joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4629a3
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push esi
push edi
mov esi, 0x20c
push esi
xor edi, edi
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.00492200
push esi
lea eax, [ebp + 0x198]
push edi
push eax
call fcn.00492200
add esp, 0x18
mov eax, 0x105
push eax
lea ecx, [ebp + 0x198]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
push 0x4d854c
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x462a20
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x462a25
mov eax, 0x7c1
mov ecx, dword [ebp + 0x3a4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048c64c
add ebp, 0x3a8
leave
ret

Function at 0x462f70
Capabilities:
Check if file exists

Disassembly:
push 0x2cc
mov eax, 0x4c3410
call fcn.00492e54
mov esi, dword [ebp + 8]
xor edi, edi
push esi
mov dword [ebp - 0x2b8], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4630c2
push esi
lea esi, [ebp - 0x64]
call fcn.00404bbf
mov eax, esi
push eax
lea esi, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.00404bde
xor ebx, ebx
inc ebx
push 0x4e0fa8
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.00405298
mov eax, dword [ebp - 0x44]
push 8
pop esi
cmp dword [ebp - 0x30], esi
jae 0x462fd0
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2b4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2bc], eax
cmp eax, 0xffffffff
jne 0x463004
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00405380
push edi
push ebx
lea ecx, [ebp - 0x64]
call fcn.00405380
xor eax, eax
jmp 0x4630c8
push 0x4d8dcc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.00464b6a
lea ecx, [ebp - 0x288]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.00464b6a
add esp, 0x18
push edi
push ebx
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 4
call fcn.00405380
test byte [ebp - 0x2b4], 0x10
je 0x463068
cmp word [ebp - 0x288], 0x2e
je 0x4630d4
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x463060
lea eax, [ebp - 0x28]
push eax
call fcn.00462f70
jmp 0x46308d
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x463073
lea ecx, [ebp - 0x28]
call fcn.004637cd
test al, al
je 0x4630ce
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x463087
lea eax, [ebp - 0x28]
push eax
call fcn.00462f3e
pop ecx
mov dword [ebp - 0x2b8], eax
cmp eax, edi
jne 0x4630d4
push edi
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00405380
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00405380
push edi
push ebx
lea ecx, [ebp - 0x64]
call fcn.00405380
mov eax, dword [ebp - 0x2b8]
call fcn.00492ed7
ret
mov dword [ebp - 0x2b8], ebx
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push edi
lea ecx, [ebp - 0x2c]
push ebx
test eax, eax
je 0x46309d
mov byte [ebp - 4], bl
call fcn.00405380
jmp 0x463004
Function at 0x46348c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00492200
push 0x208
push 0
push esi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x104
call fcn.00492200
mov eax, dword [ebp + 8]
add esp, 0x18
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4634c6
sub eax, ecx
lea ecx, [ebp - 0x3c]
push ecx
push 0x10000000
sar eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4634fa
test esi, esi
je 0x4634fa
cmp word [esi], 0
je 0x4634fa
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4635d0
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
push ebx
push edi
xor ebx, ebx
mov edi, ecx
mov byte [ebp - 0x7d], bl
cmp edi, ebx
je 0x4636a1
cmp word [edi], bx
je 0x4636a1
lea ecx, [ebp - 0x7c]
call fcn.004631e6
cmp dword [ebp - 0x68], ebx
jbe 0x463691
cmp dword [ebp - 0x64], 8
mov eax, dword [ebp - 0x78]
jae 0x46361e
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463691
cmp dword [ebp - 0x64], 8
mov eax, dword [ebp - 0x78]
jae 0x463635
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
cmp edi, ebx
je 0x463691
push esi
push edi
mov esi, str..exe.scr.bat.dll.com.cmd
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x46368c
xor eax, eax
push 0x208
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push ebx
push eax
call fcn.00492200
push edi
push 0x4e130c
lea eax, [ebp - 0x60]
push 0x104
push eax
call fcn.00464b4b
add esp, 0x1c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x463690
mov byte [ebp - 0x7d], 1
pop esi
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.00405380
mov al, byte [ebp - 0x7d]
jmp 0x4636a3
xor al, al
mov ecx, dword [ebp + 0x1ac]
pop edi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x1b0
leave
ret
Function at 0x4637cd
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push 0x68
mov eax, 0x4c33c8
call fcn.00492e54
xor ebx, ebx
mov edi, ecx
mov byte [ebp - 0x6d], bl
cmp edi, ebx
je 0x463899
cmp word [edi], bx
je 0x463899
lea ecx, [ebp - 0x2c]
call fcn.004631e6
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x463808
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463889
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x46381f
lea ecx, [ebp - 0x28]
call fcn.004635d0
test al, al
je 0x46382e
mov byte [ebp - 0x6d], 1
jmp 0x463889
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x46383a
lea eax, [ebp - 0x28]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x463889
push ebx
lea eax, [ebp - 0x74]
push eax
push 0x40
lea eax, [ebp - 0x6c]
push eax
push esi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x74], 0x40
jne 0x463882
mov eax, 0x5a4d
cmp word [ebp - 0x6c], ax
jne 0x463882
mov byte [ebp - 0x6d], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405380
mov al, byte [ebp - 0x6d]
jmp 0x46389b
xor al, al
call fcn.00492ed7
ret
Function at 0x467be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x467bf3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x467c71
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00492530
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x467c41
sub eax, edi
jmp 0x467c43
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x467c32
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x467c62
sub eax, edi
jmp 0x467c64
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x467c53
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x467d9f
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x467c97
mov ebx, ecx
test ebx, ebx
je 0x467cea
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x467cb9
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.0046c2a0
jmp 0x467cd2
cmp eax, 2
jne 0x467cd8
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x467ccb
xor eax, eax
jmp 0x467cd5
mov edx, ebx
call fcn.0046c610
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.00492530
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x467d14
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x467d28
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x467bf0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x467d9f
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x467d6e
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x467d4f
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.00492200
add esp, 0xc
add ebx, edi
pop edi
mov dword [esi + 0x16c0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x467d9f
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x467d88
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.00492200
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c5f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x46c5fb
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.0046c610
Function at 0x46cc80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 0xc], 0
push esi
mov esi, eax
jle 0x46cd43
mov ecx, 1
mov dword [ebp - 0x80], 0xedb88320
mov eax, ecx
mov dword [ebp + eax*4 - 0x80], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x46cca4
push ebx
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.0046cc40
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.0046cc40
lea ecx, [ecx]
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.0046cc40
test byte [ebp + 0xc], 1
je 0x46cd03
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x100]
test esi, esi
je 0x46cd01
test al, 1
je 0x46ccf8
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x46ccf2
mov esi, edx
sar dword [ebp + 0xc], 1
je 0x46cd3d
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.0046cc40
test byte [ebp + 0xc], 1
je 0x46cd38
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x80]
test esi, esi
je 0x46cd36
test al, 1
je 0x46cd2d
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x46cd27
mov esi, edx
sar dword [ebp + 0xc], 1
jne 0x46ccd0
mov eax, esi
xor eax, dword [ebp + 8]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46db00
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
xor ecx, ecx
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
call fcn.00473fd0
add esp, 4
lea esi, [esp + 4]
mov ecx, edi
call fcn.00474070
mov ecx, dword [esp + 0x5c]
pop esi
xor ecx, esp
call fcn.0048c64c
add esp, 0x5c
ret

