joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442513
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push 0xc0
push ebx
push esi
mov dword [eax], ebx
mov edi, esi
call fcn.004ae820
add esp, 0xc
push ebx
lea eax, [ebp + 0xc]
push eax
push 0x100000
push esi
push ebx
push ebx
push 0x70050
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x442605
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xfff70
push esi
push ebx
push ebx
push 0x7400c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44260f
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
lea edx, [eax - 1]
cmp edx, ebx
mov dword [ecx], eax
lea edi, [esi + 0x90]
jl 0x4425f3
lea eax, [edx + edx*8]
mov ecx, edx
shl eax, 4
shl ecx, 5
inc edx
lea eax, [eax + edi + 0x40]
lea ecx, [ecx + esi + 0x10]
mov dword [ebp - 4], edx
mov edx, dword [ecx - 8]
mov dword [eax - 8], edx
mov edx, dword [ecx - 4]
mov dword [eax - 4], edx
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov dl, byte [ecx + 0x13]
mov byte [eax + 0xc], dl
mov dword [eax - 0x10], ebx
mov dl, byte [ecx + 0x11]
mov byte [eax + 0x11], dl
mov edx, dword [ecx + 8]
mov dword [eax + 0x14], edx
mov dl, byte [ecx + 0x10]
mov byte [eax + 0x10], dl
mov dl, byte [ecx + 0x12]
mov byte [eax + 0x12], dl
sub ecx, 0x20
sub eax, 0x90
dec dword [ebp - 4]
jne 0x4425a9
mov eax, dword [esi + 4]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], ebx
mov eax, dword [eax]
mov dword [edi + 4], eax
jmp 0x44260d
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442a79
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
push edi
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x318], esi
mov ecx, 0xc3
lea edi, [ebp - 0x314]
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edi, edi
inc edi
test eax, eax
jne 0x442ac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [ebp - 4], edi
je 0x442ac3
mov dword [ebp - 4], esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 0x2200000
push 3
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x442af0
xor eax, eax
jmp 0x442b78
push dword [ebp + 0xc]
mov dword [ebp - 0x318], 0xa0000003
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0xc]
shl eax, 1
mov word [ebp - 0x30e], ax
mov eax, dword [ebp - 0x30e]
add eax, 2
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x308]
push eax
call fcn.004b0d75
movzx eax, word [ebp - 0x30e]
pop ecx
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push esi
add eax, 0xc
push esi
mov dword [ebp - 0x314], eax
add eax, 8
push eax
lea eax, [ebp - 0x318]
push eax
push 0x900a4
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x442b6f
cmp dword [ebp - 4], esi
jne 0x442b6d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x442c33
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442c90
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
push esi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [esp + 0x10]
push eax
call fcn.004145c5
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x442c91
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 2
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
jle 0x442cb8
push dword [ebp + 0x10]
push edi
push esi
call fcn.0043e70a
add esp, 0xc
test al, al
je 0x442cb8
mov eax, dword [ebp + 0x10]
jmp 0x442cd7
mov ax, word [esi]
cmp ax, word [edi]
jne 0x442cd5
mov ax, word [edi + 2]
cmp word [esi + 2], ax
jne 0x442cd5
cmp ax, 0x3a
jne 0x442cd5
push 2
pop eax
jmp 0x442cd7
xor eax, eax
push 0
lea eax, [esi + eax*2]
push eax
push edi
call fcn.00442b7d
add esp, 0xc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
pop esi
pop ebp
ret
Function at 0x442d33
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x40
mov esi, ecx
push 0xc
push dword [esi]
lea edi, [esi + 4]
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x12
push edi
call ebx
push 0x12
push 0x4c8a84
push edi
call fcn.004145c5
mov ecx, dword [ebp + 8]
lea eax, [edi + 0xe]
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov esi, dword [esi + 0x18]
add esp, 0xc
test esi, esi
je 0x442d97
push edi
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x442d97
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x443391
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push edi
mov dword [ebp + 0x10], 0x80
mov edi, ebx
test ebx, ebx
ja 0x4433ba
xor eax, eax
cmp eax, dword [esi]
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret
and dword [ebp + 0x14], 0
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4433f1
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x4433e8
cmp dword [ebp + 0x10], eax
jg 0x4433e5
mov eax, edi
jmp 0x4433e8
dec dword [ebp + 0x10]
add dword [esi], eax
add dword [ebp + 0xc], eax
sub ebx, eax
jmp 0x4433a9
and dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x4433ad
mov eax, dword [ebp + 0x18]
cmp edi, eax
jbe 0x4433ad
cmp ebx, eax
jbe 0x4433a7
lea edi, [edi + eax - 1]
shr edi, 1
cmp edi, eax
jbe 0x4433a9
and edi, 0xfffffe00
jmp 0x4433a9

Function at 0x4434a5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and dword [0x4dd4b4], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test byte [ebp - 0xef], 0x80
je 0x4434d2
or dword [0x4dd4b4], 2
test byte [ebp - 0xf0], 0x80
je 0x4434e2
or dword [0x4dd4b4], 4
test byte [ebp - 0xee], 0x80
je 0x4434f2
or dword [0x4dd4b4], 1
test byte [ebp - 0xa5], 0x80
je 0x443502
or dword [0x4dd4b4], 8
test byte [ebp - 0xa4], 0x80
je 0x443512
or dword [0x4dd4b4], 8
leave
ret
Function at 0x4443d8
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esi
jne 0x444413
cmp dword [ebp + 0xc], 2
jb 0x444428
cmp dword [ebp + 0xc], 3
jbe 0x44440c
cmp dword [ebp + 0xc], 5
jne 0x444428
mov dword [ebp - 4], 0x4c3038
jmp 0x444413
mov dword [ebp - 4], 0x4c3048
push 0x12
push esi
push esi
push dword [ebp - 4]
call dword [0x4dcf68]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x44442f
xor eax, eax
jmp 0x44456f
push edi
push 0x1c
pop ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
lea eax, [ebp - 0x34]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push esi
push dword [ebp - 8]
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x5c], ecx
call edi
test eax, eax
je 0x444562
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call edi
push esi
lea eax, [ebp + 0x10]
push eax
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x10], esi
call ebx
cmp dword [ebp + 0x10], esi
je 0x444535
cmp dword [ebp + 0x10], 0x400
ja 0x444535
push 0x1c
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x478], 6
call fcn.004ae820
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x78], 0x1c
call ebx
test eax, eax
je 0x444535
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x444535
push esi
lea ecx, [ebp - 0x18]
push ecx
push 0xc
lea ecx, [ebp - 0x40]
push ecx
push esi
push esi
push 0x2d1080
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44452c
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x3c]
je 0x444552
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call edi
test eax, eax
jne 0x44446f
jmp 0x444561
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x14], eax
pop ebx
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
leave
ret

Function at 0x4446e2
Capabilities:
Set environment variable

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
call fcn.00444692
push dword [esp + 0xc]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
ret 8
Function at 0x4457e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0x7a
push edi
jbe 0x44589f
cmp word [esi + 2], 0x3a
jne 0x44589f
cmp word [esi + 4], 0
jne 0x44589f
mov eax, dword [ebp + 0x14]
and word [ebp - 0x20c], 0
test eax, eax
je 0x445821
and dword [eax], 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ax, word [esi]
cmp ax, word [ebp - 0x20c]
jne 0x445878
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
cmp edi, 4
jbe 0x445878
cmp dword [ebp + 0xc], edi
jae 0x44585d
mov eax, edi
jmp 0x4458af
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
call fcn.004145c5
add esp, 0xc
lea eax, [edi - 1]
jmp 0x4458af
push 4
pop eax
cmp dword [ebp + 0xc], eax
jb 0x4458af
mov eax, dword [ebp + 0x10]
mov cx, word [esi]
and word [eax + 6], 0
push 3
mov word [eax], cx
mov word [eax + 2], 0x3a
mov word [eax + 4], 0x5c
pop eax
jmp 0x4458af
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
pop edi
pop esi
leave
ret
Function at 0x446ec1
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp edx, esi
push edi
mov dword [ebp - 4], esi
jne 0x446f15
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
jne 0x446ef3
xor eax, eax
cmp eax, esi
mov dword [ebp - 4], eax
mov edx, eax
jne 0x446f15
push esi
push esi
push 3
push esi
push 3
push esi
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
jne 0x446f10
xor eax, eax
mov dword [ebp - 4], eax
mov edx, eax
cmp edx, 0xffffffff
je 0x446f5f
cmp edx, esi
je 0x446f5f
push 9
pop ecx
xor eax, eax
push 0x28
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
pop eax
push esi
lea ecx, [ebp + 0xc]
push ecx
push eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [ebp - 0x1c]
jmp 0x446f62
or esi, 0xffffffff
lea ecx, [ebp - 4]
call fcn.00402cc5
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x448857
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00405c00
cmp dword [ebp - 8], ebx
je 0x44889c
push dword [ebp - 8]
call fcn.0049be72
mov edi, edx
cmp edi, ebx
pop ecx
mov esi, eax
jg 0x4488a0
jl 0x44889c
cmp esi, ebx
jae 0x4488a0
xor esi, esi
xor edi, edi
lea ecx, [ebp - 4]
call fcn.00444df8
cmp edi, ebx
jl 0x4488ea
jg 0x4488b2
cmp esi, ebx
jbe 0x4488ea
lea eax, [esi + 5]
push eax
lea ecx, [ebp - 4]
call fcn.00444e3a
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp eax, edi
jl 0x4488e4
jg 0x4488e2
cmp ecx, esi
jbe 0x4488e4
mov ecx, esi
mov eax, dword [ebp - 4]
mov byte [ecx + eax], bl
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 4]
call fcn.00445027
lea ecx, [ebp - 4]
call fcn.0043e825
lea ecx, [ebp - 8]
call fcn.00402cc5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448c94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
and eax, 1
mov dword [ebp - 4], eax
call fcn.0049be72
mov ebx, eax
test ebx, ebx
pop ecx
jg 0x448cba
xor eax, eax
jmp 0x448e44
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebx + 0xc]
push eax
mov ecx, edi
call fcn.00444fb1
mov esi, dword [edi]
or dword [ebp - 8], 0xffffffff
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [ebp - 8]
test ebx, ebx
jle 0x448e40
test eax, eax
je 0x448e40
push 0xa
lea eax, [ebx + esi]
push 0
push eax
call fcn.004ae820
lea eax, [ebx + 0xa]
add esp, 0xc
mov dword [ebp + 0x10], eax
push 2
push 0x4c8394
push esi
call fcn.0043e88e
add esp, 0xc
test eax, eax
jne 0x448d27
push ebx
push esi
call fcn.00442e90
pop ecx
pop ecx
push 2
push 0x4c8390
push esi
call fcn.0043e88e
add esp, 0xc
neg eax
sbb eax, eax
inc eax
cmp byte [esi], 0
je 0x448d65
cmp byte [esi + 1], 0
jne 0x448d65
push dword [ebp + 0x10]
lea eax, [esi + 2]
push esi
push eax
call fcn.0041457b
add dword [ebp + 0x10], 2
add esp, 0xc
inc ebx
xor eax, eax
inc ebx
mov word [esi], 0xfeff
inc eax
test eax, eax
jne 0x448d92
cmp byte [esi], al
jne 0x448d9b
cmp byte [esi + 1], al
je 0x448d9b
push dword [ebp + 0x10]
lea eax, [esi + 2]
push esi
push eax
call fcn.0041457b
add esp, 0xc
inc ebx
inc ebx
add dword [ebp + 0x10], 2
mov word [esi], 0xfffe
jmp 0x448d0a
mov eax, ebx
shr eax, 1
jmp 0x448e42
mov eax, dword [edi]
and dword [edi], 0
push ebx
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.00444fb1
mov eax, dword [edi]
mov cx, word [0x4c8390]
push 3
mov word [eax], cx
pop eax
push eax
push 0x4c8398
push esi
mov dword [ebp + 0x10], eax
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x448dd7
cmp dword [ebp - 4], eax
je 0x448e06
jmp 0x448dda
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + 1]
push ecx
mov ecx, dword [edi]
inc ecx
inc ecx
push ecx
mov ecx, ebx
sub ecx, eax
push ecx
add eax, esi
push eax
push 8
push 0xfde9
call dword [0x4dcbe4]
cmp dword [ebp - 4], 0
je 0x448e39
test eax, eax
jg 0x448e3d
or dword [ebp - 4], 2
lea eax, [ebx + 1]
push eax
mov eax, dword [edi]
inc eax
inc eax
push eax
push ebx
push esi
push 8
push 0
call dword [0x4dcbe4]
and dword [ebp + 0x10], 0
test eax, eax
jg 0x448e3d
cmp dword [ebp - 4], 0
je 0x448dd7
xor eax, eax
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.0043e825
mov eax, esi
jmp 0x448e42
test eax, eax
jle 0x448e29
inc eax
jmp 0x448e2b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44914d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov byte [ebp - 0x28], bl
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00405c00
cmp dword [ebp - 4], ebx
je 0x4491a1
push ebx
lea eax, [ebp - 8]
push eax
push 0x20
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00441c6a
add esp, 0xc
mov bl, al
lea ecx, [ebp - 4]
call fcn.00402cc5
mov al, bl
pop ebx
leave
ret

Function at 0x449667
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
movzx eax, word [0x4dcc20]
or eax, 0x20019
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov esi, dword [ebp + 0x18]
jne 0x449712
