
push esi
push 0x8000080
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45a6af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x45a7fc
jmp 0x45a82d
push esi
lea eax, [ebp + 8]
push eax
push dword [0x4e3514]
push dword [0x4e3d50]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4e3d50]
cmp eax, esi
mov dword [0x4e3514], esi
je 0x45a7fa
call fcn.0043fde8
mov dword [0x4e3d50], esi
jmp 0x45a7fa
cmp dword [ebp + 0x10], esi
je 0x45a818
push esi
push dword [ebp + 0x10]
call fcn.00416215
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x45a82d
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
sub edi, dword [ebx]
sub eax, dword [ebx + 4]
cmp edi, esi
mov dword [ebp - 0x10], eax
jle 0x45a801
cmp eax, esi
jle 0x45a801
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [0x4e2f0c]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [0x4e2f10]
cmp edi, dword [ebp - 8]
jne 0x45a75f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x45a801
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00445cb5
mov ebx, eax
add esp, 0xc
cmp ebx, esi
je 0x45a82d
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x18]
mov dword [ebp + 8], esi
call dword [0x4e2f1c]
push 2
push dword [ebp + 8]
call dword [0x4e2f24]
push dword [ebp - 0x10]
push edi
push esi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [0x4e2ed4]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp + 8], esi
je 0x45a7cf
push dword [ebp + 8]
call dword [0x4e2f20]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0045a2ff
add esp, 0x10
cmp ebx, esi
mov edi, eax
je 0x45a7ec
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 4], esi
je 0x45a7fa
push dword [ebp - 4]
call dword [0x4e2ed0]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 0x14]
push 1
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0045a2ff
add esp, 0x10
mov edi, eax
jmp 0x45a7ec
push str.DISPLAY
push esi
push ebx
call fcn.00445cb5
mov ebx, eax
add esp, 0xc
cmp ebx, esi
jne 0x45a7cf
xor eax, eax
inc eax
jmp 0x45a7fc