joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ddc0
Capabilities:
Get disk information
Get storage device properties

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
mov esi, ecx
and esi, 0xffdf
lea eax, [esi - 0x41]
mov ebp, 1
cmp ax, 0x19
ja case.0x45de16.2
mov ecx, dword [0x58a76c]
mov edx, dword [0x58a770]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], edx
mov word [esp + 0x1c], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x45de16
jmp dword [eax*4 + 0x45df18]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005308cb
add esp, 0x2c
ret
mov edx, dword [0x58a780]
mov ecx, dword [str..X:]
mov eax, dword [0x58a784]
push edi
push 0
push 0
push 3
push 0
push 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
mov cx, word [0x58a788]
push SysReAllocString
lea edx, [esp + 0x3c]
mov dword [esp + 0x44], eax
push edx
mov word [esp + 0x4c], cx
mov word [esp + 0x48], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45def0
push 0x227
call fcn.0052f1ee
add esp, 4
push 0
mov esi, eax
mov dword [esi + 4], 0x227
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov ecx, dword [esi + 4]
push ecx
push esi
push 0xc
lea edx, [esp + 0x24]
push edx
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45dee0
mov eax, dword [esi + 0x1c]
cmp eax, 7
je 0x45dede
cmp eax, 4
jne 0x45dee0
xor ebp, ebp
push esi
call fcn.005342a6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005308cb
add esp, 0x2c
ret
mov ecx, dword [esp + 0x30]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.005308cb
add esp, 0x2c
ret

Function at 0x45f0c0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x45f0e0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x45f0f4
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc
Function at 0x464560
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5678c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5a53f4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x5a9538]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, 0x5a9538
mov dword [esp + 0x14], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov ebp, dword [esp + 0x44]
xor ecx, ecx
cmp ebp, ecx
mov dword [esp + 0x38], ecx
jle 0x464701
mov ax, word [esp + 0x40]
xor edx, edx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], dx
lea esi, [ecx + 1]
cmp ax, cx
je 0x4645ef
lea esi, [esp + 0x18]
lea edx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
cmp ax, cx
jne 0x4645e0
sub esi, edx
sar esi, 1
mov dword [esp + 0x1c], ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
mov byte [esp + 0x38], 1
cmp edx, ecx
ja 0x46460b
cmp eax, 0xffffffff
jbe 0x464615
push 0x80070057
call fcn.00404da0
cmp eax, 0xa
jbe 0x464626
push eax
lea ecx, [esp + 0x20]
call fcn.004694d0
jmp 0x46462e
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + esi + 2]
push edx
push eax
call fcn.005342b1
push eax
call fcn.00403c50
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ebx, esi
imul ebx, ebp
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, ebx
add esp, 0x14
or ecx, edx
jge 0x464670
push ebx
mov ecx, edi
call fcn.00404930
mov edi, dword [edi]
cmp esi, 1
jne 0x464699
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
test ebp, ebp
jle 0x4646c8
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, ebp
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x4646c8
mov ecx, edi
test ebp, ebp
jle 0x4646c8
nop
xor eax, eax
test esi, esi
jle 0x4646c3
jmp 0x4646b0
mov edx, dword [esp + 0x1c]
mov dx, word [edx + eax*2]
mov word [ecx], dx
inc eax
add ecx, 2
cmp eax, esi
jl 0x4646b0
sub ebp, 1
jne 0x4646a0
test ebx, ebx
jl 0x46460b
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp ebx, dword [eax - 8]
jg 0x46460b
mov dword [eax - 0xc], ebx
mov eax, dword [ecx]
xor ecx, ecx
lea edx, [esp + 0x20]
mov word [eax + ebx*2], cx
cmp dword [esp + 0x1c], edx
je 0x4646fd
lea ecx, [esp + 0x1c]
call fcn.00468480
mov edi, dword [esp + 0x14]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005308cb
add esp, 0x28
ret 8
Function at 0x471e80
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x569d66
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x2c4], eax
push ebx
push ebp
push esi
mov eax, dword [0x5a53f4]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
xor ebp, ebp
push 0x24c
lea eax, [esp + 0x8c]
push ebp
push eax
mov esi, ecx
mov dword [esp + 0x90], ebp
call fcn.00534b20
push 0x585ea8
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.0040b0e0
push esi
push eax
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x304], ebp
call fcn.00412e00
mov esi, 8
add esp, 0x24
cmp dword [eax + 0x18], esi
jb 0x471f0d
mov eax, dword [eax + 4]
jmp 0x471f10
add eax, 4
lea ecx, [esp + 0x84]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x64], esi
jb 0x471f38
mov edx, dword [esp + 0x50]
push edx
call fcn.005303ae
add esp, 4
xor eax, eax
mov dword [esp + 0x2e0], 0xffffffff
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], ax
cmp dword [esp + 0x2c], esi
jb 0x471f69
mov ecx, dword [esp + 0x18]
push ecx
call fcn.005303ae
add esp, 4
xor edx, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], dx
cmp ebx, 0xffffffff
jne 0x471f88
xor al, al
jmp 0x472040
mov ebx, 1
lea ecx, [ecx]
push 0x585ea8
lea eax, [esp + 0x6c]
push edi
push eax
call fcn.0040b0e0
lea ecx, [esp + 0xbc]
push ecx
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x2f8], ebx
call fcn.0040b0e0
add esp, 0x18
cmp dword [eax + 0x18], esi
jb 0x471fc7
mov eax, dword [eax + 4]
jmp 0x471fca
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x48], esi
jb 0x471fe4
mov eax, dword [esp + 0x34]
push eax
call fcn.005303ae
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2e0], 0xffffffff
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], cx
cmp dword [esp + 0x80], esi
jb 0x472018
mov edx, dword [esp + 0x6c]
push edx
call fcn.005303ae
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x84]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x471f90
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c4]
xor ecx, esp
call fcn.005308cb
add esp, 0x2d4
ret
Function at 0x472220
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x472230
mov al, 1
ret
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov eax, dword [esi]
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 0xffffffff
je 0x472261
shr eax, 4
test al, 1
je 0x472261
mov eax, dword [esi]
push eax
mov bl, 1
call ebp
jmp 0x47226a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x472293
call edi
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x47229f
mov eax, dword [esi]
push eax
test bl, bl
jne 0x472299
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x47229f
pop edi
pop ebp
mov al, 1
pop ebx
ret
call ebp
test eax, eax
jne 0x472293
cmp byte [esp + 0x10], 0
je 0x4722c0
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x472293
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebp
xor al, al
pop ebx
ret

Function at 0x4749a0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0047ad50
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0047adf0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.005308cb
add esp, 0x68
ret

Function at 0x474a10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0047ad50
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0047adf0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.005308cb
add esp, 0x68
ret
Function at 0x474ba0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x58b120
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x474d31
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x474c33
cmp dword [esp + 0x14], 1
jne 0x474d18
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x474d18
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x474c78
cmp dword [esp + 0x14], 1
jne 0x474d18
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x474d18
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x474caf
cmp dword [esp + 0x14], 1
jne 0x474d18
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x474d18
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x474d18
cmp dword [esp + 0x14], 3
jne 0x474d18
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x474d18
lea eax, [esi + 0xc]
call fcn.00474a80
test eax, eax
je 0x474d18
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x475310
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00478c20
add esp, 8
test eax, eax
jne 0x47537b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005308cb
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x475390
push esi
lea ecx, [esp + 0x14]
call fcn.0047ad50
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0047adf0
test edi, edi
je 0x4753ae
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.005308cb
add esp, 0x6c
ret

Function at 0x475410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00478e20
add esp, 4
test eax, eax
jne 0x47546e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005308cb
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0047adf0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.005308cb
add esp, 0x64
ret

Function at 0x475490
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00478f10
add esp, 8
test eax, eax
jne 0x47550f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.005308cb
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0047a400
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.005308cb
add esp, 0x74
ret

Function at 0x476b30
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x476b62
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0047be30
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x476b87
push 0x58b2b4
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0047c230
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x476b90
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x476bc2
push str.WriteFile__
push 0x111
push str..QHImageHlp.c
xor edx, edx
call fcn.0047be30
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x476be7
push 0x58b2e0
push 0x113
push str..QHImageHlp.c
mov edx, 1
call fcn.0047c230
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret

Function at 0x476c60
Capabilities:
Clear file content

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x476c87
push str.SetEndOfFile__
push 0x132
push str..QHImageHlp.c
xor edx, edx
call fcn.0047be30
add esp, 0xc
xor eax, eax
ret
mov eax, 1
ret

Function at 0x476c90
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x476cba
push str.GetFileSizeEx__
push 0x11e
jmp 0x476dcf
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
cmp esi, edi
ja 0x476dac
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
jb 0x476cdc
cmp ecx, edx
jae 0x476dac
mov eax, edx
sub eax, ecx
mov ecx, edi
sbb ecx, esi
mov ebx, eax
shrd ebx, ecx, 0xf
shr ecx, 0xf
and eax, 0x7fff
mov dword [esp + 0x10], ebx
mov esi, eax
jne 0x476d01
mov esi, 0x8000
jmp 0x476d06
inc ebx
mov dword [esp + 0x10], ebx
xor eax, eax
sub edx, esi
sbb edi, eax
mov eax, dword [esp + 0x38]
mov ebp, edi
xor edi, edi
mov ebx, edx
add eax, ebx
adc edi, ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
jbe 0x476dac
lea ecx, [ecx]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x476db9
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
call fcn.00476b30
test eax, eax
je 0x476dde
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
push 0
push 0
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x476dc5
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
call fcn.00476b90
test eax, eax
je 0x476dde
mov eax, dword [esp + 0x14]
add ebx, 0xffff8000
adc ebp, 0xffffffff
add dword [esp + 0x18], 0xffff8000
mov esi, 0x8000
adc edi, 0xffffffff
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jb 0x476d30
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
push str.SetFilePointerEx__
push 0xf9
jmp 0x476dcf
push str.SetFilePointerEx__
push 0x10e
push str..QHImageHlp.c
xor edx, edx
call fcn.0047be30
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x478a60
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x478aad
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.0047be30
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x478b44
jg 0x478ad3
cmp ebx, ecx
jb 0x478b44
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x478b09
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.0047be30
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00476b30
test eax, eax
je 0x478aff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x478b2a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x478b51
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x478b51
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x479600
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x479740
cmp dword [esp + 0x28], ebp
je 0x479740
push ebx
push 0x2800
call fcn.005351d9
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x479663
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005308cb
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x479670
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.00476810
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x479716
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00534b20
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x479709
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x479709
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.004793b0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x479720
inc edi
cmp edi, 0x10
jl 0x479670
push ebx
call fcn.00534c33
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005308cb
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.005308cb
add esp, 0x1c
ret