joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441ab0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor eax, eax
xor edi, edi
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push 8
mov esi, ecx
mov edx, dword [esi + 4]
lea ecx, [esp + 0x2c]
push ecx
push edi
push edi
push 0x7405c
push edx
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push edi
add eax, 0x1ff
push 0x200
adc ecx, edi
push ecx
push eax
call sub.ntdll.dll__alldiv
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
mov ebx, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
call edx
test eax, eax
je 0x441b65
mov eax, dword [esp + 0x10]
mul dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
cmp edx, ebx
jb 0x441b65
ja 0x441b69
cmp eax, ebp
ja 0x441b69
mov edx, ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441c50
Capabilities:
Check os version
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x57c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x574], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x28]
push eax
mov esi, ecx
mov dword [esp + 0x2c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x2c], 6
jb 0x441e78
xor edi, edi
push 0x3e
lea ecx, [esp + 0x146]
push edi
push ecx
mov word [esp + 0x14c], di
call sub.ntdll.dll_memset
mov edx, dword [esi + 8]
push edx
lea eax, [esp + 0x150]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x18
push edi
push 0x80
push 3
push edi
push 3
push 0xc0000000
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441d0f
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x11e
mov ecx, str..disk.cpp
add esi, 8
call fcn.00441380
mov edx, dword [esi]
push eax
push str._s:_Failed_to_open_disk_in__IsOfflineDisk.
push edi
call edx
add esp, 0x10
jmp 0x441e78
push edi
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
push edi
push 0x70024
push esi
mov dword [esp + 0x44], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x441e71
push 0x3fe
lea ecx, [esp + 0x186]
push edi
push ecx
xor ebp, ebp
mov dword [esp + 0x24], 0x200
mov dword [esp + 0x28], edi
mov word [esp + 0x18c], di
call sub.ntdll.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push edi
lea edx, [esp + 0x20]
push edx
push 0x200
push esi
call ebx
cmp eax, 0xffffffff
jne 0x441da1
call fcn.004205a0
mov ebx, eax
mov edi, dword [ebx]
push 0x137
mov ecx, str..disk.cpp
add edi, 8
call fcn.00441380
push eax
mov eax, dword [edi]
push str._s:_Failed_to_SetFilePointer_in__IsOfflineDisk.
push ebx
call eax
jmp 0x441e6e
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x18c]
push edx
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441e48
cmp dword [esp + 0x14], 0x200
jne 0x441e48
mov ecx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x441e07
call fcn.004205a0
mov ebx, eax
mov edi, dword [ebx]
push 0x14e
mov ecx, str..disk.cpp
add edi, 8
call fcn.00441380
push eax
push str._s:_Failed_to_SetFilePointer_in__IsOfflineDisk.
jmp 0x441e69
push edi
lea eax, [esp + 0x18]
push eax
push 0x200
lea ecx, [esp + 0x18c]
push ecx
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x441e33
cmp dword [esp + 0x14], 0x200
je 0x441e38
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp ebp, edi
setne al
jmp 0x441e7a
call fcn.004205a0
mov ebx, eax
mov edi, dword [ebx]
push 0x13f
mov ecx, str..disk.cpp
add edi, 8
call fcn.00441380
push eax
push str._s:_Failed_to_ReadFile_in__IsOfflineDisk.
mov edx, dword [edi]
push ebx
call edx
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x584]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x57c
ret
Function at 0x442220
Capabilities:
Check os version

Disassembly:
sub esp, 0x8ac
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x8a4], eax
push esi
push edi
push 0x1ff
lea eax, [esp + 0x4ad]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x4b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [esi + 0x38], 0
je 0x442276
mov ecx, dword [esi + 8]
push ecx
call fcn.00442170
push 0
push 1
push edx
push eax
lea edx, [esp + 0x4b8]
push edx
jmp 0x442286
push 0
push 1
push 0
push 6
lea eax, [esp + 0x4b8]
push eax
mov edi, dword [esi + 4]
call fcn.00441500
mov ecx, 0x61
lea esi, [esp + 0x4bc]
lea edi, [esp + 0x134]
rep movsd dword es:[edi], dword [esi]
add esp, 0x14
push 0x1fe
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x2ae]
push 0
push ecx
movsb byte es:[edi], byte [esi]
mov word [esp + 0x2b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100
lea edx, [esp + 0x1d4]
push edx
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.ntdll.dll_mbstowcs]
add esp, 0xc
push 0x1fe
lea ecx, [esp + 0x6ae]
push 0
push ecx
mov word [esp + 0x6b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0x6a8]
call fcn.00441ea0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jb 0x442389
lea eax, [esp + 0x2a8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x442340
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0x6b2]
push ecx
call dword [sym.imp.ntdll.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4423e2
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x8a4]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x8ac
ret
lea edx, [esp + 0x2a8]
lea ecx, [esp + 0x6a8]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4423bd
test ax, ax
je 0x4423b9
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4423bd
add ecx, 4
add edx, 4
test ax, ax
jne 0x442397
xor eax, eax
jmp 0x4423c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4423e2
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x8a4]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x8ac
ret
mov ecx, dword [esp + 0x8ac]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0046d6fd
add esp, 0x8ac
ret
Function at 0x443650
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
push 0
lea eax, [esp + 0x10]
push eax
push 0
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4436e9
call fcn.004435f0
test eax, eax
jne 0x4436e9
mov eax, 1
test byte [0x503544], al
jne 0x4436b8
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00443520
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call ecx
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 8]
push edx
push 0x200
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4436e2
test eax, eax
je 0x4436e2
test ecx, 0x1ff
jne 0x4436e2
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x443730
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push esi
push 0
mov esi, eax
mov eax, dword [esp + 0x20]
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4437d9
call fcn.004435f0
test eax, eax
jne 0x4437d9
mov eax, 1
test byte [0x503544], al
jne 0x4437a5
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00443520
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x200
push edx
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4437d2
test eax, eax
je 0x4437d2
test ecx, 0x1ff
jne 0x4437d2
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x445340
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
xor edi, edi
test ebp, ebp
jbe 0x445397
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push esi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x4453a1
cmp dword [esp + 0x18], 0
je 0x4453a1
mov dl, byte [esi]
add edi, 1
add esi, 1
cmp dl, 0xa
je 0x445397
cmp edi, ebp
jb 0x445362
mov eax, edi
pop edi
mov byte [esi], 0
pop esi
pop ebp
pop ebx
ret
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4453b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
test esi, esi
jne 0x4453c4
lea eax, [esi + 1]
pop esi
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edi
push ebp
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x445418
cmp dword [esp + 0xc], 0
je 0x445418
cmp esi, 2
mov eax, 1
jb 0x445402
cmp byte [edi + esi - 2], 0xd
jne 0x445402
cmp byte [edi + esi - 1], 0xa
je 0x445478
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x4eab14
push ebp
call ebx
pop ebx
pop esi
pop ebp
pop ecx
ret
mov eax, 1
test byte [0x503544], al
jne 0x44544c
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0xd2
mov ecx, str.d:workDDCDDCIncludeFileIO.h
add esi, 8
call fcn.00445270
mov edx, dword [esi]
push eax
push str._s:_Failed_to_WriteFile_in_WriteLine_for_CHAR.
push 0x503520
call edx
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x4455a0
Capabilities:
Manipulate boot configuration

Disassembly:
sub esp, 0x610
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, 1
test byte [0x50354c], bl
mov esi, ecx
mov dword [esi], edi
jne 0x4455da
or dword [0x50354c], ebx
mov dword [0x503548], 0x4e7844
push 0xfe
lea eax, [esp + 0x116]
push edi
push eax
mov word [esp + 0x11c], di
call sub.ntdll.dll_memset
mov edx, dword [0x503548]
mov eax, dword [edx + 0x28]
add esp, 0xc
push 0x80
lea ecx, [esp + 0x114]
push ecx
mov ecx, 0x503548
call eax
test eax, eax
jne 0x44568c
test byte [0x503544], bl
jne 0x445648
or dword [0x503544], ebx
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x56
mov ecx, str.._boot.cpp
add esi, 8
call fcn.00445270
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_IVol.GetSystemVolumeDevice_in_IsExistBootIni.
push 0x503520
call ecx
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x610
ret
push 0xfe
lea edx, [esp + 0x16]
push edi
push edx
mov word [esp + 0x1c], di
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x14]
push 0x80
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push 0x1fe
lea edx, [esp + 0x216]
push edi
push edx
mov word [esp + 0x21c], di
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1fe
lea eax, [esp + 0x416]
push edi
push eax
mov word [esp + 0x41c], di
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push str._s_boot.ini
lea edx, [esp + 0x218]
call fcn.00404df0
lea edx, [esp + 0x18]
push edx
push str._s_ntldr
lea edx, [esp + 0x420]
call fcn.00404df0
add esp, 0x10
lea eax, [esp + 0x210]
call fcn.004454e0
test eax, eax
je 0x44574c
lea eax, [esp + 0x410]
call fcn.004454e0
test eax, eax
je 0x44574c
mov dword [esi], ebx
mov ecx, dword [esp + 0x614]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x610
ret
Function at 0x446350
Capabilities:
Manipulate boot configuration

Disassembly:
sub esp, 0x434
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x430], eax
test byte [0x50354c], 1
push esi
jne 0x44637f
or dword [0x50354c], 1
mov dword [0x503548], 0x4e7844
xor esi, esi
push 0xfe
lea eax, [esp + 0x36]
push esi
push eax
mov word [esp + 0x3c], si
call sub.ntdll.dll_memset
mov edx, dword [0x503548]
mov eax, dword [edx + 0x28]
add esp, 0xc
push 0x80
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x503548
call eax
test eax, eax
jne 0x4463d2
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x434
ret 4
push 0xfe
lea ecx, [esp + 0x136]
push esi
push ecx
mov word [esp + 0x13c], si
call sub.ntdll.dll_memset
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x140]
push 0x80
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
push 0x1fe
lea ecx, [esp + 0x24e]
push esi
push ecx
mov word [esp + 0x254], si
call sub.ntdll.dll_memset
lea edx, [esp + 0x154]
push edx
push str._s_boot.ini
lea edx, [esp + 0x25c]
call fcn.00404df0
add esp, 0x2c
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [esp + 0x43c], esi
lea edx, [esp + 0x20]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov eax, 1
je 0x446483
xor eax, eax
push esi
push esi
push 0x60
push eax
push 1
push 0x80
push esi
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0xc0100000
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ntdll.dll_ZwCreateFile]
mov ecx, dword [esp + 0x434]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x434
ret 4
Function at 0x447850
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4478f4
call fcn.004477f0
test eax, eax
jne 0x4478f4
mov eax, 1
test byte [0x503544], al
jne 0x4478c3
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00447720
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x447927
test ecx, ecx
je 0x4478ed
test eax, eax
je 0x4478ed
test ecx, 0x1ff
jne 0x4478ed
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x447940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4479e7
call fcn.004477f0
test eax, eax
jne 0x4479e7
mov eax, 1
test byte [0x503544], al
jne 0x4479b3
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00447720
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x447a1a
test ecx, ecx
je 0x4479e0
test eax, eax
je 0x4479e0
test ecx, 0x1ff
jne 0x4479e0
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x4488b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor ebp, ebp
push ebp
push str.SystemMountedDevices
push 0x80000002
mov esi, ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x448952
mov eax, 1
test byte [0x503544], al
jne 0x448923
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x83
add esi, 8
call fcn.00448470
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push 0x503520
call ecx
add esp, 0xc
xor eax, eax
jmp 0x448a44
mov edi, dword [esp + 0x43c]
mov edx, dword [esp + 0x434]
mov ebx, dword [esp + 0x438]
push ebp
xor eax, eax
push 0x200
push edi
mov dword [esp + 0x21], eax
push ebx
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov dword [esp + 0x24], edx
call sub.ntdll.dll__allmul
push 0x3fe
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x26]
push ebp
push eax
mov dword [esp + 0x28], edx
mov word [esp + 0x2c], bp
call sub.ntdll.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.MSVCR80.dll__swprintf]
lea ecx, [esp + 0x24]
push str.__Volume_s
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0xc
lea edx, [esp + 0x18]
push edx
push 3
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x30]
push eax
push ecx
call ebp
test eax, eax
je 0x4489f0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x448a44
movzx eax, word [esp + 0x430]
push eax
lea ecx, [esp + 0x24]
push str.DosDevices_c:
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0xc
lea edx, [esp + 0x18]
push edx
push 3
push 0
lea eax, [esp + 0x30]
push eax
push ecx
call ebp
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x434]
push edi
push ebx
push eax
call fcn.00448a60
mov eax, esi
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x41c
ret 0x10
Function at 0x448a60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x1418
call sub.ntdll.dll__chkstk
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x1414], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.SystemMountedDevices
push 0x80000002
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x448afe
test byte [0x503544], 1
jne 0x448ad2
or dword [0x503544], 1
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0xa5
add esi, 8
call fcn.00448470
mov ecx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push 0x503520
call ecx
add esp, 0x10
xor eax, eax
jmp 0x448c34
push 0xffe
lea edx, [esp + 0x426]
push ebx
push edx
mov word [esp + 0x42c], bx
call sub.ntdll.dll_memset
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x434]
push ecx
push ebx
push edx
mov dword [esp + 0x38], 0x1000
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x448c2f
mov ebp, dword [esp + 0x1430]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x448b60
push 0x3ff
lea eax, [esp + 0x25]
push ebx
push eax
add esi, 1
mov byte [esp + 0x2c], bl
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
lea eax, [esp + 0x430]
push eax
push ecx
mov dword [esp + 0x34], 0x400
call edi
test eax, eax
jne 0x448bfb
mov edx, dword [esp + 0x142c]
cmp dword [esp + 0x20], edx
jne 0x448bfb
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push ebx
push 0x200
push eax
push ecx
call sub.ntdll.dll__alldiv
cmp eax, ebp
jne 0x448bfb
cmp edx, dword [esp + 0x1434]
jne 0x448bfb
cmp word [esp + 0x420], 0x23
jne 0x448bfb
cmp word [esp + 0x422], 0x7b
jne 0x448bfb
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x420]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x434]
push edx
push esi
push eax
mov dword [esp + 0x38], 0x1000
mov dword [esp + 0x440], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x448b60
mov eax, 1
mov ecx, dword [esp + 0x1424]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x1418
ret 0xc