joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x79d5c4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d5ca
pop ebp
sub ebp, 6
sub ebp, 0x39d5c4
jmp 0x79d628
jmp 0x79d631
mov eax, 0x39d5c4
add eax, ebp
add eax, 0x93
mov ecx, 0x617
mov edx, 0x4402173e
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d648
jmp 0x79d65b
push esp
jle 0x79d6b4
push esi
adc bh, byte ds:[esi]
or eax, 0xabc16efe
cli
sahf
push cs
outsb dx, byte ds:[esi]
mov ch, 0xf3
mov ch, 0xb7
add bh, byte [esi]
mov edi, 0x3e3ec6ff
cmp eax, 0x3e3a86f3
test byte ds:[esi], dl
leave
fdivr qword [0x32bfb5f6]
cmp eax, 0x79566efb
or eax, 0x45563e37
pushfd
push cs
aas
adc bl, byte [edx]
push esi
salc
cmp edi, dword [esi]
xlatb
adc al, 0x3e
imul esi, dword ds:[ebx - 0x4ac1e5ae], 0xffffffbb
imul esi, dword [ebx - 0x4ac1e5ae], 0xffffffbb
mov ch, 0xab
xor bh, byte [esi]
mov ch, 0xb3
notrack call edi
cmp al, 0xf
cmp al, 0xbd
cld
cmp dh, byte [edi + 0x31]
mov ebx, 0xc1c1c1ca
arpl sp, di
xor bh, byte [esi]
mov ch, 0xb2
sbb bh, byte [edx]
push esi
jns 0x79d6f5
aaa
push esi
inc ebp
pushfd
push cs
aas
adc bl, byte [edx]
outsd dx, dword [esi]
salc
cmp edi, dword [esi]
xlatb
xlatb
or eax, 0x6b3e3e3c
mov ch, 0xd2
ror dword [ebx + 0x32], 0xc1
dec ebx
salc
pop eax
mov ch, 0x83
or eax, 0xbdec0df7
salc
cmp esi, dword [esi + 0x31]
mov edx, 0x3e3e3e70
xor dword [esi + 0x3e3e3e76], esi
pop eax
mov ch, 0x22
pop es
mov esi, 0xba31d6c5
and al, 0x3e
mov esi, 0xba31d7c5
das
pop eax
mov edi, 0x311bc1c5
mov edx, 0x3e3e3e2b
jg 0x79d71f
rol ecx, 0xc1
pop ss
jb 0x79d756
aas
mov ebp, 0xd6bd3bff
cmp dl, bh
xlatb
add ecx, 0xffffffc1
rcl dword [edi], 0x6a
pop es
cmp al, 0xbd
invalid
Function at 0xa4180
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x288
push 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0x288
call fcn.001591ee
mov ebx, eax
add esp, 8
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0xa41e7
push str.out_of_memory
push 0x17bec4
push 0x27e
push str.fr_subject_localhost_address
push str.fr_subject.c
call fcn.000c0810
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 8]
push eax
push ebx
call esi
cmp eax, 0x6f
jne 0xa4254
push ebx
call fcn.00158d47
add esp, 4
push dword [ebp - 8]
push 1
call fcn.001591ee
mov ebx, eax
add esp, 8
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0xa4238
push str.out_of_memory
push 0x17bec4
push 0x288
push str.fr_subject_localhost_address
push str.fr_subject.c
call fcn.000c0810
jmp 0xa4276
lea eax, [ebp - 8]
push eax
push ebx
call esi
test eax, eax
je 0xa427f
push str.failed_to_get_adapter_information
push 0x17bec4
push 0x28a
jmp 0xa4267
test eax, eax
je 0xa427f
push str.failed_to_get_adapter_information
push 0x17bec4
push 0x28d
push str.fr_subject_localhost_address
push str.fr_subject.c
call fcn.000c08e0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0xa42f8
mov esi, 1
mov edi, ebx
test ebx, ebx
je 0xa4305
mov ebx, dword [ebp - 0x10]
nop dword [eax]
test esi, esi
je 0xa42f5
cmp dword [edi + 0x1a0], 6
jne 0xa42ef
lea edx, [edi + 0x1b0]
test edx, edx
je 0xa42ef
mov eax, edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa42b0
sub eax, esi
mov ecx, ebx
push eax
call fcn.000c0f20
add esp, 4
test eax, eax
je 0xa42ed
push str.out_of_memory
push 0x17bec4
push 0x29a
push str.fr_subject_localhost_address
push str.fr_subject.c
call fcn.000c0810
add esp, 0x14
mov esi, eax
jmp 0xa42ef
xor esi, esi
mov edi, dword [edi]
test edi, edi
jne 0xa4290
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0xa4305
push ebx
call fcn.00158d47
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xa5160
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov esi, edx
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0xa51a5
push edi
push dword [esi + 4]
push dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp dword [esi + 4], eax
je 0xa51a5
push str.failed_to_send_broadcast_datagram
push 0x17bec4
push 0x4dd
push str.fr_beacon_broadcast_send
push str.fr_subject.c
call fcn.000c08e0
add esp, 0x14
mov edi, eax
mov edx, esi
mov ecx, ebx
call fcn.000a54c0
test edi, edi
je 0xa51bf
test eax, eax
je 0xa51bf
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0xa51d0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x1a700c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xc], 1
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x10
push eax
push 0
mov edi, ecx
xorps xmm0, xmm0
push 2
push str.255.255.255.255
movaps xmmword [esp + 0x24], xmm0
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStringToAddressA]
test eax, eax
je 0xa5234
push str.failed_to_set_broadcast_address
push 0x17bec4
push 0x4a4
jmp 0xa5270
mov eax, 2
push 0x1632
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0xa5293
push str.failed_to_create_broadcast_UDP_socket
push 0x17bec4
push 0x4ac
push str.fr_beacon_broadcast_init
push str.fr_subject.c
call fcn.000c08e0
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x20
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0xa52bd
push str.failed_to_enable_broadcasting
push 0x17bec4
push 0x4b1
jmp 0xa52df
push 0x10
lea eax, [esp + 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0xa5318
push str.failed_to_connect_to_broadcast_address
push 0x17bec4
push 0x4b7
push str.fr_beacon_broadcast_init
push str.fr_subject.c
call fcn.000c08e0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa5305
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xa5330
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1a700c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xc], 1
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
push eax
push 0
mov esi, ecx
mov dword [esp + 0x14], 0x1c
xorps xmm0, xmm0
push 0x17
push str.ff02::1
mov dword [esi + 4], 0xffffffff
movaps xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.WS2_32.dll_WSAStringToAddressA]
test eax, eax
je 0xa53a3
push str.failed_to_set_multicast_address
push 0x17bec4
push 0x4ff
jmp 0xa53e2
mov eax, 0x17
push 0x1632
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
push 0x17
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov dword [esi + 4], ecx
cmp ecx, 0xffffffff
jne 0xa5405
push str.failed_to_create_multicast_UDP_socket
push 0x17bec4
push 0x507
push str.fr_beacon_multicast_init
push str.fr_subject.c
call fcn.000c08e0
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x28]
push 4
movups xmmword [esi + 8], xmm0
movq xmm0, qword [esp + 0x24]
movq qword [esi + 0x18], xmm0
mov dword [esi + 0x20], eax
lea eax, [esp + 0x10]
push eax
push 0xb
push 0x29
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0xa5456
push str.failed_to_enable_multicast_on_loopback
push 0x17bec4
push 0x50e
push str.fr_beacon_multicast_init
push str.fr_subject.c
call fcn.000c08e0
jmp 0xa547f
mov ecx, esi
call fcn.000a5570
test eax, eax
je 0xa54ab
push str.failed_to_get_network_interface_list
push 0x17bec4
push 0x510
push str.fr_beacon_multicast_init
push str.fr_subject.c
call fcn.000c0810
mov edi, eax
add esp, 0x14
test edi, edi
je 0xa5498
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xa54c0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ecx, ecx
push edi
mov dword [ebp - 8], ecx
cmp dword [esi + 4], 0xffffffff
jne 0xa54e2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x24]
mov ebx, dword [eax]
mov edi, dword [eax + 8]
shr ebx, 2
test ebx, ebx
jle 0xa5560
push 4
push edi
push 9
push 0x29
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0xa5526
push 0x1c
lea eax, [esi + 8]
push eax
mov eax, dword [ebp - 4]
push 0
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_sendto]
mov edx, dword [ebp - 4]
cmp dword [edx + 4], eax
je 0xa5555
push str.failed_to_send_multicast_datagram
push 0x17bec4
push 0x555
push str.fr_beacon_multicast_send
push str.fr_subject.c
call fcn.000c08e0
add esp, 0x14
mov ecx, esi
call fcn.000a5570
mov ecx, eax
mov dword [ebp - 8], ecx
jmp 0xa5558
mov ecx, dword [ebp - 8]
add edi, 4
sub ebx, 1
jne 0xa54f1
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa70a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x108]
mov ebx, ecx
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0xa7100
push str.failed_to_get_subjects_host_name
push 0x17bec4
push 0x9f8
push str.fr_subject_get_hostname
push str.fr_subject.c
call fcn.000c0810
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x108]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0xa7110
xor edi, edi
sub esi, ecx
je 0xa713d
nop dword [eax]
movsx eax, byte [ebp + edi - 0x108]
push eax
call fcn.001599da
mov byte [ebp + edi - 0x108], al
add esp, 4
inc edi
cmp edi, esi
jb 0xa7120
lea edx, [ebp - 0x108]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0xa7146
sub edx, esi
lea eax, [ebp - 0x108]
push edx
push eax
mov edx, str.hostname
mov ecx, ebx
call fcn.000b4c70
add esp, 8
test eax, eax
je 0xa717e
push str.failed_to_set_subjects_host_name
push 0x17bec4
push 0x9ff
jmp 0xa70dd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xa7430
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 0x104
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.001591ee
mov esi, eax
add esp, 8
test esi, esi
je 0xa7532
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0xa7515
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0xa7515
push 1
push ebx
call fcn.001591ee
mov edi, eax
add esp, 8
test edi, edi
je 0xa7515
push edi
push ebx
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0xa750c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x17d388
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0xa750c
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._lu._lu._lu._lu
push 0x104
push esi
call fcn.000a3960
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
mov edx, esi
push eax
call fcn.000c0f20
add esp, 4
mov dword [ebp - 0x10], eax
push edi
call fcn.00158d47
add esp, 4
push esi
call fcn.00158d47
mov eax, dword [ebp - 0x10]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xab160
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, edx
push edi
test ebx, ebx
je 0xab1e9
cmp dword [ebx], 0
jne 0xab1e9
test esi, esi
je 0xab1e9
push 0x14
push 1
call fcn.001591ee
mov edi, eax
add esp, 8
mov dword [ebp - 4], edi
test edi, edi
je 0xab1e9
lea ecx, [edi + 4]
call fcn.000c15b0
test eax, eax
jne 0xab1e9
lea ecx, [edi + 8]
call fcn.000c1510
test eax, eax
jne 0xab1e9
push 1
push eax
push eax
push 0xffffffffffffffff
mov dword [edi + 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi], eax
test eax, eax
je 0xab1e9
mov esi, dword [edi + 8]
push 0
push 0
push edi
push 0xab0e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0xab1e9
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
call fcn.000ab210
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xab3a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
xor edx, edx
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, dword [eax + 8]
inc esi
push edi
mov eax, esi
xor edi, edi
add eax, 1
push 1
setb dl
neg edx
or edx, eax
push edx
call fcn.001591ee
mov ebx, eax
add esp, 8
test ebx, ebx
je 0xab461
mov eax, dword [ebp - 4]
push dword [eax + 4]
lea eax, [esi + 1]
push 0x17e740
push eax
push ebx
call fcn.000a3960
add esp, 0x10
cmp esi, eax
jne 0xab461
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
js 0xab45a
cmp eax, 3
jle 0xab406
cmp eax, 6
jne 0xab45a
cmp eax, 2
jne 0xab485
mov ecx, str..A:_
mov edx, ebx
sub esi, 4
jb 0xab428
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0xab42d
add ecx, 4
add edx, 4
sub esi, 4
jae 0xab417
cmp esi, 0xfffffffc
je 0xab45a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0xab485
cmp esi, 0xfffffffd
je 0xab45a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0xab485
cmp esi, 0xfffffffe
je 0xab45a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0xab485
cmp esi, 0xffffffff
je 0xab45a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0xab485
mov edi, 1
jmp 0xab485
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.failed_to_concatenate_device_path__s_and_
push 0x265
push str.fr_device_filter_by_type
push str.fr_device.c
call fcn.000c0810
add esp, 0x14
mov edi, eax
test ebx, ebx
je 0xab492
push ebx
call fcn.00158d47
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xab610
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 3
je 0xab6d8
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 8]
push 0
push eax
push 8
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
push 0
push 0
xorps xmm0, xmm0
push 0x7405c
push dword [esi + 0x40]
movq qword [ebp - 0x10], xmm0
movups xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call edi
test eax, eax
je 0xab721
push 0
lea eax, [ebp - 8]
push eax
push 0x18
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x70000
