joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b680
Capabilities:
Get storage device properties

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
jne 0x44b6ce
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
push 3
push edi
push 3
push SysReAllocStringLen
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x44b6b3
xor eax, eax
cmp eax, edi
mov esi, eax
jne 0x44b6cd
push edi
push edi
push 3
push edi
push 3
push edi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x44b6cb
xor eax, eax
mov esi, eax
pop ebp
cmp eax, 0xffffffff
je 0x44b75a
cmp eax, edi
je 0x44b75a
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
push edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
lea edx, [esp + 0x4c]
push edx
push 0x28
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x24]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x2d1400
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0x28
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, edi
mov ebx, dword [esp + 0x34]
je 0x44b751
cmp esi, 0xffffffff
je 0x44b751
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x34
ret
cmp esi, edi
je 0x44b76a
cmp esi, 0xffffffff
je 0x44b76a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x34
ret
Function at 0x44b780
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4eab48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movzx ecx, word [0x51c734]
mov edx, dword [esp + 0x34]
push ebp
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
or ecx, 0x2001b
push ecx
xor ebp, ebp
push ebp
push edx
push eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x44b94c
push ebx
mov bl, byte [esp + 0x40]
test bl, 1
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
je 0x44b7f7
mov ecx, dword [esp + 0x10]
push 0x4efd50
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebp
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
push ebp
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov dword [esp + 0x18], edi
jae 0x44b835
mov ecx, eax
mov dword [esp + 0x14], ecx
lea eax, [ecx*4 + 8]
xor esi, esi
cmp eax, ebp
mov dword [esp + 0x28], esi
jl 0x44b860
lea ecx, [eax + eax + 2]
push ecx
call fcn.00449130
mov esi, eax
add esp, 4
cmp esi, ebp
mov dword [esp + 0x28], esi
je 0x44b860
mov word [esi], bp
cmp edi, ebp
mov dword [esp + 0x38], ebp
jne 0x44b924
test bl, 4
je 0x44b8c8
mov edi, dword [esp + 0x20]
dec edi
cmp edi, ebp
jl 0x44b8c8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x3c]
push ecx
lea eax, [edx*4 + 1]
push esi
mov dword [esp + 0x44], eax
mov word [esi], bp
mov edx, dword [esp + 0x28]
push edi
push edx
call ebx
cmp eax, ebp
jne 0x44b8bd
cmp word [esi], bp
je 0x44b8c1
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebp
je 0x44b8c1
mov dword [esp + 0x18], eax
dec edi
jns 0x44b880
mov bl, byte [esp + 0x48]
test bl, 2
je 0x44b924
mov edi, dword [esp + 0x24]
dec edi
cmp edi, ebp
jl 0x44b924
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea esp, [esp]
mov ecx, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x3c]
push eax
lea edx, [ecx*4 + 1]
push esi
mov dword [esp + 0x44], edx
mov word [esi], bp
mov ecx, dword [esp + 0x28]
push edi
push ecx
call ebx
cmp eax, ebp
jne 0x44b91d
cmp word [esi], bp
je 0x44b921
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [0x51d3e4]
cmp eax, ebp
je 0x44b921
mov dword [esp + 0x18], eax
dec edi
jns 0x44b8e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x44b945
mov ecx, dword [0x51d3c8]
add esi, 0xfffffff8
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x44ba80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
push esi
push 0x20019
push eax
mov dword [esp + 0xc], 0x32
mov dword [esp + 0x10], 1
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov esi, eax
test esi, esi
je 0x44baf4
push edi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.Class
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x44baf4
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x44baf4
mov eax, 1
pop esi
add esp, 0x3c
ret
xor eax, eax
pop esi
add esp, 0x3c
ret

Function at 0x44c3a0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4ebc28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
push 0x51d5ec
mov edi, ecx
mov dword [esp + 0x10], 0x51d5ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x88]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x44c407
mov eax, dword [edi + 0x18]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x88]
push ecx
push 2
push 0x466
push eax
mov dword [edi + 0x88], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [edi + 0x18]
call fcn.004467c0
cmp dword [edi + 0xb0], ebx
je 0x44c42e
mov edx, dword [edi + 0xbc]
mov eax, dword [edi + 0xb8]
push ebx
push edx
push eax
call fcn.00448190
add esp, 0xc
cmp dword [edi + 0xa0], ebx
je 0x44c501
mov ecx, dword [edi + 0xac]
mov esi, dword [ecx]
dec esi
js 0x44c501
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x44c460
mov edx, dword [edi + 0xa8]
mov eax, dword [edx]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x44c4f9
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x44c4bc
mov ecx, dword [eax + 0x18]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 0xa8]
mov eax, dword [edx]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x18]
push 4
push 1
push 1
push 0xfffffffffffffff8
push 0xfffffffffffffff8
push 0
push eax
call ebx
mov ecx, dword [edi + 0xa8]
mov edx, dword [ecx]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x18]
push 0
push edx
call ebp
mov eax, dword [edi + 0xa8]
mov ecx, dword [eax]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ecx + 4]
cmp edx, 4
jne 0x44c4d5
cmp dword [ecx + 0x40], 0
jg 0x44c4e1
cmp edx, 0xa
jne 0x44c4f9
cmp word [ecx + 0x4c], 0
je 0x44c4f9
mov edx, dword [eax]
mov ecx, dword [edx + esi*4]
test ecx, ecx
lea eax, [edx + esi*4]
mov dword [eax], 0x51d4b8
je 0x44c4f9
mov eax, dword [ecx]
push 1
call dword [eax]
dec esi
jns 0x44c460
pop ebp
push 0x51d5ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44d200
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e9e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
push esi
push 0x80
push 3
push esi
push 7
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], esi
call fcn.00417e55
mov ebp, dword [esp + 0x10]
cmp ebp, esi
je 0x44d263
push ebp
call fcn.004a44e0
mov ebx, edx
add esp, 4
cmp ebx, esi
mov edi, eax
jg 0x44d267
jl 0x44d263
cmp edi, esi
jae 0x44d267
xor edi, edi
xor ebx, ebx
push 2
call fcn.00449130
mov esi, eax
add esp, 4
test esi, esi
je 0x44d27a
mov byte [esi], 0
test ebx, ebx
jl 0x44d2c9
jg 0x44d284
test edi, edi
jbe 0x44d2c9
lea eax, [edi + 6]
push esi
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
je 0x44d29b
mov byte [edi + esi + 5], 0
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp eax, ebx
jl 0x44d2c5
jg 0x44d2c3
cmp ecx, edi
jbe 0x44d2c5
mov ecx, edi
mov byte [ecx + esi], 0
movzx edx, word [0x522010]
push esi
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi]
mov ebx, eax
lea ebp, [ebx + 2]
lea eax, [ebp + ebp + 4]
push ecx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x44d300
mov word [eax + ebp*2 + 2], 0
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
push ebp
push edx
push ebx
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
test ebp, ebp
jge 0x44d31b
xor ebp, ebp
mov ecx, dword [edi]
mov word [ecx + ebp*2], 0
mov edx, dword [edi]
lea eax, [ebp + ebp + 4]
push edx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x44d33f
mov word [eax + ebp*2 + 2], 0
test esi, esi
je 0x44d355
mov eax, dword [0x51d3c8]
add esi, 0xfffffff8
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x44d36d
cmp eax, 0xffffffff
je 0x44d36d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44d710
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x44d730
xor ecx, ecx
cmp word [eax], 0x26
jne 0x44d72a
add eax, 2
inc ecx
cmp word [eax], 0x26
je 0x44d720
cmp word [eax], 0
jne 0x44d736
mov eax, 0x4f24cc
ret
test ecx, ecx
push esi
jne 0x44d76a
push edi
push ecx
mov edi, eax
mov esi, 0x4f24d0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
pop edi
jne 0x44d790
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jmp 0x44d789
xor edx, edx
cmp ecx, 1
mov ecx, dword [esp + 8]
setle dl
push 0xffffffffffffffff
dec edx
and edx, ecx
push edx
push eax
call fcn.0041ff6a
test eax, eax
mov esi, 0x4f24d0
jne 0x44d790
mov esi, 0x4f24cc
mov eax, esi
pop esi
ret
Function at 0x44d910
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0x10]
test al, al
je 0x44d937
mov eax, dword [esi + 8]
test eax, eax
jle 0x44d937
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 8]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44d958
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x44d971
cmp eax, 0xffffffff
je 0x44d971
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
pop ecx
ret