mov edi, dword [ebp + 0x14]
push 0x1000
mov ecx, edi
mov dword [esi], 0xffa
call fcn.00444e3a
mov eax, dword [edi]
mov byte [eax], bl
mov eax, dword [edi]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call ebx
cmp eax, 0xea
mov dword [ebp - 8], eax
jne 0x4496fd
add dword [esi], 0xa
mov eax, dword [esi]
add eax, 6
push eax
mov ecx, edi
call fcn.00444e3a
mov eax, dword [edi]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
cmp dword [ebp - 8], 0
je 0x449723
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x1c]
and dword [esi], 0
test ecx, ecx
je 0x44971e
mov dword [ecx], eax
lea eax, [ebx - 1]
jmp 0x449754
xor ecx, ecx
cmp dword [esi], ecx
jge 0x44972b
mov dword [esi], ecx
mov eax, dword [edi]
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, dword [esi]
mov edx, dword [edi]
inc eax
shr eax, 1
lea eax, [edx + eax*2]
mov word [eax + 2], cx
mov word [eax], cx
mov eax, dword [esi]
add eax, 5
push eax
mov ecx, edi
call fcn.00444e3a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x449981
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
or ebx, 0xffffffff
cmp esi, edi
mov dword [ebp - 4], edi
je 0x4499a1
mov dword [esi], ebx
mov dword [esi + 4], ebx
push edi
push 0x20000000
push 3
push edi
push 3
push 0x100080
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00405c00
cmp dword [ebp - 4], edi
je 0x449a09
push edi
lea eax, [ebp - 0x1a0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x2d1080
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1a0], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x449a09
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4499f8
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp esi, edi
mov eax, dword [ebp - 0xc]
je 0x449a07
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ebx, eax
lea ecx, [ebp - 4]
call fcn.00402cc5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x449ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x20]
xor edx, edx
push edi
mov edi, dword [ebp + 0x18]
xor ecx, ecx
inc edx
mov eax, edi
add eax, edx
adc ebx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
jne 0x449cd5
cmp eax, edx
jbe 0x449cde
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
cmp esi, ecx
jne 0x449ce8
lea eax, [ebp - 0x14]
mov dword [ebp + 0x20], eax
mov edi, dword [ebp + 0x14]
cmp edi, ecx
mov esi, dword [ebp + 8]
jg 0x449d02
push 0x200
push dword [esi]
call fcn.00442116
pop ecx
pop ecx
mov edi, eax
mov eax, dword [ebp + 0x10]
shl eax, 7
lea eax, [eax + edi - 1]
xor edx, edx
div edi
mov ebx, eax
inc ebx
inc ebx
lea eax, [ebx + 2]
imul eax, edi
push eax
push 0
push dword [ebp + 0xc]
call fcn.004ae820
and dword [ebp + 0x14], 0
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [esi]
call fcn.0043fb25
add esp, 0x1c
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
cmp dword [ebp + 0x1c], ecx
ja 0x449d7d
jb 0x449d5b
cmp dword [ebp + 0x18], ecx
ja 0x449d7d
mov eax, 0x1c2
mov edx, dword [ebp + 0xc]
cmp byte [eax + edx], 0xee
jne 0x449d73
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
add eax, 0x10
cmp eax, 0x1f2
jle 0x449d60
push ecx
push dword [ebp - 8]
mov eax, edi
push dword [ebp - 0xc]
cdq
push edx
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], edx
call fcn.004ae930
add eax, dword [ebp + 0x24]
adc edx, dword [ebp + 0x28]
push edx
push eax
push dword [esi]
call fcn.0043fb25
mov eax, dword [ebp + 0xc]
add esp, 0x10
add eax, edi
inc ebx
imul ebx, edi
push 0
lea ecx, [ebp + 0x14]
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
push dword [esi]
mov dword [ebp + 0x10], eax
call ebx
cmp dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
lea eax, [eax + edi*2 + 0x10000]
mov dword [ebp + 0xc], eax
je 0x449e33
push edi
push 0
push eax
call fcn.004ae820
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [eax + 4], 0
ja 0x449e01
jb 0x449df3
cmp dword [eax], 2
jae 0x449e01
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov ecx, dword [ecx + 0x24]
mov dword [eax + 4], ecx
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [eax + 4]
push dword [eax]
call fcn.004ae930
add eax, dword [ebp + 0x24]
adc edx, dword [ebp + 0x28]
push edx
push eax
push dword [esi]
call fcn.0043fb25
add esp, 0x10
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
push dword [esi]
call ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret