joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499a50
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 5
cmp edi, ebx
je 0x499b95
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 2
push edi
call ebp
test eax, eax
jne 0x499b80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x499b80
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004a52bf
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x499b6b
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push edi
call ebp
test eax, eax
je 0x499b4b
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x499b4b
xor edi, edi
cmp dword [esi], ebx
jbe 0x499b40
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebx, [esi + 4]
jmp 0x499b20
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
push eax
push ecx
call ebp
test eax, eax
jne 0x499b38
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x499b20
jmp 0x499b40
mov dword [esp + 0x18], 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.004a4132
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004a314d
add esp, 0x18
ret
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004a314d
add esp, 0x18
ret
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004a314d
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004a314d
add esp, 0x18
ret
Function at 0x49a590
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x58452a
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x284]
mov dword fs:[0], eax
mov dword [esp + 0x28c], 0
lea eax, [esp + 0x14]
push eax
call fcn.004030f0
mov bl, 1
mov byte [esp + 0x28c], bl
mov ecx, dword [esp + 0x294]
push ecx
push str._s.
lea edi, [esp + 0x1c]
call fcn.00413090
push 0x250
lea edx, [esp + 0x38]
push 0
push edx
call fcn.004add60
mov ecx, dword [esp + 0x28]
add esp, 0x14
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x49a770
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test byte [esp + 0x2c], 0x10
je 0x49a6ea
cmp word [esp + 0x58], 0x2e
jne 0x49a669
mov ax, word [esp + 0x5a]
test ax, ax
je 0x49a751
cmp ax, 0x2e
jne 0x49a669
cmp word [esp + 0x5c], 0
je 0x49a751
mov edx, dword [0x5ff398]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ff398
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x28c], 3
mov edx, dword [esp + 0x294]
lea ecx, [esp + 0x58]
push ecx
push edx
push str._s_s
lea edi, [esp + 0x24]
call fcn.00413090
mov eax, dword [esp + 0x24]
add esp, 8
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov dword [esp + 0x28], esi
call fcn.00492a60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x290], 5
mov byte [esp + 0x290], 3
call fcn.0049a590
add esp, 4
mov byte [esp + 0x28c], bl
mov eax, edi
push eax
call fcn.00403090
jmp 0x49a751
mov edx, dword [0x5ff398]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ff398
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x28c], 7
mov edx, dword [esp + 0x294]
lea ecx, [esp + 0x58]
push ecx
push edx
push str._s_s
lea edi, [esp + 0x28]
call fcn.00413090
mov esi, dword [esp + 0x28]
add esp, 0xc
push esi
call ebp
mov byte [esp + 0x28c], bl
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49a751
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x49a636
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x294]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov byte [esp + 0x28c], 0
lea eax, [esp + 0x14]
push eax
call fcn.00403090
mov dword [esp + 0x28c], 0xffffffff
lea ecx, [esp + 0x294]
push ecx
call fcn.00403090
mov eax, esi
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.004a314d
add esp, 0x27c
ret
Function at 0x49a800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585858
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
cmp dword [0x601fe0], 0
je 0x49a9b0
lea ecx, [esp + 0x14]
push ecx
mov ecx, 4
lea edx, [esp + 0x44]
call fcn.00497c50
mov byte [esp + 0x38], 1
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x44]
mov ecx, 2
push eax
lea edx, [ecx + 2]
call fcn.00497d10
mov byte [esp + 0x38], 2
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x44]
mov ecx, 2
push edx
lea edx, [ecx + 4]
call fcn.00497d10
mov byte [esp + 0x38], 3
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004aa82c
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
mov word [esp + 0x24], ax
call fcn.004aa82c
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov word [esp + 0x26], ax
call fcn.004aa82c
mov word [esp + 0x2a], ax
xor eax, eax
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x49a983
mov ecx, dword [esp + 0x44]
call fcn.0049a7e0
lea ecx, [esp + 0x18]
mov esi, eax
mov edi, edx
call fcn.0049a7e0
push 0
sub esi, eax
push 0x15180
sbb edi, edx
push edi
push esi
call fcn.004b8500
mov esi, eax
mov eax, dword [0x601fe0]
mov ecx, edx
cdq
cmp ecx, edx
jl 0x49a983
jg 0x49a930
cmp esi, eax
jbe 0x49a983
mov byte [esp + 0x38], 2
lea edx, [esp + 0xc]
push edx
call fcn.00403090
mov byte [esp + 0x38], 1
lea eax, [esp + 0x10]
push eax
call fcn.00403090
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x14]
push ecx
call fcn.00403090
mov dword [esp + 0x38], 0xffffffff
lea edx, [esp + 0x40]
push edx
call fcn.00403090
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
mov byte [esp + 0x38], 2
lea eax, [esp + 0xc]
push eax
call fcn.00403090
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x10]
push ecx
call fcn.00403090
mov byte [esp + 0x38], 0
lea edx, [esp + 0x14]
push edx
call fcn.00403090
mov dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x40]
push eax
call fcn.00403090
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x49b5a0
Capabilities:
Write file on windows