push dword [esi + 0x40]
call edi
test eax, eax
je 0xab721
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0xab721
mov edx, dword [ebp - 0xc]
test edx, edx
jl 0xab721
mov edi, dword [ebp - 0x10]
jg 0xab6ac
test edi, edi
je 0xab721
push 0
push ecx
push edx
push edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], ecx
call fcn.00171f70
mov dword [esi + 0x58], eax
xor eax, eax
mov dword [esi + 0x5c], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x58]
lea ecx, [esi + 0x50]
call fcn.000b3070
test eax, eax
jne 0xab721
mov eax, dword [esi + 0x50]
test eax, eax
je 0xab721
mov edx, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
test edx, edx
jb 0xab721
ja 0xab6fe
test ecx, ecx
je 0xab721
push edx
push ecx
push 0
push eax
call fcn.00171bf0
mov dword [esi + 0x48], eax
xor eax, eax
mov dword [esi + 0x4c], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xabc40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 0xc], eax
mov edx, ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
push edi
mov eax, dword [esi + 0x14]
mov edi, dword [edx + 0x50]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 8]
add eax, dword [esi + 0x30]
cmp dword [ebp + 0xc], 0
ja 0xabc8a
jb 0xabc88
cmp ebx, edi
jae 0xabc8a
mov edi, ebx
push 0
add eax, ecx
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push dword [edx + 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0xabce1
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
push dword [eax + 0x38]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push str.failed_to_read_on_offset__llu_and_length__llu_for_device__s_on__s
push 0x543
push str.fr_device_read_memory_sync
push str.fr_device.c
call fcn.000c08e0
add esp, 0x28
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
cmp eax, edi
je 0xabd1f
push edi
push 0
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push str.failed_on_a_partial_read_on_offset__llu_and_length__lluof__llu_bytes
push 0x546
push str.fr_device_read_memory_sync
push str.fr_device.c
call fcn.000c0810
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
add dword [esi + 0x48], eax
mov ecx, dword [ebp - 4]
adc dword [esi + 0x4c], 0
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xabf80
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, edx
push edi
push esi
push 0
mov eax, dword [esi + 0x14]
mov edi, ecx
push dword [esi + 0x40]
mov eax, dword [eax + 8]
add eax, dword [esi + 0x30]
push eax
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0xabfe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0xabfe3
push dword [edi + 4]
push dword [edi + 0x38]
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi + 0x3c]
push dword [esi + 0x38]
push str.failed_to_read_on_offset__llu_and_length__llu_for_device__s_on__s
push 0x5af
push str.fr_device_read_device_async
push str.fr_device.c
call fcn.000c08e0
add esp, 0x28
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0xabff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, edx
mov dword [ebp - 8], 0
push 0
mov edi, ecx
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0xac05e
push dword [edi + 4]
push dword [edi + 0x38]
push dword [esi + 0x3c]
push dword [esi + 0x38]
push str.failed_to_set_device_offset_to__llu_on_device__s_on__s
push 0x5c0
push str.fr_device_read_device_sync
push str.fr_device.c
call fcn.000c08e0
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14]
lea ecx, [ebp - 8]
mov ebx, dword [esi + 0x40]
push 0
push ecx
mov eax, dword [eax + 8]
add eax, dword [esi + 0x30]
push ebx
push eax
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0xac0be
push dword [edi + 4]
push dword [edi + 0x38]
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi + 0x3c]
push dword [esi + 0x38]
push str.failed_to_read_on_offset__llu_and_length__llu_for_device__s_on__s
push 0x5c7
push str.fr_device_read_device_sync
push str.fr_device.c
call fcn.000c08e0
add esp, 0x28
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0xac0f6
push ebx
push 0
push eax
push str.failed_on_a_partial_read_at__lluof__llu_bytes
push 0x5cb
push str.fr_device_read_device_sync
push str.fr_device.c
call fcn.000c0810
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret