joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce0b
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x41fce6
call fcn.00410107
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x14], 0xf
call fcn.0040156e
push 0x1c
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040f8b0
add esp, 0xc
push str.gfxUI.exe
lea ecx, [ebp - 0x2c]
call fcn.00401de6
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0040f8b0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.0040f8b0
add esp, 0x18
mov dword [ebp - 0x84], esi
call fcn.004011e8
cmp eax, 1
jne 0x40cebe
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40ce87
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
push ecx
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40ced0
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x40]
call esi
mov byte [ebp - 0x2d], 1
jmp 0x40ced0
push ebx
push str.Warning
push str.Install_.Net3.0_Frame_Work_to_run_the_Intel_UI_Application
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040161a
mov al, byte [ebp - 0x2d]
call fcn.00410151
ret

Function at 0x40d440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x42acb4], 0
push esi
jne 0x40d3b3
call fcn.0040d2d9
test eax, eax
je 0x40d3f6
mov eax, dword [0x42acb4]
cmp eax, 1
jne 0x40d3d4
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40d3f6
pop esi
ret
push eax
call dword [0x42acbc]
test eax, eax
jne 0x40d43e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40d3fa
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x42acb4]
call dword [0x42acbc]
mov edi, eax
test edi, edi
je 0x40d41f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40d43b
mov edi, esi
add esi, 0xff0
push edi
push dword [0x42acb4]
call dword [0x42acb8]
add edi, 0x10
cmp edi, esi
jb 0x40d427
mov eax, edi
pop edi
pop esi
ret
jmp 0x40d3a0

Function at 0x40f92a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4296e0]
jne 0x40f934
repz ret
jmp fcn.00412d91
Function at 0x41cc82
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413911
and dword [ebp - 4], 0
cmp dword [0x42b6ec], 0
mov ebx, eax
jne 0x41cd33
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41cde4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42335c
push edi
call esi
test eax, eax
je 0x41cde4
push eax
call fcn.0041389f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42b6ec], eax
call esi
push eax
call fcn.0041389f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42b6f0], eax
call esi
push eax
call fcn.0041389f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42b6f4], eax
call esi
push eax
call fcn.0041389f
pop ecx
mov dword [0x42b6fc], eax
test eax, eax
je 0x41cd33
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041389f
pop ecx
mov dword [0x42b6f8], eax
mov eax, dword [0x42b6f8]
cmp eax, ebx
je 0x41cd8b
cmp dword [0x42b6fc], ebx
je 0x41cd8b
push eax
call fcn.0041391a
push dword [0x42b6fc]
mov esi, eax
call fcn.0041391a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41cd8b
test edi, edi
je 0x41cd8b
call esi
test eax, eax
je 0x41cd82
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41cd82
test byte [ebp - 0xc], 1
jne 0x41cd8b
or dword [ebp + 0x10], 0x200000
jmp 0x41cdc4
mov eax, dword [0x42b6f0]
cmp eax, ebx
je 0x41cdc4
push eax
call fcn.0041391a
pop ecx
test eax, eax
je 0x41cdc4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41cdc4
mov eax, dword [0x42b6f4]
cmp eax, ebx
je 0x41cdc4
push eax
call fcn.0041391a
pop ecx
test eax, eax
je 0x41cdc4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b6ec]
call fcn.0041391a
pop ecx
test eax, eax
je 0x41cde4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41cde6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b0a2d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b0a65
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004aead1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004aeaa9
jmp 0x4b0a71
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b211f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b2161
call fcn.004b7d63
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4b2161
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4b2158
xor eax, eax
jmp 0x4b2169
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b216f
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b8293
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b82c1
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4b82df
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b81f9
jmp 0x4b82df
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b82df
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b81f9
test edi, edi
mov eax, edi
jne 0x4b82c9
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1480c80
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1480c8a
pushal
call 0x1480c90
pop ebp
sub ebp, 0x10
sub ebp, 0x1080c80
jmp 0x1480ca6
mov eax, 0x1080c80
add eax, ebp
add eax, 0x4c
mov ecx, 0x58d
mov edx, 0x14abcf2
xor byte [eax], dl
inc eax
dec ecx
jne 0x1480cbd
jmp 0x1480cd0
jns 0x1480d11
jns 0x1480d4f
into
bnd jae 0x1480d0d
or dh, dl
int1
aas
dec edx
div edx
dec eax
invalid
sbb ebx, edx
repne cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
jns 0x1480d90
cli
bnd jns 0x1480d86
invalid
out dx, al
lcall 0xdef3, 0xf219347e
salc
mov dword [0xf2f2f71a], eax
sbb ecx, ebp
repne cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
or eax, 0x870dfe87
cli
sbb al, byte [eax + 0x79f2f2f2]
dec edi
cli
sar dword [ebx], 0x73
add bh, bl
sbb al, 0x75
push ebx
jae 0x1480d79
fistp word [esi*2 + 0x7120c153]
sbb dh, bh
mov edx, 0xf2bc76fd
std
std
jp 0x1480d46
xchg esp, eax
jns 0x1480d80
retf
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x631d64e2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2e7a4aa9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x1000d019
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x1000d029
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1000ae65
aas
outsd dx, dword [esi]
jbe 0x1000d0aa
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1000ae65
faddp st(6)
in al, 0x49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1000d052
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1000d052
invalid
call fcn.1000ae65
insd dword es:[edi], dx
cmp byte [esi + 0x245a8bee], bl
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1000ae65
cmp dl, byte [esi]
and dword [esi - 1], ebx
jne 0x1000d09c
push dword [ebp + 4]
in eax, 0xff
push dword [ebp + 8]
sbb ebp, eax
jmp 0xc900d0c6

Function at 0x1000f1d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f1fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f1fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402480
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x124]
mov ecx, eax
lea eax, [ebp - 0x13c]
mov edx, eax
mov eax, 1
call fcn.004041a0
call fcn.004042a0
push eax
test eax, eax
jne 0x402665
mov eax, dword [ebp - 4]
test eax, eax
je 0x4024e4
jmp 0x40250c
push 0x105
lea eax, [ebp - 0x118]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.00404a60
jmp 0x402665
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402830
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.00402890
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x402539
jmp 0x40253b
jmp 0x402552
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, 0
jl 0x402552
jmp 0x402548
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x402552
jmp 0x402514
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x144], 0
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x10]
mov esi, 1
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x10]
call fcn.00404aa0
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov ecx, ebx
mov edx, esi
call fcn.00404b00
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
call fcn.00404bc0
lea edx, [ebp - 8]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4025dd
mov eax, dword [eax - 4]
cmp eax, 2
jge 0x4025e7
jmp 0x402665
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x22
je 0x4025f2
jmp 0x402665
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4025ff
mov eax, dword [eax - 4]
mov al, byte [edx + eax - 1]
cmp al, 0x22
je 0x402609
jmp 0x402665
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40262a
mov ecx, dword [ecx - 4]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404b00
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
call fcn.00404bc0
lea edx, [ebp - 8]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 8], eax
call fcn.004043a0
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x144], 0
pop eax
test eax, eax
je 0x4026af
mov edx, str._t_nAnsiString
lea eax, [ebp - 8]
call fcn.00404630
call fcn.00404430
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
leave
ret
Function at 0x402ac0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], eax
mov byte [ebp - 4], dl
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x24]
and edx, 0xefffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
cmp byte [ebp - 4], 0
jne 0x402ae6
jmp 0x402af7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
or eax, 0x10000000
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov byte [eax + 0x59], dl
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402b0c
jmp 0x402b0e
jmp 0x402b52
cmp byte [ebp - 4], 0
jne 0x402b16
jmp 0x402b30
mov eax, dword [ebp - 8]
mov edx, dword [0x416410]
call edx
push 5
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
jmp 0x402b52
mov eax, dword [ebp - 8]
mov byte [eax + 0x189], 0
push 0
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 8]
mov edx, dword [0x416410]
call edx
leave
ret
Function at 0x414fa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x414fbe
jmp 0x414fc7
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x414fd8
jmp 0x414fe1
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 4], eax
push 0x12
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x414ff2
jmp 0x414ffb
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x401480
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x496f74]
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40151e
cmp dword [esp + 0x10], 2
jne 0x40151e
cmp dword [esp + 4], 5
jae 0x4014ea
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
push ecx
push edx
call fcn.00401fc0
xor edx, edx
add esp, 8
test al, al
sete dl
mov eax, edx
mov ecx, dword [esp + 0x94]
call fcn.004543e5
add esp, 0x98
ret
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push eax
push ecx
call fcn.00402220
xor edx, edx
add esp, 8
test al, al
sete dl
mov eax, edx
mov ecx, dword [esp + 0x94]
call fcn.004543e5
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
mov eax, 1
call fcn.004543e5
add esp, 0x98
ret

Function at 0x401540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x496f74]
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
mov byte [esp + 9], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [esp + 1], 0x3a
je 0x401586
mov eax, 1
mov ecx, dword [esp + 0x104]
call fcn.004543e5
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp]
push ecx
push edx
call fcn.00401480
mov ecx, dword [esp + 0x10c]
add esp, 8
call fcn.004543e5
add esp, 0x108
ret