Disassembly:
test ecx, ecx
je 0x49b5c3
test edx, edx
je 0x49b5c3
mov eax, dword [esi]
test eax, eax
je 0x49b5c3
push eax
push edx
push 1
push ecx
call fcn.004aa110
mov eax, dword [esi]
push eax
call fcn.004a9f52
add esp, 0x14
ret

Function at 0x49b910
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jbe 0x49b92f
test ecx, ecx
je 0x49b92f
xor eax, eax
test edx, edx
jbe 0x49b929
mov edi, edi
xor byte [eax + ecx], 0xef
inc eax
cmp eax, edx
jb 0x49b920
mov eax, 1
ret
xor eax, eax
ret

Function at 0x49bc90
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0049f7b0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0049f850
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004a314d
add esp, 0x68
ret
Function at 0x49be00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49bf91
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49be93
cmp dword [esp + 0x14], 1
jne 0x49bf78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x49bf78
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x49bed8
cmp dword [esp + 0x14], 1
jne 0x49bf78
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x49bf78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x49bf0f
cmp dword [esp + 0x14], 1
jne 0x49bf78
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x49bf78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x49bf78
cmp dword [esp + 0x14], 3
jne 0x49bf78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x49bf78
lea eax, [esi + 0xc]
call fcn.0049bd00
test eax, eax
je 0x49bf78
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x49c380
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0049e2f0
add esp, 8
test eax, eax
jne 0x49c3eb
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004a314d
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x49c400
push esi
lea ecx, [esp + 0x14]
call fcn.0049f7b0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0049f850
test edi, edi
je 0x49c41e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004a314d
add esp, 0x6c
ret

Function at 0x49c460
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0049e4e0
add esp, 4
test eax, eax
jne 0x49c4be
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004a314d
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0049f850
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004a314d
add esp, 0x64
ret

Function at 0x49c4e0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0049e5c0
add esp, 8
test eax, eax
jne 0x49c55f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004a314d
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0049f3a0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004a314d
add esp, 0x74
ret

Function at 0x49ce60
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49ce8b
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x49cea4
push 0x5d3ab0
call fcn.004a0320
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x49d740
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x49d773
mov dword [esp + 0x10], 0xffffffff
jmp 0x49d779
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x49d7a7
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
jmp 0x49d887
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49d7d7
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
jmp 0x49d887
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x49d7f9
mov eax, 1
push 0x5d3ab0
call fcn.004a0320
add esp, 4
jmp 0x49d887
cmp dword [esp + 0x40], ebx
je 0x49d835
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x49d81b
mov eax, 5
push 0x5d3ab0
call fcn.004a0320
add esp, 4
jmp 0x49d887
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x49d87f
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x49d843
mov ebx, esi
jmp 0x49d807
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x49d86c
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
jmp 0x49d887
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.0049ce60
test eax, eax
je 0x49d887
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x49d891
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a314d
add esp, 0x28
ret
Function at 0x49e170
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49e1b6
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x49e248
jg 0x49e1de
cmp ebx, ecx
jb 0x49e248
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x49e20d
push 0x5d3ab0
mov eax, 0x5d3ab0
call fcn.004a02b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.0049ce60
test eax, eax
je 0x49e203
mov eax, dword [esp + 0x20]
test eax, eax
je 0x49e22e
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x49e255
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x49e255
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x49eb00
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x49ec40
cmp dword [esp + 0x28], ebp
je 0x49ec40
push edi
push 0x2800
call fcn.004a52bf
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x49eb63
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004a314d
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x49eb70
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.0049cd30
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x49ec16
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004add60
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49ec09
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x49ec09
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.0049e890
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x49ec20
inc ebx
cmp ebx, 0x10
jl 0x49eb70
push edi
call fcn.004a4132
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004a314d
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.004a314d
add esp, 0x1c
ret
Function at 0x49ecf0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x49ed2a
cmp dword [esp + 0x34], esi
je 0x49ed2a
push 0x200
call fcn.004a52bf
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x49ed35
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ee94
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x49ee2a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x49ed8d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ee03
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49edf8
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.0049ec60
cmp edx, ebx
jb 0x49edf8
ja 0x49edf2
cmp eax, dword [esp + 0x24]
jbe 0x49edf8
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x49ed80
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x49ee40
cmp dword [esp + 0x24], 0
jbe 0x49ee94
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.0049cd30
add esp, 0x10
test eax, eax
jne 0x49ee79
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.004a4132
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push edi
push edx
push str.MAC:
call fcn.0049e890
add esp, 0xc
mov dword [esp + 0x18], eax
push edi
call fcn.004a4132
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret