joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042e13
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
jne 0x10042e27
lea ebx, [ebp + 0x10]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jl 0x10042e6a
mov eax, dword [esi + 4]
push edi
lea ecx, [ebp + 0x10]
push ecx
push 0x1000
push eax
push dword [esi]
mov dword [esi + 8], edi
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
jne 0x10042e60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x10042e6a
cmp dword [ebp + 0x10], edi
jne 0x10042e6a
dec dword [esi + 0x14]
jns 0x10042e2f
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jge 0x10042e8a
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
mov ecx, dword [esi + 4]
mov al, byte [eax + ecx]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
xor eax, eax
inc eax
mov dword [ebx], eax
jmp 0x10042e8e
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x100432f8
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x108
push esi
push edi
mov ax, word [ebp + 0x7c]
push 0x20
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints_
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x21
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov word [ebp + 0x6e], ax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x10]
push eax
mov edi, 0x80000001
push edi
call esi
lea eax, [ebp - 0x94]
push eax
push edi
call esi
pop edi
pop esi
add ebp, 0x74
leave
ret

Function at 0x100435bd
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x7405c
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call ebx
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x18
push esi
push edi
push edi
push 0x70000
push dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call ebx
cmp dword [ebp - 8], edi
je 0x1004361c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x10043639
mov eax, dword [esi + 0x14]
mul dword [esi + 0x10]
push edi
push dword [esi + 0xc]
push edx
push eax
call fcn.100b4200
push dword [esi + 4]
push dword [esi]
push edx
push eax
call fcn.100b4200
pop edi
pop ebx
leave
ret
Function at 0x100437ab
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push 0xc0
push ebx
push esi
mov dword [eax], ebx
mov edi, esi
call fcn.100b40f0
add esp, 0xc
push ebx
lea eax, [ebp + 0xc]
push eax
push 0x100000
push esi
push ebx
push ebx
push 0x70050
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1004389d
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xfff70
push esi
push ebx
push ebx
push 0x7400c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100438a7
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
lea edx, [eax - 1]
cmp edx, ebx
mov dword [ecx], eax
lea edi, [esi + 0x90]
jl 0x1004388b
lea eax, [edx + edx*8]
mov ecx, edx
shl eax, 4
shl ecx, 5
inc edx
lea eax, [eax + edi + 0x40]
lea ecx, [ecx + esi + 0x10]
mov dword [ebp - 4], edx
mov edx, dword [ecx - 8]
mov dword [eax - 8], edx
mov edx, dword [ecx - 4]
mov dword [eax - 4], edx
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov dl, byte [ecx + 0x13]
mov byte [eax + 0xc], dl
mov dword [eax - 0x10], ebx
mov dl, byte [ecx + 0x11]
mov byte [eax + 0x11], dl
mov edx, dword [ecx + 8]
mov dword [eax + 0x14], edx
mov dl, byte [ecx + 0x10]
mov byte [eax + 0x10], dl
mov dl, byte [ecx + 0x12]
mov byte [eax + 0x12], dl
sub ecx, 0x20
sub eax, 0x90
dec dword [ebp - 4]
jne 0x10043841
mov eax, dword [esi + 4]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], ebx
mov eax, dword [eax]
mov dword [edi + 4], eax
jmp 0x100438a5
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10043d11
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
push edi
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x318], esi
mov ecx, 0xc3
lea edi, [ebp - 0x314]
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edi, edi
inc edi
test eax, eax
jne 0x10043d58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [ebp - 4], edi
je 0x10043d5b
mov dword [ebp - 4], esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 0x2200000
push 3
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10043d88
xor eax, eax
jmp 0x10043e10
push dword [ebp + 0xc]
mov dword [ebp - 0x318], 0xa0000003
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0xc]
shl eax, 1
mov word [ebp - 0x30e], ax
mov eax, dword [ebp - 0x30e]
add eax, 2
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x308]
push eax
call fcn.100b6645
movzx eax, word [ebp - 0x30e]
pop ecx
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push esi
add eax, 0xc
push esi
mov dword [ebp - 0x314], eax
add eax, 8
push eax
lea eax, [ebp - 0x318]
push eax
push 0x900a4
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10043e07
cmp dword [ebp - 4], esi
jne 0x10043e05
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043ecb
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10043f28
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
push esi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [esp + 0x10]
push eax
call fcn.100144ff
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x10043f29
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 2
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
jle 0x10043f50
push dword [ebp + 0x10]
push edi
push esi
call fcn.1000f6d2
add esp, 0xc
test al, al
je 0x10043f50
mov eax, dword [ebp + 0x10]
jmp 0x10043f6f
mov ax, word [esi]
cmp ax, word [edi]
jne 0x10043f6d
mov ax, word [edi + 2]
cmp word [esi + 2], ax
jne 0x10043f6d
cmp ax, 0x3a
jne 0x10043f6d
push 2
pop eax
jmp 0x10043f6f
xor eax, eax
push 0
lea eax, [esi + eax*2]
push eax
push edi
call fcn.10043e15
add esp, 0xc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
pop esi
pop ebp
ret
Function at 0x10043fcb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x40
mov esi, ecx
push 0xc
push dword [esi]
lea edi, [esi + 4]
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x12
push edi
call ebx
push 0x12
push 0x100cdbb4
push edi
call fcn.100144ff
mov ecx, dword [ebp + 8]
lea eax, [edi + 0xe]
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov esi, dword [esi + 0x18]
add esp, 0xc
test esi, esi
je 0x1004402f
push edi
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1004402f
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100446f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push edi
mov dword [ebp + 0x10], 0x80
mov edi, ebx
test ebx, ebx
ja 0x10044721
xor eax, eax
cmp eax, dword [esi]
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret
and dword [ebp + 0x14], 0
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10044758
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1004474f
cmp dword [ebp + 0x10], eax
jg 0x1004474c
mov eax, edi
jmp 0x1004474f
dec dword [ebp + 0x10]
add dword [esi], eax
add dword [ebp + 0xc], eax
sub ebx, eax
jmp 0x10044710
and dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x10044714
mov eax, dword [ebp + 0x18]
cmp edi, eax
jbe 0x10044714
cmp ebx, eax
jbe 0x1004470e
lea edi, [edi + eax - 1]
shr edi, 1
cmp edi, eax
jbe 0x10044710
and edi, 0xfffffe00
jmp 0x10044710

Function at 0x100448e6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and dword [0x100e34d0], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test byte [ebp - 0xef], 0x80
je 0x10044913
or dword [0x100e34d0], 2
test byte [ebp - 0xf0], 0x80
je 0x10044923
or dword [0x100e34d0], 4
test byte [ebp - 0xee], 0x80
je 0x10044933
or dword [0x100e34d0], 1
test byte [ebp - 0xa5], 0x80
je 0x10044943
or dword [0x100e34d0], 8
test byte [ebp - 0xa4], 0x80
je 0x10044953
or dword [0x100e34d0], 8
leave
ret
Function at 0x100454f4
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esi
jne 0x1004552f
cmp dword [ebp + 0xc], 2
jb 0x10045544
cmp dword [ebp + 0xc], 3
jbe 0x10045528
cmp dword [ebp + 0xc], 5
jne 0x10045544
mov dword [ebp - 4], 0x100c8068
jmp 0x1004552f
mov dword [ebp - 4], 0x100c8078
push 0x12
push esi
push esi
push dword [ebp - 4]
call dword [0x100e2f80]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1004554b
xor eax, eax
jmp 0x1004568b
push edi
push 0x1c
pop ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
lea eax, [ebp - 0x34]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push esi
push dword [ebp - 8]
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x5c], ecx
call edi
test eax, eax
je 0x1004567e
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call edi
push esi
lea eax, [ebp + 0x10]
push eax
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x10], esi
call ebx
cmp dword [ebp + 0x10], esi
je 0x10045651
cmp dword [ebp + 0x10], 0x400
ja 0x10045651
push 0x1c
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x478], 6
call fcn.100b40f0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x78], 0x1c
call ebx
test eax, eax
je 0x10045651
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x10045651
push esi
lea ecx, [ebp - 0x18]
push ecx
push 0xc
lea ecx, [ebp - 0x40]
push ecx
push esi
push esi
push 0x2d1080
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10045648
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x3c]
je 0x1004566e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call edi
test eax, eax
jne 0x1004558b
jmp 0x1004567d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x14], eax
pop ebx
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
leave
ret

Function at 0x10045812
Capabilities:
Set environment variable

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
call fcn.100457c2
push dword [esp + 0xc]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
ret 8
Function at 0x100469ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0x7a
push edi
jbe 0x10046a88
cmp word [esi + 2], 0x3a
jne 0x10046a88
cmp word [esi + 4], 0
jne 0x10046a88
mov eax, dword [ebp + 0x14]
and word [ebp - 0x20c], 0
test eax, eax
je 0x10046a0a
and dword [eax], 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ax, word [esi]
cmp ax, word [ebp - 0x20c]
jne 0x10046a61
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
cmp edi, 4
jbe 0x10046a61
cmp dword [ebp + 0xc], edi
jae 0x10046a46
mov eax, edi
jmp 0x10046a98
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
call fcn.100144ff
add esp, 0xc
lea eax, [edi - 1]
jmp 0x10046a98
push 4
pop eax
cmp dword [ebp + 0xc], eax
jb 0x10046a98
mov eax, dword [ebp + 0x10]
mov cx, word [esi]
and word [eax + 6], 0
push 3
mov word [eax], cx
mov word [eax + 2], 0x3a
mov word [eax + 4], 0x5c
pop eax
jmp 0x10046a98
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
pop edi
pop esi
leave
ret
Function at 0x100480aa
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp edx, esi
push edi
mov dword [ebp - 4], esi
jne 0x100480fe
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
jne 0x100480dc
xor eax, eax
cmp eax, esi
mov dword [ebp - 4], eax
mov edx, eax
jne 0x100480fe
push esi
push esi
push 3
push esi
push 3
push esi
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
jne 0x100480f9
xor eax, eax
mov dword [ebp - 4], eax
mov edx, eax
cmp edx, 0xffffffff
je 0x10048148
cmp edx, esi
je 0x10048148
push 9
pop ecx
xor eax, eax
push 0x28
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
pop eax
push esi
lea ecx, [ebp + 0xc]
push ecx
push eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [ebp - 0x1c]
jmp 0x1004814b
or esi, 0xffffffff
lea ecx, [ebp - 4]
call fcn.10002d56
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10049b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.10005b9d
cmp dword [ebp - 8], ebx
je 0x10049b45
push dword [ebp - 8]
call fcn.100a0afd
mov edi, edx
cmp edi, ebx
pop ecx
mov esi, eax
jg 0x10049b49
jl 0x10049b45
cmp esi, ebx
jae 0x10049b49
xor esi, esi
xor edi, edi
lea ecx, [ebp - 4]
call fcn.10045faf
cmp edi, ebx
jl 0x10049b93
jg 0x10049b5b
cmp esi, ebx
jbe 0x10049b93
lea eax, [esi + 5]
push eax
lea ecx, [ebp - 4]
call fcn.10045ff1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp eax, edi
jl 0x10049b8d
jg 0x10049b8b
cmp ecx, esi
jbe 0x10049b8d
mov ecx, esi
mov eax, dword [ebp - 4]
mov byte [ecx + eax], bl
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 4]
call fcn.100461de
lea ecx, [ebp - 4]
call fcn.1003f96c
lea ecx, [ebp - 8]
call fcn.10002d56
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10049f3d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
and eax, 1
mov dword [ebp - 4], eax
call fcn.100a0afd
mov ebx, eax
test ebx, ebx
pop ecx
jg 0x10049f63
xor eax, eax
jmp 0x1004a0ed
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebx + 0xc]
push eax
mov ecx, edi
call fcn.10046168
mov esi, dword [edi]
or dword [ebp - 8], 0xffffffff
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [ebp - 8]
test ebx, ebx
jle 0x1004a0e9
test eax, eax
je 0x1004a0e9
push 0xa
lea eax, [ebx + esi]
push 0
push eax
call fcn.100b40f0
lea eax, [ebx + 0xa]
add esp, 0xc
mov dword [ebp + 0x10], eax
push 2
push 0x100cd4c4
push esi
call fcn.1003fa82
add esp, 0xc
test eax, eax
jne 0x10049fd0
push ebx
push esi
call fcn.10044137
pop ecx
pop ecx
push 2
push 0x100cd4c0
push esi
call fcn.1003fa82
add esp, 0xc
neg eax
sbb eax, eax
inc eax
cmp byte [esi], 0
je 0x1004a00e
cmp byte [esi + 1], 0
jne 0x1004a00e
push dword [ebp + 0x10]
lea eax, [esi + 2]
push esi
push eax
call fcn.100144b5
add dword [ebp + 0x10], 2
add esp, 0xc
inc ebx
xor eax, eax
inc ebx
mov word [esi], 0xfeff
inc eax
test eax, eax
jne 0x1004a03b
cmp byte [esi], al
jne 0x1004a044
cmp byte [esi + 1], al
je 0x1004a044
push dword [ebp + 0x10]
lea eax, [esi + 2]
push esi
push eax
call fcn.100144b5
add esp, 0xc
inc ebx
inc ebx
add dword [ebp + 0x10], 2
mov word [esi], 0xfffe
jmp 0x10049fb3
mov eax, ebx
shr eax, 1
jmp 0x1004a0eb
mov eax, dword [edi]
and dword [edi], 0
push ebx
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.10046168
mov eax, dword [edi]
mov cx, word [0x100cd4c0]
push 3
mov word [eax], cx
pop eax
push eax
push 0x100cd4c8
push esi
mov dword [ebp + 0x10], eax
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x1004a080
cmp dword [ebp - 4], eax
je 0x1004a0af
jmp 0x1004a083
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + 1]
push ecx
mov ecx, dword [edi]
inc ecx
inc ecx
push ecx
mov ecx, ebx
sub ecx, eax
push ecx
add eax, esi
push eax
push 8
push 0xfde9
call dword [0x100e2be4]
cmp dword [ebp - 4], 0
je 0x1004a0e2
test eax, eax
jg 0x1004a0e6
or dword [ebp - 4], 2
lea eax, [ebx + 1]
push eax
mov eax, dword [edi]
inc eax
inc eax
push eax
push ebx
push esi
push 8
push 0
call dword [0x100e2be4]
and dword [ebp + 0x10], 0
test eax, eax
jg 0x1004a0e6
cmp dword [ebp - 4], 0
je 0x1004a080
xor eax, eax
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.1003f96c
mov eax, esi
jmp 0x1004a0eb
test eax, eax
jle 0x1004a0d2
inc eax
jmp 0x1004a0d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004a3f6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov byte [ebp - 0x28], bl
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.10005b9d
cmp dword [ebp - 4], ebx
je 0x1004a44a
push ebx
lea eax, [ebp - 8]
push eax
push 0x20
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call fcn.10042f62
add esp, 0xc
mov bl, al
lea ecx, [ebp - 4]
call fcn.10002d56
mov al, bl
pop ebx
leave
ret

Function at 0x1004a913
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
movzx eax, word [0x100e2c20]
or eax, 0x20019
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov esi, dword [ebp + 0x18]
jne 0x1004a9be
mov edi, dword [ebp + 0x14]
push 0x1000
mov ecx, edi
mov dword [esi], 0xffa
call fcn.10045ff1
mov eax, dword [edi]
mov byte [eax], bl
mov eax, dword [edi]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call ebx
cmp eax, 0xea
mov dword [ebp - 8], eax
jne 0x1004a9a9
add dword [esi], 0xa
mov eax, dword [esi]
add eax, 6
push eax
mov ecx, edi
call fcn.10045ff1
mov eax, dword [edi]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
cmp dword [ebp - 8], 0
je 0x1004a9cf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x1c]
and dword [esi], 0
test ecx, ecx
je 0x1004a9ca
mov dword [ecx], eax
lea eax, [ebx - 1]
jmp 0x1004aa00
xor ecx, ecx
cmp dword [esi], ecx
jge 0x1004a9d7
mov dword [esi], ecx
mov eax, dword [edi]
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, dword [esi]
mov edx, dword [edi]
inc eax
shr eax, 1
lea eax, [edx + eax*2]
mov word [eax + 2], cx
mov word [eax], cx
mov eax, dword [esi]
add eax, 5
push eax
mov ecx, edi
call fcn.10045ff1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004ac2d
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
or ebx, 0xffffffff
cmp esi, edi
mov dword [ebp - 4], edi
je 0x1004ac4d
mov dword [esi], ebx
mov dword [esi + 4], ebx
push edi
push 0x20000000
push 3
push edi
push 3
push 0x100080
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.10005b9d
cmp dword [ebp - 4], edi
je 0x1004acb5
push edi
lea eax, [ebp - 0x1a0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x2d1080
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1a0], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004acb5
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x1004aca4
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp esi, edi
mov eax, dword [ebp - 0xc]
je 0x1004acb3
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ebx, eax
lea ecx, [ebp - 4]
call fcn.10002d56
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret