joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0d50
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x254
xor eax, eax
push esi
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0x264]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x30]
push 0xc
push edx
push eax
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x274]
push 0x2d1080
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4e0da6
mov dword [esi], 0xffffffff
pop esi
add esp, 0x254
ret
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x54]
push edx
push 0x102
mov dword [esp + 0x1c], ecx
call dword [0x7363d4]
mov ecx, dword [str..A:]
mov edx, dword [0x69d4f0]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x69d4f4]
mov dword [esp + 0x1c], edx
mov dx, word [0x69d4f8]
test eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], ecx
mov word [esp + 0x24], dx
mov dword [esi], 0
jle 0x4e0ee5
push ebx
push ebp
push edi
xor ebp, ebp
lea ebx, [esp + 0x60]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp ax, 0x41
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x4e0ed0
cmp ax, 0x42
je 0x4e0ed0
lea edx, [esp + 0x10]
push edx
call dword [0x7363bc]
cmp eax, 2
jb 0x4e0ed0
cmp eax, 3
ja 0x4e0ed0
mov ax, word [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [esp + 0x38]
push 0x80000000
push ecx
mov word [esp + 0x48], ax
call dword [0x736388]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e0ed0
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x40]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
push eax
push edx
lea eax, [esp + 0x48]
push 0x20
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4e0ed0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x48]
cmp eax, ecx
jne 0x4e0ec7
mov eax, dword [esp + 0x270]
mov edi, dword [esp + 0x26c]
mov cx, word [esp + 0x10]
mov edx, dword [eax]
mov word [edi + edx*2], cx
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
push esi
call fcn.004f5730
add esp, 4
mov eax, dword [esp + 0x18]
add ebp, 4
add ebx, 8
cmp ebp, eax
jl 0x4e0e03
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x254
ret
Function at 0x4e0ef0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x248
mov eax, dword [str.._:]
mov ecx, dword [0x69f758]
mov edx, dword [0x69f75c]
mov dword [esp + 4], eax
mov ax, word [0x69f760]
push esi
mov esi, dword [esp + 0x254]
push edi
mov dword [esp + 0x10], ecx
mov word [esp + 0x18], ax
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
mov di, word [esp + 0x254]
mov dword [esp + 8], 0
test esi, esi
mov dword [esp + 0x2c], 0x227
mov word [esp + 0x14], di
jne 0x4e0f73
push esi
push esi
push 3
push esi
push 3
lea ecx, [esp + 0x20]
push 0x80000000
push ecx
call dword [0x736388]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e0fd2
mov eax, dword [esp + 0x2c]
push ebx
lea edx, [esp + 0xc]
push 0
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
lea edx, [esp + 0x30]
push 0xc
push edx
push 0x2d1400
push esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test di, di
mov ebx, eax
je 0x4e0fb8
push esi
call fcn.004f5730
add esp, 4
test ebx, ebx
pop ebx
je 0x4e0fd2
cmp dword [esp + 0x44], 7
jne 0x4e0fd2
pop edi
mov eax, 1
pop esi
add esp, 0x248
ret
pop edi
xor eax, eax
pop esi
add esp, 0x248
ret
Function at 0x4e1090
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5810d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e4
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [esp + 0x10]
mov dword [ebp + 0x3c], eax
xor edi, edi
mov esi, 1
call fcn.00559027
mov eax, dword [0x733f14]
mov dword [esp + 0x2fc], edi
mov dword [esp + 0x18], eax
push 0x4011
lea ecx, [esp + 0x44]
push 0x2b4
push ecx
push edi
push 0x69e9f4
mov byte [esp + 0x310], 1
mov dword [esp + 0x30], 0x27
mov dword [esp + 0x34], 0xffffffff
call dword [0x73648c]
push eax
lea ecx, [esp + 0x14]
call fcn.00559114
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x10]
mov edx, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, ebx
push eax
push edi
push 0x402
push edx
call dword [0x73655c]
push eax
call fcn.005590b9
lea ecx, [esp + 0x10]
call fcn.00559079
mov ecx, dword [ebp + 0x3c]
mov eax, 0x1a
test esi, ecx
je 0x4e1152
inc edi
shl esi, 1
dec eax
jne 0x4e114d
lea eax, [edi*8 + 2]
push eax
call fcn.00423ee0
add esp, 4
mov esi, eax
lea ecx, [edi*4 + 1]
mov dword [ebp + 0x44], eax
push esi
push ecx
call dword [0x7363d4]
mov ax, word [esi]
test ax, ax
je 0x4e128b
mov edi, dword [esp + 0x304]
mov ebx, dword [0x7363bc]
cmp ax, 0x5a
jbe 0x4e11a0
add eax, 0xffffffe0
mov word [esi], ax
push 0x4211
lea edx, [esp + 0x44]
push 0x2b4
push edx
push 0x10
push esi
call dword [0x73648c]
lea eax, [esp + 0x4c]
push esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x40], esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
call ebx
cmp edi, 2
jne 0x4e11fe
cmp eax, 5
jne 0x4e127b
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x4e126f
mov cx, word [esi]
push ecx
call fcn.00512980
add esp, 4
test eax, eax
je 0x4e127b
jmp 0x4e126f
cmp edi, 3
jne 0x4e1220
mov ax, word [esi]
cmp ax, 0x41
je 0x4e126f
cmp ax, 0x61
je 0x4e126f
cmp ax, 0x42
je 0x4e126f
cmp ax, 0x62
jne 0x4e127b
jmp 0x4e126f
cmp edi, 4
jne 0x4e1237
mov dx, word [esi]
push edx
call fcn.00464190
add esp, 4
test eax, eax
je 0x4e127b
jmp 0x4e126f
cmp edi, 6
jne 0x4e1250
mov ax, word [esi]
push 0
push eax
call fcn.004e0ef0
add esp, 8
test eax, eax
je 0x4e127b
jmp 0x4e126f
cmp edi, 7
jne 0x4e126a
mov cx, word [esi]
push 0
push eax
push ecx
call fcn.004e0fe0
add esp, 0xc
test eax, eax
je 0x4e127b
jmp 0x4e126f
cmp edi, 5
je 0x4e127b
lea edx, [esp + 0x1c]
mov ecx, ebp
push edx
call fcn.005591a0
mov ax, word [esi + 8]
add esi, 8
test ax, ax
jne 0x4e1194
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x4e12a4
push 0
push eax
mov eax, dword [ebp + 0x1c]
push 0x14e
push eax
call dword [0x73655c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x2fc], 0
call fcn.0055adeb
lea ecx, [esp + 0x10]
mov dword [esp + 0x2fc], 0xffffffff
call fcn.00559050
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2f0
ret 4
Function at 0x4ed180
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x733f14]
push 0x6722c4
push 0x64
mov dword [esp + 8], eax
call fcn.0051faa0
add esp, 8
lea ecx, [esp]
push eax
call fcn.0055af82
mov ecx, dword [esp]
push 0
push 0x10
push ecx
call fcn.005647c7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4ede30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4ede6a
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4ede6a
mov ecx, dword [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4ede6a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4ede61
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4efc90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x581e95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], 0x635ac8
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov eax, dword [0x733f14]
mov dword [esp + 0x14], edi
mov dword [esi + 0x1c], eax
mov ecx, dword [0x733f14]
mov dword [esi + 0x20], ecx
mov edx, dword [0x733f14]
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edi
mov eax, dword [0x733f14]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x733f14]
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 5
call fcn.0055a1ca
mov edx, dword [0x733f14]
mov dword [esi + 0x48], edx
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 7
call fcn.0055a1ca
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], 0x635ac8
mov dword [esi + 0x64], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x74], edi
mov eax, dword [0x733f14]
mov dword [esi + 0x78], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4f36e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
xor esi, esi
push eax
push edi
mov dword [esp + 0x1c], esi
xor ebp, ebp
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push str.GetMappedFileNameW
push str.psapi.dll
mov dword [esp + 0x24], eax
call dword [0x736434]
push eax
call dword [0x7363ec]
mov ebx, eax
test ebx, ebx
je 0x4f3791
push 0x800
call fcn.004f56f0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4f3791
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4f3747
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4f3791
push 0
push 1
push 0
push 2
push 0
push edi
call dword [0x736384]
mov esi, eax
test esi, esi
je 0x4f3791
push 1
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4f37a0
push 0x104
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x4f3795
mov dword [esp + 0x14], 1
jmp 0x4f3795
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4f37a0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call fcn.004f5730
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
jne 0x4f37c4
push ebp
call fcn.004f5720
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4f4780
Capabilities:
Get disk size

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp + 0xc]
lea ecx, [esp]
push 0
push eax
push 8
push ecx
push 0
push 0
push 0x7405c
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4f47c3
mov eax, dword [esp + 4]
mov ecx, dword [esp]
push 0
push 0x200
push eax
push ecx
call fcn.0053f650
add esp, 8
ret
xor eax, eax
xor edx, edx
add esp, 8
ret
Function at 0x4f5750
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push eax
push ecx
push esi
call fcn.004f57a0
add esp, 0xc
test eax, eax
jne 0x4f5771
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4f5792
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x4f57f0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
lea edx, [esp]
push edx
push ecx
push eax
call fcn.004efbb0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret

Function at 0x4f59c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edi
call fcn.004f57a0
add esp, 0xc
test eax, eax
jne 0x4f59e0
pop edi
pop esi
ret
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 0
push edx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4f59ff
pop edi
pop esi
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, esi
pop edi
sete al
pop esi
ret

Function at 0x4f5b00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
push ebx
mov ebx, dword [esp + 8]
and edx, ecx
push ebp
push esi
cmp edx, 0xffffffff
push edi
je 0x4f5b30
push ecx
push eax
push ebx
call fcn.004f57a0
add esp, 0xc
test eax, eax
jne 0x4f5b30
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push edi
push ebx
mov dword [esp + 0x28], 0
call ebp
test eax, eax
jne 0x4f5b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x4f5b28
cmp dword [esp + 0x14], esi
je 0x4f5b8a
push esi
push ebx
call fcn.004f38d0
add esp, 8
cmp eax, 1
jne 0x4f5b80
mov eax, dword [esp + 0x14]
add edi, eax
sub esi, eax
jmp 0x4f5b3e
mov dword [0x85ac64], 1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4f7360
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x582476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x910
mov eax, dword [0x733f14]
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x92c]
mov dword [esp + 0x924], ebx
mov edx, dword [ecx]
mov eax, dword [edx - 8]
inc eax
push eax
call fcn.0055b230
mov ebp, eax
cmp ebp, ebx
je 0x4f752b
push 0xc
call fcn.0055f8c0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4f7420
mov eax, dword [0x733f14]
push edi
mov dword [esi + 8], eax
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x78c448]
mov eax, dword [esp + 0x934]
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x24], str.open
mov edx, dword [ecx + 0x1c]
test eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 1
pop edi
jne 0x4f7427
lea eax, [esp + 0x14]
mov dword [esp + 0x24], ebp
push eax
call dword [0x736494]
jmp 0x4f74cb
xor esi, esi
jmp 0x4f7504
cmp eax, 1
jne 0x4f7466
lea ecx, [esp + 0x54]
push str.shell32.dll_OpenAs_RunDLL
push ecx
call fcn.0053f406
lea edx, [esp + 0x5c]
push ebp
push edx
call fcn.0053f3dc
add esp, 0x10
lea ecx, [esp + 0x14]
lea eax, [esp + 0x54]
mov dword [esp + 0x24], 0x72892c
push ecx
mov dword [esp + 0x2c], eax
call dword [0x736494]
jmp 0x4f74cb
cmp eax, 2
jne 0x4f74cb
lea edx, [esp + 0x10]
push edx
call fcn.004f7560
add esp, 4
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x928], 1
call fcn.0055af32
lea ecx, [esp + 0x10]
mov byte [esp + 0x924], 0
call fcn.0055adeb
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xc]
mov eax, dword [eax - 8]
inc eax
push eax
call fcn.0055b230
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], ebp
call dword [0x736494]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call fcn.0055b280
cmp dword [esp + 0x34], 0x1f
je 0x4f7504
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4f7504
push ebp
lea ecx, [esi + 8]
mov dword [esi], eax
call fcn.0055af82
lea edx, [esp + 0x50]
push edx
push 0
push esi
push 0x4f72f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov ebx, 1
mov ecx, dword [esp + 0x92c]
push 0xffffffffffffffff
call fcn.0055b280
test ebx, ebx
jne 0x4f752b
test esi, esi
je 0x4f752b
lea ecx, [esi + 8]
call fcn.0055adeb
push esi
call fcn.0055f8e9
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x924], 0xffffffff
call fcn.0055adeb
mov ecx, dword [esp + 0x91c]
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x91c
ret
Function at 0x4fe9d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov ecx, 0x4000
xor eax, eax
mov edi, 0x84a4a0
xor esi, esi
rep stosd dword es:[edi], eax
mov eax, dword [0x7ccacc]
mov dword [0x83a484], esi
cmp eax, esi
mov dword [0x85a4a8], esi
mov dword [0x7ccabc], esi
jne 0x4fea08
mov eax, dword [esp + 0xc]
mov dword [0x7ccac8], eax
jmp 0x4fea40
mov eax, dword [0x83a488]
push 0x10000
push eax
call fcn.004fea80
add esp, 8
cmp eax, 0x106
mov dword [0x7ccac8], eax
jae 0x4fea40
cmp dword [0x7ccabc], esi
jne 0x4fea40
call fcn.004feae0
mov eax, dword [0x7ccac8]
cmp eax, 0x106
jb 0x4fea27
cmp eax, esi
je 0x4fea76
mov esi, dword [0x83a488]
xor ecx, ecx
mov dword [0x7ccab8], ecx
xor eax, eax
xor edx, edx
and ecx, 0x3ff
mov dl, byte [esi + eax]
and edx, 0x7fff
shl ecx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [0x7ccab8], ecx
jb 0x4fea54
pop edi
pop esi
ret
Function at 0x5018a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x5018d0
mov ecx, dword [esp + 8]
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x63787c]
xor eax, edx
inc ecx
dec esi
jne 0x5018b1
pop ebx
not eax
pop esi
ret

Function at 0x502b00
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 1
push edi
call fcn.00502aa0
mov ebp, dword [edi + 0x9c90]
add esp, 4
test ebp, ebp
jne 0x502b2f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
jle 0x502b4d
lea esi, [edi + 4]
mov ebx, ebp
mov eax, dword [esi]
push eax
call fcn.004f5720
mov dword [esi], 0
add esp, 4
add esi, 4
dec ebx
jne 0x502b36
lea ecx, [ebp*4]
push ecx
call fcn.004f56f0
add esp, 4
mov dword [edi + 0x9c88], eax
test eax, eax
jne 0x502b75
call fcn.004ed180
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
xor ebx, ebx
test ebp, ebp
jle 0x502bd6
mov eax, 0xfffffffc
lea esi, [edi + 4]
sub eax, edi
mov dword [esp + 0x18], eax
push ebx
push edi
call fcn.00502110
mov edx, dword [esi]
push edx
call fcn.004f5860
add esp, 0xc
test eax, eax
jne 0x502bbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x502bb5
mov eax, dword [esi]
push eax
call fcn.004f2e00
add esp, 4
mov dword [esp + 0x10], 0
jmp 0x502bce
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x9c88]
add ecx, esi
mov dword [ecx + edx], eax
inc ebx
add esi, 4
cmp ebx, ebp
jl 0x502b89
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x508280
Capabilities:
Create thread

Disassembly:
sub esp, 0x60
push ebx
mov ebx, dword [esp + 0x6c]
push ebp
push esi
mov eax, dword [ebx + 0x2b8]
push edi
push 0x80
push 8
push 8
push str.BurnBuffer
mov dword [esp + 0x88], eax
call fcn.004f6c90
mov ecx, dword [0x7d0744]
add esp, 0x10
cmp ecx, 3
jne 0x5082cd
mov ecx, dword [ebx + 0x3acc]
test ecx, ecx
je 0x5082cd
cmp eax, 0x20
jge 0x5082cd
mov eax, 0x20
shl eax, 0xa
cdq
sub eax, edx
push 0x68
mov edi, eax
sar edi, 1
call fcn.004f56f0
mov esi, eax
add esp, 4
test esi, esi
je 0x5083ff
mov ebp, dword [esp + 0x7c]
mov ecx, edi
imul ecx, ebp
push ecx
call fcn.004f56f0
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x5083ff
mov edx, dword [esp + 0x74]
push 0
push 0
push 0
push 0
mov dword [esi + 0x64], edx
call dword [0x736380]
test eax, eax
mov dword [esi + 0x2c], eax
je 0x50841b
lea eax, [esi + 0x30]
mov dword [esi + 0x20], ebp
push eax
mov dword [esi + 0x24], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebp, 1
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebp
mov eax, dword [0x7d0744]
cmp eax, 3
jne 0x508350
mov dword [esi + 0x60], ebp
mov eax, dword [esi + 0x60]
test eax, eax
je 0x50839f