Function at 0x46db70
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
xor ecx, ecx
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
call fcn.00473fd0
add esp, 4
lea esi, [esp + 4]
mov ecx, edi
call fcn.00474070
mov ecx, dword [esp + 0x5c]
pop esi
xor ecx, esp
call fcn.0048c64c
add esp, 0x5c
ret
Function at 0x46dd00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4e166c
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46de91
mov dword [esi], eax
push ebp
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46dd93
cmp dword [esp + 0x14], 1
jne 0x46de78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x46de78
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46ddd8
cmp dword [esp + 0x14], 1
jne 0x46de78
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46de78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46de0f
cmp dword [esp + 0x14], 1
jne 0x46de78
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46de78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46de78
cmp dword [esp + 0x14], 3
jne 0x46de78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x46de78
lea eax, [esi + 0xc]
call fcn.0046dbe0
test eax, eax
je 0x46de78
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x46e490
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
lea eax, [esp + 4]
mov esi, edx
push eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00471ec0
add esp, 8
test eax, eax
jne 0x46e4fb
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0048c64c
add esp, 0x64
ret
mov eax, dword [esp + 0x6c]
test eax, eax
jbe 0x46e510
push esi
lea ecx, [esp + 0x10]
call fcn.00473fd0
add esp, 4
lea esi, [esp + 0xc]
mov ecx, ebx
call fcn.00474070
test edi, edi
je 0x46e52e
mov ecx, dword [esp + 8]
xor eax, eax
cmp ecx, dword [esp + 4]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0048c64c
add esp, 0x64
ret

Function at 0x46e590
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 4]
mov edi, ecx
push eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
call fcn.004720c0
add esp, 4
pop edi
test eax, eax
jne 0x46e5ec
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0048c64c
add esp, 0x5c
ret
push esi
lea esi, [esp + 4]
mov ecx, ebx
call fcn.00474070
mov ecx, dword [esp + 0x5c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0048c64c
add esp, 0x5c
ret

Function at 0x46e610
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp]
push ecx
push eax
mov dword [esp + 8], 0x6a09e667
mov dword [esp + 0xc], 0xbb67ae85
mov dword [esp + 0x10], 0x3c6ef372
mov dword [esp + 0x14], 0xa54ff53a
mov dword [esp + 0x18], 0x510e527f
mov dword [esp + 0x1c], 0x9b05688c
mov dword [esp + 0x20], 0x1f83d9ab
mov dword [esp + 0x24], 0x5be0cd19
call fcn.004721b0
add esp, 8
test eax, eax
jne 0x46e68c
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0048c64c
add esp, 0x6c
ret
push edi
mov eax, esi
lea edi, [esp + 4]
call fcn.004736a0
mov ecx, dword [esp + 0x6c]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0048c64c
add esp, 0x6c
ret

Function at 0x46fe00
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46fe32
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.004750a0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x46fe57
push 0x4e1800
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.004754a0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x46fe60
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46fe92
push str.WriteFile__
push 0x111
push str..QHImageHlp.c
xor edx, edx
call fcn.004750a0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x46feb7
push 0x4e182c
push 0x113
push str..QHImageHlp.c
mov edx, 1
call fcn.004754a0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret

Function at 0x46ff30
Capabilities:
Clear file content

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46ff57
push str.SetEndOfFile__
push 0x132
push str..QHImageHlp.c
xor edx, edx
call fcn.004750a0
add esp, 0xc
xor eax, eax
ret
mov eax, 1
ret

Function at 0x46ff60
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x46ff8a
push str.GetFileSizeEx__
push 0x11e
jmp 0x47009f
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
cmp esi, edi
ja 0x47007c
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
jb 0x46ffac
cmp ecx, edx
jae 0x47007c
mov eax, edx
sub eax, ecx
mov ecx, edi
sbb ecx, esi
mov ebx, eax
shrd ebx, ecx, 0xf
shr ecx, 0xf
and eax, 0x7fff
mov dword [esp + 0x10], ebx
mov esi, eax
jne 0x46ffd1
mov esi, 0x8000
jmp 0x46ffd6
inc ebx
mov dword [esp + 0x10], ebx
xor eax, eax
sub edx, esi
sbb edi, eax
mov eax, dword [esp + 0x38]
mov ebp, edi
xor edi, edi
mov ebx, edx
add eax, ebx
adc edi, ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
jbe 0x47007c
lea ecx, [ecx]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x470089
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
call fcn.0046fe00
test eax, eax
je 0x4700ae
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
push 0
push 0
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x470095
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
call fcn.0046fe60
test eax, eax
je 0x4700ae
mov eax, dword [esp + 0x14]
add ebx, 0xffff8000
adc ebp, 0xffffffff
add dword [esp + 0x18], 0xffff8000
mov esi, 0x8000
adc edi, 0xffffffff
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jb 0x470000
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
push str.SetFilePointerEx__
push 0xf9
jmp 0x47009f
push str.SetFilePointerEx__
push 0x10e
push str..QHImageHlp.c
xor edx, edx
call fcn.004750a0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x471d10
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x471d5d
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.004750a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x471df4
jg 0x471d83
cmp ebx, ecx
jb 0x471df4
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x471db9
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.004750a0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.0046fe00
test eax, eax
je 0x471daf
mov eax, dword [esp + 0x20]
test eax, eax
je 0x471dda
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x471e01
pop edi
pop esi
mov ecx, 1
pop ebp
mov word [eax], cx
mov eax, ecx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x471e01
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4728a0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4f51d0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x4729e0
cmp dword [esp + 0x28], ebp
je 0x4729e0
push edi
push 0x2800
call fcn.0048d9cf
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x472903
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0048c64c
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x472910
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.0046fb20
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4729b6
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00492200
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4729a9
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x4729a9
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00472650
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x4729c0
inc ebx
cmp ebx, 0x10
jl 0x472910
push edi
call fcn.0048de66
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0048c64c
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0048c64c
add esp, 0x1c
ret