Function at 0x44dc40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e9e48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x54], ebx
call fcn.00417e55
mov esi, dword [esp + 8]
cmp esi, ebx
jne 0x44dca1
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20
lea edx, [esp + 0x1c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00446af0
add esp, 0xc
cmp esi, 0xffffffff
mov bl, al
je 0x44dcd6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x44e0a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e9e9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x200002
mov ebp, 1
mov word [esp + 0x1c], bx
call fcn.00449130
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x14], edi
je 0x44e0e5
mov word [edi], bx
cmp dword [esp + 0x240], ebx
mov dword [esp + 0x22c], ebx
jne 0x44e11c
lea eax, [esp + 0x18]
push eax
push 0x104
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
cmp esi, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x240], ecx
je 0x44e23c
cmp ebp, ebx
mov esi, 0xa0000000
mov dword [esp + 0x10], ebx
je 0x44e12e
mov esi, 0xe0000000
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
mov ebx, dword [esp + 0x244]
push 3
push esi
push ebx
call dword [0x51d404]
mov edi, eax
test edi, edi
jne 0x44e179
lea esp, [esp]
cmp ebp, 1
jne 0x44e1bc
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 3
and esi, 0xbfffffff
push esi
push ebx
mov ebp, 2
call dword [0x51d404]
mov edi, eax
test edi, edi
je 0x44e150
mov ecx, dword [esp + 0x240]
push ecx
push edi
call dword [0x51d408]
mov esi, eax
test esi, esi
jne 0x44e199
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov edx, dword [esp + 0x23c]
push edx
push edi
call dword [0x51d40c]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x44e1ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x44e222
test edi, edi
jne 0x44e179
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x44e238
test esi, esi
je 0x44e222
xor ebx, ebx
test ebp, ebp
jne 0x44e1d9
mov ebx, 0x200
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ecx
call dword [0x51d410]
mov esi, eax
test esi, esi
jne 0x44e21e
cmp ebp, 2
jne 0x44e214
mov edx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
or ebx, 0x200
push ebx
push edx
push eax
call dword [0x51d410]
mov esi, eax
test esi, esi
jne 0x44e21e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x44e22d
push ebx
call dword [0x51d414]
test edi, edi
je 0x44e238
push edi
call dword [0x51d414]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x44e253
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x224]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x44e270
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
movzx ecx, word [0x51c734]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x1c]
or ecx, 0x20019
push ecx
xor ebx, ebx
push ebx
push edx
push eax
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test ebp, ebp
jne 0x44e34d
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [edi], 0xffa
mov ecx, dword [esi]
push ecx
mov eax, 0xfff
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44e2d8
mov byte [eax + 0xffe], 0
mov edx, dword [esi]
mov ebx, dword [esp + 0x20]
push edi
mov byte [edx], 0
mov eax, dword [esi]
mov edx, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
cmp ebp, 0xea
jne 0x44e33b
mov ebp, dword [edi]
add ebp, 0xa
mov dword [edi], ebp
mov ecx, dword [esi]
lea eax, [ebp + 5]
push ecx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44e322
mov byte [eax + ebp + 4], 0
mov edx, dword [esi]
mov ecx, dword [esp + 0x18]
push edi
push edx
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
test ebp, ebp
je 0x44e360
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44e357
mov dword [eax], ebp
pop edi
pop esi
pop ebp
lea eax, [ebx - 1]
pop ebx
pop ecx
ret
cmp dword [edi], 0
jge 0x44e36b
mov dword [edi], 0
mov ecx, dword [edi]
mov eax, dword [esi]
mov byte [eax + ecx], 0
mov ecx, dword [edi]
mov eax, dword [esi]
add eax, ecx
mov word [eax + 2], 0
mov word [eax], 0
mov edi, dword [edi]
mov edx, dword [esi]
add edi, 5
lea eax, [edi + 1]
push edx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44e3a1
mov byte [eax + edi], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x44e590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
neg esi
sbb esi, esi
push edi
mov eax, ecx
push ecx
xor eax, 0xa
and esi, 0x2000000
push ebp
add esi, 0x2000000
mov dword [esp + 0x1c], eax
call fcn.004217de
mov edx, dword [esp + 0x38]
add esp, 8
test edx, edx
lea ecx, [ebp + eax*2]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0
mov ebx, eax
mov edi, ebp
jne 0x44e5f6
mov dword [esp + 0x24], ecx
mov ebp, ecx
jmp 0x44e61c
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
cmp ebp, ecx
jae 0x44e6d8
mov edi, ebp
mov ax, word [ebp]
add ebp, 2
cmp word [esp + 0x14], ax
je 0x44e612
cmp ebp, ecx
jb 0x44e600
mov ebx, ebp
sub ebx, edi
mov dword [esp + 0x24], ebp
sar ebx, 1
cmp edi, ebp
mov eax, edi
jae 0x44e62c
xor word [eax], dx
add eax, 2
cmp eax, ebp
jb 0x44e622
push 0
push 0
push ebx
push edi
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp]
mov dword [esp + 0x1c], eax
lea eax, [eax + ecx + 1]
mov dword [esp + 0x18], eax
lea eax, [eax + eax + 2]
push edx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebp], eax
je 0x44e674
mov ecx, dword [esp + 0x18]
mov word [eax + ecx*2], 0
mov edx, dword [ebp]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
push ecx
lea ebp, [edx + eax*2]
push ebp
push ebx
push edi
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
lea ecx, [ebx + ebx]
mov ebx, ecx
shr ecx, 2
mov edx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
test edx, edx
rep stosb byte es:[edi], al
jle 0x44e5ea
mov ecx, dword [esp + 0x2c]
add ecx, edx
dec edx
mov dword [esp + 0x2c], ecx
js 0x44e5ea
lea eax, [edx + 1]
mov dx, word [esp + 0x30]
xor word [ebp], dx
add ebp, 2
dec eax
jne 0x44e6c4
jmp 0x44e5ea
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov esi, dword [esp + 0x2c]
pop edi
mov word [ecx + esi*2], dx
mov eax, dword [eax]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x44e6f0
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x414
call fcn.00449130
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 4], esi
je 0x44e70e
mov word [esi], 0
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov word [esi], 0
mov eax, edi
mov ecx, str.Device_
mov edx, 7
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x44e73f
dec edx
jns 0x44e726
jmp 0x44e770
push 0xc
push edi
push str.DosDevices_
call fcn.004449d0
add esp, 0xc
test al, al
jne 0x44e770
cmp word [edi], 0
je 0x44e775
cmp word [edi + 2], 0
je 0x44e775
push 0x3a
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x44e775
or dword [esp + 0x24], 1
mov eax, edi
mov ecx, 0x4f94a8
mov edx, 0xa
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebp, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
mov ebp, dword [esp + 0x1c]
jne 0x44e7b1
dec edx
jns 0x44e781
mov ecx, dword [esp + 0x24]
mov bl, byte [esp + 0x28]
and ecx, 0xfffffffe
test bl, bl
mov dword [esp + 0x24], ecx
jne 0x44e7e5
jmp 0x44e7b5
mov bl, byte [esp + 0x28]
test bl, bl
je 0x44e7c8
xor ecx, ecx
mov cx, word [ebp]
push ecx
call fcn.00446ca0
add esp, 4
mov edx, dword [esp + 0x24]
push edi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov esi, eax
test esi, esi
jne 0x44e7f4
test bl, bl
jl 0x44e843
mov esi, dword [esp + 0x10]
xor bl, bl
push 0x208
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x44e825
test bl, bl
jle 0x44e843
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
push 0x208
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x44e843
mov edx, dword [esp + 0x24]
push edi
push ebp
or edx, 0xe
push edx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test bl, bl
mov esi, eax
jl 0x44e843
test esi, esi
jne 0x44e843
or bl, 0xff
jmp 0x44e7b5
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop ebp
pop ebx
je 0x44e861
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x44e870
Capabilities:
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x4e9ebb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
push esi
push edi
xor edi, edi
mov dword [esp + 8], edi
mov eax, dword [esp + 0x1b8]
push edi
push 0x20000000
push 3
push edi
push 3
push 0x100080
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1cc], edi
call fcn.00417e55
mov esi, dword [esp + 8]
cmp esi, edi
je 0x44e8fa
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0xc
lea edx, [esp + 0x18]
push edx
push edi
push edi
push 0x2d1080
push esi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x44e914
cmp esi, 0xffffffff
je 0x44e8fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
add esp, 0x1ac
ret
cmp esi, 0xffffffff
mov edi, dword [esp + 0x10]
je 0x44e924
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1a8]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1ac
ret