mov eax, dword [ebx + 0x3acc]
test eax, eax
je 0x50839f
mov dx, word [0x7d09f8]
mov ecx, 0x17
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x78]
mov word [esp + 0x1c], dx
push 0xffffffffffffffff
mov al, byte [ecx]
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00515800
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x508440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x50841b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x58], ebp
push esi
call fcn.00508750
add esp, 4
test eax, eax
je 0x5083e2
cmp dword [esi + 0x48], ebp
je 0x5083e2
mov eax, dword [esi + 0x58]
test eax, eax
je 0x5083e9
push 0x64
call edi
jmp 0x5083c3
mov eax, dword [esi + 0x58]
test eax, eax
jne 0x5083ee
cmp dword [esi + 0x48], ebp
jne 0x50841b
mov dword [esi + 0x5c], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
push 0x6722c4
push 0x64
call fcn.0051faa0
mov ecx, dword [esp + 0x7c]
push eax
push 1
push ecx
call fcn.0051a630
add esp, 0x14
test esi, esi
je 0x508428
push esi
call fcn.005086f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
Function at 0x509bc0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x672700]
mov cx, word [0x672704]
push ebx
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x14], eax
mov word [esp + 0x18], cx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov esi, 0x41
test dword [esp + 0x10], edi
je 0x509c23
lea edx, [esp + 0x14]
mov word [esp + 0x14], si
push edx
call dword [0x7363bc]
cmp eax, 5
jne 0x509c23
mov eax, dword [esp + 0x20]
push ebx
push ebp
push eax
push esi
call fcn.005098f0
add esp, 0x10
shl edi, 1
inc esi
cmp si, 0x5a
jbe 0x509bf8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x51adc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x80c5e8]
cmp eax, 0x3e8
jb 0x51ae82
mov eax, dword [esp + 0x10]
push esi
test eax, eax
je 0x51ade6
push eax
jmp 0x51adeb
push 0x73768c
call fcn.0053f4af
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x51ae1f
push esi
push str.Verifying
push 0x116
call fcn.0051faa0
add esp, 8
push eax
mov eax, dword [esp + 0x14]
push str._s...__s
push 0
push eax
jmp 0x51ae69
mov eax, dword [0x7d0758]
push esi
test eax, eax
je 0x51ae4a
push str.Simulation_of_writing_media...
push 0x28b
call fcn.0051faa0
mov ecx, dword [esp + 0x18]
add esp, 8
push eax
push 0x69e348
push 0
push ecx
jmp 0x51ae69
push str.Writing
push 0x2ae
call fcn.0051faa0
mov edx, dword [esp + 0x18]
add esp, 8
push eax
push str._s...__s
push 0
push edx
call fcn.0051aa10
add esp, 0x14
call edi
push esi
mov dword [0x80c5e8], eax
call fcn.004f5720
add esp, 4
pop esi
pop edi
ret

Function at 0x51c140
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x7cfbc4]
test eax, eax
jne 0x51c154
mov dword [0x7d09bc], 1
mov ecx, dword [0x7d09b4]
test ecx, ecx
je 0x51c1c8
push esi
push 1
call fcn.0055e54e
mov eax, dword [0x7d09b4]
mov dword [eax + 0x144], 0
mov ecx, dword [0x7d09b4]
call fcn.00518c20
mov esi, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push fcn.0051be90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
pop esi
test eax, eax
jne 0x51c1d2
mov dword [0x7d09bc], eax
mov eax, dword [0x7d09b4]
test eax, eax
je 0x51c1d2
mov dword [eax + 0x144], 1
mov ecx, dword [0x7d09b4]
call fcn.00518c20
pop ecx
ret
mov edx, dword [esp + 8]
push edx
call fcn.0051be90
pop ecx
ret

Function at 0x51d5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
xor ebp, ebp
call dword [0x736388]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x51d5de
xor ebx, ebx
jmp 0x51d648
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jle 0x51d648
cmp esi, 0x200000
jge 0x51d648
push esi
call fcn.00540211
mov edi, eax
add esp, 4
test edi, edi
je 0x51d648
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x51d648
push esi
push edi
call fcn.0051d1f0
add esp, 8
test eax, eax
je 0x51d648
push 0x218
call fcn.004f56f0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x51d648
push esi
push edi
push ebp
call fcn.0051d2a0
add esp, 0xc
test eax, eax
jne 0x51d653
push ebp
call fcn.004f5720
add esp, 4
xor ebp, ebp
push edi
call fcn.004f5720
push ebx
call fcn.004f5730
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret