joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42be30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
lea eax, [esp + 4]
push eax
push 0x4e87f8
xor esi, esi
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42beb7
push 0x7fe
lea ecx, [esp + 0x16]
push esi
push ecx
mov word [esp + 0x1c], si
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push str.SystemStartOptions
push edx
mov dword [esp + 0x20], 0x400
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42becf
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x810
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.ntdll.dll__wcslwr]
mov esi, dword [sym.imp.ntdll.dll_wcsstr]
lea eax, [esp + 0x14]
push str.winpe
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x42bf11
lea ecx, [esp + 0x10]
push str..wim
push ecx
call esi
add esp, 8
test eax, eax
je 0x42beb7
mov ecx, dword [esp + 0x810]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0046d6fd
add esp, 0x810
ret

Function at 0x42c060
Capabilities:
Install driver

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
xor eax, eax
push esi
push edi
mov word [esp + 8], 0
mov dword [esp + 0xa], eax
mov word [esp + 0xe], ax
call fcn.0042cc20
test eax, eax
je 0x42c092
push str.RegistryMachineSystemCurrentControlSetServices_ampa
lea eax, [esp + 0xc]
push eax
jmp 0x42c09c
push str.RegistryMachineSystemCurrentControlSetServicesddcdrv
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call fcn.0042bdd0
test eax, eax
jge 0x42c10f
mov eax, 1
test byte [0x503544], al
jne 0x42c0df
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0xcd
add esi, 8
call fcn.0042bd00
mov edx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_EnablePrivilege_SE_LOAD_DRIVER_PRIVILEGE__in_LoadDrive.
push 0x503520
call edx
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_NtLoadDriver
cmp eax, 0xc000010e
je 0x42c153
test eax, eax
jge 0x42c153
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0xd9
add esi, 8
call fcn.0042bd00
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_NtLoadDriver.
push edi
call ecx
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42cc20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x404
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x400], eax
push 0x3fe
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp]
push 0x5c
push edx
call dword [sym.imp.ntdll.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x42ccc6
push esi
push edi
lea edi, [esp + 8]
mov word [eax], 0
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42cc82
lea eax, [esp + 8]
mov ecx, 8
mov esi, 0x475dd0
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x404
ret
mov ecx, dword [esp + 0x400]
xor ecx, esp
xor eax, eax
call fcn.0046d6fd
add esp, 0x404
ret

Function at 0x42cd40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42cde4
call fcn.0042cce0
test eax, eax
jne 0x42cde4
mov eax, 1
test byte [0x503544], al
jne 0x42cdb3
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.0042cb50
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x42ce17
test ecx, ecx
je 0x42cddd
test eax, eax
je 0x42cddd
test ecx, 0x1ff
jne 0x42cddd
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x42ce30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push esi
push 0
mov esi, eax
mov eax, dword [esp + 0x20]
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42ced9
call fcn.0042cce0
test eax, eax
jne 0x42ced9
mov eax, 1
test byte [0x503544], al
jne 0x42cea5
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.0042cb50
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x200
push edx
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42ced2
test eax, eax
je 0x42ced2
test ecx, 0x1ff
jne 0x42ced2
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x42e8a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42e944
call fcn.0042e840
test eax, eax
jne 0x42e944
mov eax, 1
test byte [0x503544], al
jne 0x42e913
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.0042e770
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x42e977
test ecx, ecx
je 0x42e93d
test eax, eax
je 0x42e93d
test ecx, 0x1ff
jne 0x42e93d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x42e990
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42ea37
call fcn.0042e840
test eax, eax
jne 0x42ea37
mov eax, 1
test byte [0x503544], al
jne 0x42ea03
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.0042e770
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x42ea6a
test ecx, ecx
je 0x42ea30
test eax, eax
je 0x42ea30
test ecx, 0x1ff
jne 0x42ea30
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x430f30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430fd4
call fcn.00430ed0
test eax, eax
jne 0x430fd4
mov eax, 1
test byte [0x503544], al
jne 0x430fa3
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00430e00
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x431007
test ecx, ecx
je 0x430fcd
test eax, eax
je 0x430fcd
test ecx, 0x1ff
jne 0x430fcd
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x431020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4310c7
call fcn.00430ed0
test eax, eax
jne 0x4310c7
mov eax, 1
test byte [0x503544], al
jne 0x431093
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00430e00
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4310fa
test ecx, ecx
je 0x4310c0
test eax, eax
je 0x4310c0
test ecx, 0x1ff
jne 0x4310c0
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x4326f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x432794
call fcn.00432690
test eax, eax
jne 0x432794
mov eax, 1
test byte [0x503544], al
jne 0x432763
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.004325c0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4327c7
test ecx, ecx
je 0x43278d
test eax, eax
je 0x43278d
test ecx, 0x1ff
jne 0x43278d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x4327e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x432887
call fcn.00432690
test eax, eax
jne 0x432887
mov eax, 1
test byte [0x503544], al
jne 0x432853
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.004325c0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4328ba
test ecx, ecx
je 0x432880
test eax, eax
je 0x432880
test ecx, 0x1ff
jne 0x432880
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x4345a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x434644
call fcn.00434540
test eax, eax
jne 0x434644
mov eax, 1
test byte [0x503544], al
jne 0x434613
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00434470
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x434677
test ecx, ecx
je 0x43463d
test eax, eax
je 0x43463d
test ecx, 0x1ff
jne 0x43463d
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x439f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
push ebx
push edi
lea edx, [esp + 8]
xor ebx, ebx
push edx
mov dword [esp + 0xc], ebx
call eax
mov edi, eax
cmp edi, ebx
je 0x43a07d
push 0x3fe
lea ecx, [esp + 0x16]
push ebx
push ecx
mov word [esp + 0x1c], bx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x400
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_wcsrchr]
add esp, 8
cmp eax, ebx
je 0x43a07d
push esi
push 0x3fe
lea ecx, [esp + 0x41a]
push ebx
mov word [eax], bx
push ecx
mov word [esp + 0x420], bx
call sub.ntdll.dll_memset
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x424]
push str._sLdmData.dmp
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x18
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43a07c
mov eax, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x14]
push edx
push eax
push edi
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 0x810]
pop edi
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x80c
ret

Function at 0x43b7a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x470cdc
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], vtable.COperation.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x51c], ecx
mov dword [eax + 0x520], ecx
mov dword [eax + 0x524], ecx
mov dword [eax + 0x528], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x43da20
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43daa8
mov eax, 1
test byte [0x503544], al
jne 0x43da7e
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x3ef
add esi, 8
call fcn.0043b6d0
mov ecx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push 0x503520
call ecx
add esp, 0x10
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push str.SystemPartition
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
sbb esi, esi
push eax
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x43f8e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x43f934
mov eax, dword [esp + 8]
test eax, eax
je 0x43f91a
cmp eax, 1
jne 0x43f934
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.0046d6fd
add esp, 0x118
ret

Function at 0x43f9e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
push edi
xor edi, edi
cmp cx, di
mov esi, edx
je 0x43fa8f
cmp cx, 0x2a
je 0x43fa8f
xor eax, eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
movzx eax, cx
push eax
lea ecx, [esp + 0x24]
push str._c:_
push ecx
mov word [esp + 0x2c], di
call dword [sym.imp.MSVCR80.dll__swprintf]
push 0xfe
lea edx, [esp + 0x42]
push edi
push edx
mov word [esp + 0x48], di
call sub.ntdll.dll_memset
add esp, 0x18
push 0x80
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push 0x40
push ebx
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop edi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x22c
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43fa94
sub eax, edx
sar eax, 1
je 0x43fbc2
push 0xfe
lea edx, [esp + 0x136]
push edi
push edx
mov word [esp + 0x13c], di
call sub.ntdll.dll_memset
add esp, 0xc
test byte [0x50354c], 1
jne 0x43fae1
or dword [0x50354c], 1
mov dword [0x503548], 0x4e7844
mov eax, dword [0x503548]
mov edx, dword [eax + 0x64]
push 0x80000000
push esi
mov ecx, 0x503548
call edx
mov esi, eax
cmp esi, 0xffffffff
je 0x43fba1
test byte [0x503528], 1
jne 0x43fb27
or dword [0x503528], 1
mov dword [0x5032ec], 0x4e8ab4
mov dword [0x5032f0], edi
mov dword [0x5032f4], edi
push 0x40
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x5032ec]
lea eax, [esp + 0x20]
push eax
mov eax, dword [edx + 0x14]
push 0x40
push ebx
push esi
mov ecx, 0x5032ec
call eax
test eax, eax
push esi
jne 0x43fb7f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x4d
add esi, 8
call fcn.0043f630
mov ecx, dword [esi]
push eax
push str._s:_Call_GetVolumeInfoByHandle_to_fail.
push edi
call ecx
jmp 0x43fbbf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x22c
ret
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x56
add esi, 8
call fcn.0043f630
mov edx, dword [esi]
push eax
push str._s:_OpenDevVolume_failed.
push edi
call edx
add esp, 0x10
mov ecx, dword [esp + 0x230]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0046d6fd
add esp, 0x22c
ret
Function at 0x441500
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4415a4
call fcn.004414a0
test eax, eax
jne 0x4415a4
mov eax, 1
test byte [0x503544], al
jne 0x441573
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00441380
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4415d7
test ecx, ecx
je 0x44159d
test eax, eax
je 0x44159d
test ecx, 0x1ff
jne 0x44159d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x4415f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x441697
call fcn.004414a0
test eax, eax
jne 0x441697
mov eax, 1
test byte [0x503544], al
jne 0x441663
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x8e
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.00441380
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x503520
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4416ca
test ecx, ecx
je 0x441690
test eax, eax
je 0x441690
test ecx, 0x1ff
jne 0x441690
mov eax, 1
pop esi
add esp, 0xc
ret