joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4382ac
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x4b5f61
call fcn.00487e94
mov dword [ebp - 4], 1
movzx ecx, byte [ebp + 0xc]
push dword [ebp + 0x10]
mov eax, ecx
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
push eax
push dword [ebp + 8]
push str.Color
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx esi, al
movzx ecx, ax
shl esi, 8
shr ecx, 8
or esi, ecx
shr eax, 0x10
shl esi, 8
movzx eax, al
or esi, eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040259b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040259b
mov eax, esi
call fcn.00487e62
ret 0xc

Function at 0x438322
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x4b5f61
call fcn.00487e94
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
movzx eax, byte [ebp + 0xc]
push eax
push dword [ebp + 8]
push str.Alpha
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov bl, al
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040259b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov al, bl
call fcn.00487e62
ret 0xc

Function at 0x438375
Capabilities:
Read .ini file

Disassembly:
push 0x20c
mov eax, 0x4b5fb5
call fcn.00487ec7
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x218], esi
and dword [ebp - 0x214], 0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, esi
call fcn.0040364a
push dword [ebp + 0xc]
mov dword [ebp - 0x214], edi
push str.ParentTheme_d
push esi
call fcn.00403636
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [ebp + 0x10]
push 0x100
push eax
push 0x4c9ff4
push dword [esi]
push str.Info
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00402266
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040259b
mov eax, esi
call fcn.00487e76
ret 0xc
Function at 0x439037
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4f9d0c], 0xffffffff
jne 0x4390d1
push ebx
push edi
push 4
pop eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0xc], eax
mov ebx, 0x20019
lea eax, [ebp - 4]
mov dword [0x4f9d0c], edi
push eax
push ebx
push edi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v2.0.50727
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43909c
lea eax, [ebp - 4]
push eax
push ebx
push edi
push str.SOFTWAREWow6432NodeMicrosoftNET_Framework_SetupNDP_v2.0.50727
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4390cf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.Install
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4390c6
inc eax
cmp dword [ebp - 8], eax
jne 0x4390c6
mov dword [0x4f9d0c], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [0x4f9d0c]
leave
ret

Function at 0x4390d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4f9d08], 0xffffffff
jne 0x439172
push ebx
push edi
push 4
pop eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0xc], eax
mov ebx, 0x20019
lea eax, [ebp - 4]
mov dword [0x4f9d08], edi
push eax
push ebx
push edi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43913d
lea eax, [ebp - 4]
push eax
push ebx
push edi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439170
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.Install
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439167
inc eax
cmp dword [ebp - 8], eax
jne 0x439167
mov dword [0x4f9d08], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [0x4f9d08]
leave
ret
Function at 0x439179
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0x4b6240
call fcn.00487ec7
mov eax, dword [0x4f9d00]
xor esi, esi
cmp eax, 0xffffffff
jne 0x4391db
mov edi, 0x11c
mov dword [0x4f9d00], esi
push edi
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x22c], edi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x228], 5
jne 0x4391d6
xor eax, eax
inc eax
mov dword [0x4f9d00], eax
jmp 0x4391db
mov eax, dword [0x4f9d00]
test eax, eax
je 0x4392af
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x23c], 4
mov dword [ebp - 0x238], 0x100
mov dword [ebp - 0x230], esi
call fcn.0040364a
mov dword [ebp - 4], esi
lea eax, [ebp - 0x230]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionThemeManager_
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43929b
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
push str.ThemeActive
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43928f
lea eax, [ebp - 0x110]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x234]
call fcn.00402266
push esi
push 0x4cac18
lea ecx, [ebp - 0x234]
call fcn.0040a80a
test eax, eax
jne 0x43928f
xor esi, esi
inc esi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.0040259b
mov eax, esi
call fcn.00487e76
ret

Function at 0x4392b5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x4f9cfc]
cmp esi, 0xffffffff
jne 0x43932b
push edi
mov edi, 0x11c
lea eax, [ebp - 0x120]
xor esi, esi
push edi
push esi
push eax
mov dword [0x4f9cfc], esi
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
pop edi
jbe 0x439325
cmp dword [ebp - 0x11c], 6
jne 0x439322
cmp dword [ebp - 0x118], 2
jbe 0x439325
xor esi, esi
inc esi
mov dword [0x4f9cfc], esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00487643
leave
ret

Function at 0x4393b1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4f9cf4]
cmp eax, 0xffffffff
jne 0x439428
and dword [0x4f9cf4], 0
lea eax, [ebp - 0x120]
push esi
mov esi, 0x11c
push esi
push 0
push eax
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jne 0x439423
cmp dword [ebp - 0x118], 2
jae 0x439423
cmp byte [ebp - 6], 1
jne 0x439423
xor eax, eax
inc eax
mov dword [0x4f9cf4], eax
jmp 0x439428
mov eax, dword [0x4f9cf4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487643
leave
ret
Function at 0x439434
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x114
mov eax, 0x4b6285
call fcn.00487ec7
mov eax, dword [0x4f9cf0]
cmp eax, 0xffffffff
jne 0x439610
xor edi, edi
mov dword [ebp - 0x120], 1
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0x100
mov dword [ebp - 0x118], edi
call fcn.0040364a
mov dword [ebp - 4], edi
xor edx, edx
mov ecx, str.Shdocvw.dll
call fcn.0043c135
sub eax, 0x1d6
je 0x4395f1
sub eax, 1
je 0x4395ea
sub eax, 1
je 0x4395e3
sub eax, 0x1c
je 0x4395dc
sub eax, 0x32
je 0x4395d5
lea eax, [ebp - 0x118]
mov dword [0x4f9cf0], 0x258
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4395c1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
push str.Version
push dword [ebp - 0x118]
call esi
test eax, eax
jne 0x4395c1
lea eax, [ebp - 0x110]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
call fcn.00402266
push dword [ebp - 0x114]
call fcn.00490f02
imul eax, eax, 0x64
mov ebx, 0x384
pop ecx
mov dword [0x4f9cf0], eax
cmp eax, ebx
jne 0x4395c1
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
push str.svcVersion
push dword [ebp - 0x118]
call esi
test eax, eax
jne 0x4395c1
lea eax, [ebp - 0x110]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
call fcn.00402266
push dword [ebp - 0x114]
call fcn.00490f02
imul eax, eax, 0x64
pop ecx
cmp eax, ebx
jle 0x4395c1
push dword [ebp - 0x114]
call fcn.00490f02
imul eax, eax, 0x64
pop ecx
mov dword [0x4f9cf0], eax
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x4f9cf0]
jmp 0x4395fc
mov esi, 0x226
jmp 0x4395f6
mov esi, 0x1f4
jmp 0x4395f6
mov esi, 0x191
jmp 0x4395f6
mov esi, 0x190
jmp 0x4395f6
mov esi, 0x12c
mov dword [0x4f9cf0], esi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x114]
add ecx, 0xfffffff0
call fcn.0040259b
mov eax, esi
call fcn.00487e76
ret
Function at 0x43bfae
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x4b6796
call fcn.00487e94
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5061f0]
cmp eax, dword [ecx + 4]
jg 0x43c0ff
lea ecx, [ebp - 0x10]
call fcn.0040364a
mov byte [ebp - 4], 2
call fcn.0043c2f6
sub eax, dword [0x5061f4]
push eax
lea eax, [ebp - 0x10]
push 0x4d7994
push eax
call fcn.00403636
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
add esp, 0xc
push dword [eax - 0xc]
push eax
call fcn.00403393
mov esi, 0x4cb328
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00403393
push 0x4c9ff4
push 0x4d79a0
lea ecx, [ebp - 0x10]
call fcn.0040a844
cmp dword [0x4f9d20], 0
mov esi, 0x4fe9c8
je 0x43c083
mov edi, 0x104
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x2e
push esi
call fcn.00489480
pop ecx
pop ecx
test eax, eax
je 0x43c076
push 0x4d79a4
xor ecx, ecx
push edi
push esi
mov word [eax], cx
call fcn.00495194
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [0x4f9d20], ebx
cmp dword [0x4fe968], 0
jne 0x43c08e
jmp 0x43c0dc
push 0x4d79b0
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00498c69
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x43c0c9
push dword [ebp - 0x10]
push 0x4ca26c
push dword [ebp - 0x14]
call fcn.0043c3d8
push dword [ebp - 0x14]
call fcn.00498fc4
push dword [ebp - 0x14]
call fcn.0049913e
add esp, 0x14
cmp dword [0x4fe968], 2
jne 0x43c0dc
push ebx
push ebx
push dword [ebp - 0x10]
call fcn.00464a4f
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040259b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040259b
call fcn.00487e62
ret
mov esi, 0x5061f0
push esi
call fcn.00487784
cmp dword [0x5061f0], 0xffffffff
pop ecx
jne 0x43bfd8
mov byte [ebp - 4], 1
call fcn.0043c2f6
mov dword [0x5061f4], eax
mov byte [ebp - 4], bl
push esi
call fcn.0048773a
pop ecx
jmp 0x43bfd8
Function at 0x43c135
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, edx
push esi
push edi
mov dword [ebp - 0x248], eax
mov esi, ecx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x244], eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
xor ecx, ecx
mov dword [ebp - 0x240], eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045a96b
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x240]
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x43c27b
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
push 0x4ca734
push edi
call esi
push 0x34
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push eax
call fcn.00488f00
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
push str.VarFileInfoTranslation
push edi
call esi
push 4
push dword [ebp - 0x23c]
lea eax, [ebp - 0x244]
push eax
call fcn.00488f00
mov ecx, dword [ebp - 0x244]
mov eax, ecx
push 0x4d79ec
shr eax, 0x10
push eax
movzx eax, cx
push eax
lea eax, [ebp - 0x204]
push str.StringFileInfo_04X_04X_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call esi
push dword [ebp - 0x23c]
mov esi, 0x100
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.004929af
add esp, 0xc
test ebx, ebx
je 0x43c27b
push dword [ebp - 0x23c]
push esi
push ebx
call fcn.004929af
add esp, 0xc
push edi
call fcn.0045a966
lea eax, [ebp - 0x204]
mov dword [esp], 0x4c9ff4
push eax
call fcn.00490f86
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
je 0x43c2b7
lea eax, [ebp - 0x204]
push eax
call fcn.00498b1f
fmul qword [0x4dfdb8]
pop ecx
call fcn.00488120
jmp 0x43c2b9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487643
leave
ret
Function at 0x44d002
Capabilities:
Read file on windows