Function at 0x401fc0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x469d1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov eax, dword [0x496f74]
mov dword [esp + 0x120], eax
movsx eax, byte [esp + 0x134]
push ebx
push eax
lea ecx, [esp + 0x18]
push 0x470304
push ecx
xor ebx, ebx
call fcn.004546fa
add esp, 0xc
push 0x104
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x4020ad
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.004545e6
mov edx, dword [0x496150]
add esp, 4
push edx
lea ecx, [esp + 0xc]
call fcn.00452eb0
lea ecx, [esp + 8]
mov dword [esp + 0x134], ebx
call fcn.00452dc0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00454560
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x402098
lea ecx, [esp + 8]
call fcn.00452dc0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402070
mov ecx, dword [esp + 0x140]
push ecx
sub eax, edx
add esi, eax
push 0x470300
push esi
call fcn.0045451d
add esp, 0xc
cmp eax, 1
jne 0x402098
mov bl, al
lea ecx, [esp + 8]
mov dword [esp + 0x134], 0xffffffff
call fcn.00409ef0
pop esi
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x124]
mov al, bl
pop ebx
call fcn.004543e5
add esp, 0x130
ret
Function at 0x4020e0
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x1c
mov eax, dword [0x496f74]
push ebx
mov dword [esp + 0x1c], eax
movsx eax, byte [esp + 0x24]
push esi
push eax
lea ecx, [esp + 0xc]
push str.._c:
push ecx
xor bl, bl
call fcn.004546fa
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40215e
push 0
lea eax, [esp + 0x2c]
push eax
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x402157
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov dword [eax], edx
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
pop esi
mov al, bl
pop ebx
call fcn.004543e5
add esp, 0x1c
ret

Function at 0x4024c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x496f74]
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 2
jb 0x4024f1
cmp byte [esp + 1], 0x3a
mov al, byte [esp]
je 0x4024f3
mov al, 0x43
mov ecx, dword [esp + 0x104]
call fcn.004543e5
add esp, 0x108
ret
Function at 0x402b40
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x283c
call fcn.004548d0
mov eax, dword [0x496f74]
push ebx
push esi
mov dword [esp + 0x2840], eax
mov eax, dword [0x496158]
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.00452eb0
mov ecx, dword [ebp + 8]
push ecx
xor ebx, ebx
mov ecx, eax
mov dword [esp + 0x2858], ebx
call fcn.00452dc0
push eax
lea edx, [esp + 0x38]
push edx
call fcn.004546fa
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x2854], 0xffffffff
call fcn.00409ef0
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402d16
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push ebx
mov dword [esp + 0x30], ecx
xor eax, eax
lea edx, [esp + 0x14]
push edx
push 0x2710
mov ecx, 0x9c4
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x13c]
push eax
push 0xc
lea ecx, [esp + 0x38]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov ebx, dword [ebp + 0xc]
je 0x402cbd
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x402c54
lea edx, [esp + eax + 0x130]
push 0x64
push edx
lea eax, [ebx + 4]
push eax
call fcn.00454760
add esp, 0xc
mov eax, dword [esp + 0x140]
test eax, eax
je 0x402c75
push 0x64
lea ecx, [esp + eax + 0x134]
push ecx
lea edx, [ebx + 0x68]
push edx
call fcn.00454760
add esp, 0xc
mov eax, dword [esp + 0x144]
test eax, eax
je 0x402c99
push 0x64
lea eax, [esp + eax + 0x134]
push eax
lea ecx, [ebx + 0x130]
push ecx
call fcn.00454760
add esp, 0xc
mov eax, dword [esp + 0x148]
test eax, eax
je 0x402cbd
lea edx, [esp + eax + 0x130]
push 0x64
push edx
lea eax, [ebx + 0xcc]
push eax
call fcn.00454760
add esp, 0xc
xor eax, eax
push eax
mov ecx, 0x9c4
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x2710
lea edx, [esp + 0x13c]
push edx
push eax
push eax
push 0x2d0c10
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x402d0b
push 0x64
lea eax, [esp + 0x144]
push eax
add ebx, 0xcc
push ebx
call fcn.00454760
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402d1b
mov eax, 0xb
mov ecx, dword [esp + 0x284c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2844]
call fcn.004543e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402d40
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x469d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x496f74]
mov dword [esp + 0x24], eax
push ebx
mov bl, byte [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x5c
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x402d93
mov eax, 0x15
jmp 0x402e61
mov ecx, dword [0x49615c]
push ebp
push esi
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.00452eb0
movsx edx, bl
push edx
mov ecx, eax
mov dword [esp + 0x44], 0
call fcn.00452dc0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004546fa
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
call fcn.00409ef0
mov ebp, dword [esp + 0x50]
xor eax, eax
push eax
push eax
push 3
push eax
push 3
mov ecx, 0x68
mov edi, ebp
rep stosd dword es:[edi], eax
push 0xc0000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402e57
mov ebx, dword [esp + 0x4c]
push ebp
push ebx
push edi
call fcn.004026e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x402e4e
push ebp
push edi
call fcn.00402320
mov esi, eax
add esp, 8
test esi, esi
je 0x402e4e
mov al, byte [esp + 0x54]
test al, al
je 0x402e4e
push ebp
push ebx
call fcn.00402990
mov esi, eax
add esp, 8
test esi, esi
je 0x402e4e
push ebp
push ebx
call fcn.00402b40
add esp, 8
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402e5c
mov esi, 0xb
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x28]
pop ebx
call fcn.004543e5
add esp, 0x34
ret

Function at 0x403090
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x403020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
setne al
ret