Disassembly:
push 0x20c
mov eax, 0x4b8e56
call fcn.00487ec7
mov esi, ecx
lea ecx, [ebp - 0x214]
call fcn.0040364a
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jl 0x44d09c
cmp dword [esi + 0x140], edi
jne 0x44d09c
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push str..PhysicalDrive_d
push eax
call fcn.00403636
add esp, 0xc
push edi
push edi
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44d09c
push edi
push edi
push edi
push esi
mov dword [ebp - 0x218], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x218]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test esi, esi
je 0x44d09c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.0040259b
call fcn.00487e76
ret 4
Function at 0x45127a
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b972d
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.00488010
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x1044]
call fcn.0040364a
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1044]
push dword [ebp + 8]
push str..PhysicalDrive_d
push eax
call fcn.00403636
add esp, 0xc
push esi
push 0x80
push 3
pop ebx
push ebx
push esi
push ebx
push 0xc0000000
push dword [ebp - 0x1044]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x1030
mov esi, eax
lea eax, [ebp - 0x1040]
push 0
push eax
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x1038], ebx
xor eax, eax
mov dword [ebp - 0x1028], 0x28
inc eax
mov dword [ebp - 0x1024], 0x1000
mov dword [ebp - 0x1034], eax
mov ecx, 0x1030
mov dword [ebp - 0x1030], eax
xor eax, eax
push eax
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x103c], eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x1048]
push eax
push ecx
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x1040], 0x31
push eax
push ecx
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test esi, esi
je 0x451382
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1000
lea eax, [ebp - 0x1010]
push edx
push eax
mov ecx, edi
call fcn.00457a8b
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1044]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487643
leave
ret 0x10
Function at 0x4513c8
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9772
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.00488010
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x1044]
mov dword [ebp - 0x104c], eax
call fcn.0040364a
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1044]
push dword [ebp + 8]
push str..PhysicalDrive_d
push eax
call fcn.00403636
add esp, 0xc
push ebx
push 0x80
push 3
pop edi
push edi
push ebx
push edi
push 0xc0000000
push dword [ebp - 0x1044]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x1010
mov esi, eax
lea eax, [ebp - 0x1020]
push ebx
push eax
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x102c], ebx
mov ecx, 0x1030
mov dword [ebp - 0x103c], ebx
mov dword [ebp - 0x1048], ebx
mov dword [ebp - 0x1038], edi
push 2
pop eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x1030], eax
lea eax, [ebp - 0x1048]
push eax
push ecx
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x1028], 0x28
push eax
push ecx
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x1024], 0x1000
mov dword [ebp - 0x1040], 0x31
call ebx
mov edi, eax
test edi, edi
jne 0x4514f6
or dword [ebp - 0x102c], 0xffffffff
mov ecx, 0x1030
push eax
lea eax, [ebp - 0x1048]
push eax
push ecx
lea eax, [ebp - 0x1040]
push eax
push ecx
push eax
push 0x2d1400
push esi
call ebx
mov edi, eax
test esi, esi
je 0x451501
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x104c]
lea eax, [ebp - 0x1010]
mov edx, 0x200
add ecx, 0x1000
push edx
push eax
call fcn.00457a8b
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1044]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487643
leave
ret 0x10
Function at 0x4585c4
Capabilities:
Read .ini file

Disassembly:
push 0x20c
mov eax, 0x4b513f
call fcn.00487ec7
mov edi, ecx
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x218], esi
and dword [ebp - 0x214], 0
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.0040364a
cmp dword [ebp + 0x14], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 1
jne 0x458654
push dword [edi + 0x178]
push 0x100
push eax
push 0x4c9ff4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00402266
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x45868d
lea eax, [ebp - 0x210]
push dword [edi + 0x17c]
push 0x100
push eax
push 0x4c9ff4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00402266
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0040259b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040259b
mov eax, esi
call fcn.00487e76
ret 0x10
Function at 0x4592d4
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
push eax
mov esi, 0xf003f
xor ebx, ebx
push esi
push ebx
mov edi, str.SYSTEMCurrentControlSetServicesEventLogApplicationCrystalDiskInfo
mov dword [ebp - 0x210], ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45933c
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4593b8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push str.EventMessageFile
push dword [ebp - 0x210]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4593bc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0048cb73
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push ebx
push str.EventMessageFile
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x4593bc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45941c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push str.TypesSupported
push dword [ebp - 0x210]
call esi
test eax, eax
je 0x45940b
push 4
pop ecx
push ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 7
push eax
push ecx
push ebx
push str.TypesSupported
push dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
call edi
test eax, eax
jne 0x4593ac
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487643
leave
ret

Function at 0x45942b
Capabilities:
Access the windows event log

Disassembly:
push 8
mov eax, 0x4ba3de
call fcn.00487e94
mov dword [ebp - 0x14], edx
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
push 0x4ca17c
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x459494
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push eax
push esi
push 1
push esi
push 0x63
mov dword [ebp - 0x10], ecx
lea eax, [ebx - 0x258]
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, 0xc0000000
add eax, 0x80000000
add eax, ebx
push eax
push esi
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
je 0x459494
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov eax, esi
call fcn.00487e62
ret