joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4159ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x415a26
push edi
movzx edx, byte [ecx]
push 8
dec esi
xor eax, edx
inc ecx
pop edi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x415a08
test esi, esi
jne 0x4159fe
pop edi
not eax
pop esi
pop ebp
ret 8

Function at 0x415c8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call fcn.00450230
add esp, 0xc
push 0
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [esi]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
jne 0x415ce9
xor eax, eax
jmp 0x415d12
push edi
push 8
pop ecx
lea edi, [ebp - 0xe04]
mov esi, str.EFI_PART
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x415d04
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x415ce5
cmp byte [ebp - 0xe42], 0xee
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 4

Function at 0x415e09
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov dword [ebp - 0x210], esi
mov byte [ebp - 0x204], 0
call fcn.00450230
add esp, 0xc
push 0x40000000
push esi
push 0x469d6c
call fcn.0042f614
pop ecx
pop ecx
push eax
call fcn.00438ad2
mov edi, eax
test edi, edi
jne 0x415e85
push esi
push str.Cant_open_physical_drive__u_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x151
push str.GPTUTIL
call fcn.0044dc85
add esp, 0x14
xor eax, eax
jmp 0x415ece
and dword [ebp - 0x208], 0
mov esi, 0x200
push 0
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x204]
push eax
push dword [edi]
call dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
test eax, eax
je 0x415ede
cmp dword [ebp - 0x20c], esi
jne 0x415ede
inc dword [ebp - 0x208]
cmp dword [ebp - 0x208], 0x22
jl 0x415e91
push edi
call fcn.00438b96
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 4
push dword [ebp - 0x210]
push dword [ebp - 0x208]
push str.Cant_write_sector__d_on_disk__d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x159
push str.GPTUTIL
call fcn.0044dc85
add esp, 0x18
jmp 0x415e81

Function at 0x415f38
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00415c8c
Function at 0x41662a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [0x482288]
mov dword [ebp - 0x68], eax
call fcn.0044df99
mov esi, dword [0x482288]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
cmp esi, 0xffffffff
jne 0x416669
xor eax, eax
inc eax
jmp 0x416681
push edi
mov edi, 0x400000
push edi
call fcn.00452122
pop ecx
mov dword [ebp - 0x60], eax
cmp eax, ebx
jne 0x416691
push 2
pop eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 4
push ebx
push ebx
push 0x14
push esi
call fcn.0044df99
cmp eax, 0x14
jne 0x4166a4
cmp edx, ebx
je 0x4166d5
push ebx
push 0x14
push str.cant_seek_to_position:__I64d_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x10a
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x18
push 3
pop ebx
push dword [ebp - 0x60]
call fcn.0045038b
pop ecx
mov eax, ebx
jmp 0x416680
lea eax, [ebp - 0x5c]
push eax
call fcn.0041d43d
mov esi, dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
jmp 0x4166fa
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x64], ebx
je 0x416731
push dword [ebp - 0x64]
push dword [ebp - 0x60]
push eax
call fcn.0041db19
push ebx
lea eax, [ebp - 0x64]
push eax
push edi
push dword [ebp - 0x60]
push dword [0x482288]
call esi
test eax, eax
jne 0x4166e6
push str.cant_read_data_from_hashfile_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x114
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
push 4
jmp 0x4166c7
push eax
push dword [ebp - 0x68]
call fcn.0041dbbe
push ebx
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [0x482288]
call fcn.0044df99
jmp 0x4166c8
Function at 0x416ec9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00416cd3
mov edi, edx
mov esi, eax
and eax, edi
cmp eax, 0xffffffff
jne 0x416f05
movzx eax, word [0x4a3fa8]
imul eax, dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
call fcn.00450230
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
push 0
push edi
push esi
push dword [0x482288]
call fcn.0044df99
cmp eax, esi
jne 0x416f1c
cmp edx, edi
je 0x416f43
push edi
push esi
push edi
push esi
push str.cant_seek_to_fileposition_in_hash_file_at__I64lu_0x_I64lx__n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x311
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x20
or eax, 0xffffffff
jmp 0x416eff
push 0
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x4a3fa8]
imul eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [0x482288]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
jne 0x416f88
push str.error_reading_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x317
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
jmp 0x416f3e
movzx eax, word [0x4a3fa8]
imul eax, dword [ebp + 0x14]
cmp dword [ebp + 0xc], eax
je 0x416efd
push dword [ebp + 0xc]
push str.error_reading_hash_file:_short_read___u_bytes_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x31d
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
jmp 0x416f3e
Function at 0x417370
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x482288]
push edi
or edi, 0xffffffff
cmp eax, edi
je 0x417538
mov ecx, dword [0x4a41f4]
push eax
call fcn.0041ee59
test eax, eax
jne 0x4173b3
push str.cant_flush_data_to_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3f0
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
mov ecx, dword [0x4a41f4]
push esi
call fcn.0041e8c2
xor esi, esi
cmp dword [0x4a3d40], esi
je 0x4174d9
cmp dword [0x4d659c], esi
jne 0x4174d9
mov eax, dword [0x482290]
mov ecx, dword [0x482294]
mov edx, eax
and edx, ecx
cmp edx, edi
je 0x417419
add eax, 0x1000
push esi
adc ecx, esi
push ecx
push eax
push dword [0x482288]
call fcn.0044df99
push dword [0x482288]
call dword [sym.imp.___total_physical_size__lu_MB_SetEndOfFile]
mov dword [0x482290], edi
mov dword [0x482294], edi
push ebx
push esi
push esi
push esi
push dword [0x482288]
call fcn.0044df99
mov edi, dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
push esi
lea eax, [ebp - 4]
push eax
mov ebx, 0x486
push ebx
push 0x4a3d68
push dword [0x482288]
call edi
test eax, eax
jne 0x417468
push str.cant_write_to_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x403
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
push 0x4a3d6c
call fcn.0041662a
cmp eax, esi
je 0x417495
push eax
push str.Corrupted_hash_file__cant_calculate_checksum_due_to_read_errors___d__nPlease_generate_a_new_hash_file_from_the_original_image.
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x408
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
push esi
push esi
push esi
push dword [0x482288]
call fcn.0044df99
push esi
lea eax, [ebp - 4]
push eax
push ebx
push 0x4a3d68
push dword [0x482288]
call edi
pop ebx
test eax, eax
jne 0x4174d9
push str.cant_write_to_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x411
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
mov eax, dword [0x4a41ee]
cmp eax, esi
je 0x4174e9
push eax
call fcn.0045038b
pop ecx
push dword [0x482288]
call dword [sym.imp.___total_physical_size__lu_MB_FlushFileBuffers]
push dword [0x482288]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
push 0x48a
push esi
push 0x4a3d68
call fcn.00450230
mov eax, dword [0x4a3d60]
add esp, 0xc
cmp eax, esi
je 0x41752a
push eax
call fcn.0045038b
pop ecx
mov dword [0x4a3d60], esi
or dword [0x482288], 0xffffffff
mov dword [0x4a3d40], esi
pop esi
pop edi
leave
ret
Function at 0x41763d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
xor esi, esi
push esi
push esi
push dword [0x482288]
call fcn.0044df99
push esi
push esi
push dword [0x4a3fa4]
mov edi, eax
push dword [0x482288]
mov ebx, edx
call fcn.0044df99
mov ecx, dword [0x4a3fa4]
cmp eax, ecx
jne 0x417679
cmp edx, esi
je 0x41769d
push ecx
push str.cant_seek_in_hash_file._Position:__I64lu_0x_I64lx__n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x478
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
or eax, 0xffffffff
jmp 0x4176ea
push esi
push dword [ebp + 0xc]
push dword [0x4a3fa0]
push dword [ebp + 8]
push dword [0x482288]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
jne 0x4176da
push str.cant_read_from_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x47e
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
jmp 0x417698
push esi
push ebx
push edi
push dword [0x482288]
call fcn.0044df99
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4176f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [0x482288]
call fcn.0044df99
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4a3fa0]
mov dword [ebp - 8], edx
cmp edi, eax
jbe 0x41772c
push eax
push edi
push str.WARNING:_Encryption_length___u___but_only__u_bytes_reserved._n
call fcn.00450f5c
add esp, 0xc
mov esi, dword [0x4a3fa4]
push ebx
xor eax, eax
push eax
add esi, 0xfffffffc
push esi
push dword [0x482288]
mov dword [0x4a3fa0], edi
call fcn.0044df99
cmp eax, esi
jne 0x417755
xor eax, eax
cmp edx, eax
je 0x41777e
push dword [0x4a3fa4]
push str.cant_seek_in_hash_file._Position:__I64lu_0x_I64lx__n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x495
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
or eax, 0xffffffff
jmp 0x4177e1
mov esi, dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
push 4
push 0x4a3fa0
push dword [0x482288]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [0x482288]
call esi
test eax, eax
jne 0x4177cd
push str.cant_write_to_hash_file_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x49d
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
jmp 0x417779
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [0x482288]
call fcn.0044df99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x419997
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
and dword [0x4d659c], 0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x419896
call fcn.0045552f
add esp, 0xc
push 0
push fcn.0044af65
push str.index
push 0x46d014
mov dword [0x4d7514], 1
call fcn.00448ce4
and dword [0x4d7514], 0
mov dword [0x4d66a4], eax
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x41a74f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x41a76e
or dword [esi], 0xffffffff
call dword [sym.imp.___total_physical_size__lu_MB_GetVersion]
and eax, 0xff
cmp eax, 5
push edi
lea eax, [ebp - 0x44]
jb 0x41a789
push str..Global_s
jmp 0x41a78e
push str.._s
push eax
call fcn.00450c76
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
cmp eax, 0xffffffff
jne 0x41a7bc
xor eax, eax
jmp 0x41a7ce
test esi, esi
je 0x41a7c4
mov dword [esi], eax
jmp 0x41a7cb
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 8

Function at 0x41a7de
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ical_size__lu_MB_OpenServiceA]
mov esi, eax
test esi, esi
je 0x41a822
push edi
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ical_size__lu_MB_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ical_size__lu_MB_CloseServiceHandle]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 8
Function at 0x41abd1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0041ab9e
xor edi, edi
cmp edi, 0x1a
jge 0x41ac40
lea esi, [edi + 0x41]
push esi
lea eax, [ebp - 0x2c]
push 0x46a8cc
push eax
call fcn.00450c76
add esp, 0xc
push 0x64
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_QueryDosDeviceA]
test eax, eax
je 0x41ac92
push 0xe
lea eax, [ebp - 0x90]
push str.DeviceFloppy
push eax
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x41ac92
push esi
push str.._c:
jmp 0x41ac49
lea eax, [edi - 0x1a]
push eax
push str..PhysicalDrive_d
lea eax, [ebp - 0x18]
push eax
call fcn.00450c76
add esp, 0xc
push 1
call dword [sym.imp.___total_physical_size__lu_MB_SetErrorMode]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41ac84
cmp edi, 0x1a
jg 0x41ac9c
jmp 0x41ac92
push esi
call dword [sym.imp.___total_physical_size__lu_MB_FlushFileBuffers]
push esi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
inc edi
cmp edi, 0x20
jl 0x41abed
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret
Function at 0x41b2f5
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
push 0x28
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call fcn.00452122
pop ecx
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x41b323
push 0x28
push str.Not_enough_memory_to_allocate__d_bytes_n
call fcn.0043c16a
pop ecx
pop ecx
mov edi, 0x4000
push edi
push 1
call fcn.00450903
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
jne 0x41b343
push str.Not_enough_memory_to_allocate_16384_bytes_n
call fcn.0043c16a
pop ecx
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.00455611
pop ecx
push eax
push ebx
push esi
push esi
mov esi, dword [sym.imp.___total_physical_size__lu_MB_DeviceIoControl]
push 0x70050
push dword [ebp + 8]
call esi
test eax, eax
jle 0x41b3ce
cmp dword [ebx], 1
jne 0x41b3ce
push edi
call fcn.00452122
mov esi, eax
pop ecx
test esi, esi
jne 0x41b384
push str.Not_enough_memory_to_allocate_16384_bytes_n
call fcn.0043c16a
pop ecx
push ebx
call fcn.00455611
push eax
push ebx
push esi
call fcn.00451390
mov edx, dword [esi + 4]
add esp, 0x10
mov dword [ebx], edx
test edx, edx
je 0x41b3c5
lea ecx, [ebx + 8]
lea eax, [esi + 0x38]
mov edi, dword [eax + 8]
mov dword [ecx + 8], edi
mov edi, dword [eax + 0xc]
mov dword [ecx + 0xc], edi
mov edi, dword [eax]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
add eax, 0x90
add ecx, 0x20
dec edx
jne 0x41b3a4
push esi
call fcn.0045038b
pop ecx
jmp 0x41b3ee
xor edi, edi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.00455611
pop ecx
push eax
push ebx
push edi
push edi
push 0x7400c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x41b460
mov esi, dword [ebx]
shl esi, 5
add esi, 0x28
push esi
push dword [ebp - 8]
call fcn.0045366b
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x41b417
push esi
push str.Not_enough_memory_to_allocate__d_bytes_n
call fcn.0043c16a
pop ecx
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
cmp dword [ebx], edi
jbe 0x41b460
mov edx, dword [ebp - 8]
add edx, 8
lea eax, [ebx + 0x20]
mov ecx, dword [eax - 0x10]
or ecx, dword [eax - 0xc]
je 0x41b453
mov cl, byte [eax]
cmp cl, 0x42
je 0x41b453
cmp cl, 5
je 0x41b453
cmp cl, 0xf
je 0x41b453
inc dword [ebp - 4]
push 8
mov edi, edx
lea esi, [eax - 0x18]
pop ecx
rep movsd dword es:[edi], dword [esi]
add edx, 0x20
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add eax, 0x20
cmp ecx, dword [ebx]
jb 0x41b42a
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [esi], eax
test eax, eax
je 0x41b480
push 0x41acaa
push 0x20
push eax
lea eax, [esi + 8]
push eax
call fcn.004533e0
add esp, 0x10
push ebx
call fcn.0045038b
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x41b490
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x244], esi
call fcn.0041f685
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0043de09
push esi
push 0x20000000
push 3
push esi
push 3
push Ordinal_2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [ebp - 0x230], eax
cmp eax, 0xffffffff
jne 0x41b52d
push edi
lea eax, [ebp - 0x108]
push eax
push str._nError_opening_volume:__s___s_
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x205
push str.LINUXCPPART2FILE
call fcn.0044dc85
add esp, 0x18
xor eax, eax
xor edx, edx
jmp 0x41b60b
mov edi, dword [sym.imp.___total_physical_size__lu_MB_DeviceIoControl]
push esi
lea ecx, [ebp - 0x234]
push ecx
push 8
lea ecx, [ebp - 0x240]
push ecx
push esi
push esi
push 0x7405c
push eax
call edi
test eax, eax
je 0x41b563
mov esi, dword [ebp - 0x240]
mov edi, dword [ebp - 0x23c]
jmp 0x41b5fb
push esi
lea eax, [ebp - 0x234]
push eax
push 0x90
lea eax, [ebp - 0x2d8]
push eax
push esi
push esi
push 0x70048
push dword [ebp - 0x230]
call edi
test eax, eax
je 0x41b598
mov esi, dword [ebp - 0x2c8]
mov edi, dword [ebp - 0x2c4]
jmp 0x41b5fb
push esi
lea eax, [ebp - 0x234]
push eax
push 0x20
lea eax, [ebp - 0x22c]
push eax
push esi
push esi
push 0x74004
push dword [ebp - 0x230]
call edi
test eax, eax
je 0x41b5ca
mov esi, dword [ebp - 0x224]
mov edi, dword [ebp - 0x220]
jmp 0x41b5fb
push dword [ebp - 0x238]
lea eax, [ebp - 0x108]
push eax
push str._nCant_get_size_of_volume:__s___s_
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x218
push str.LINUXCPPART2FILE
call fcn.0044dc85
mov edi, dword [ebp - 0x244]
add esp, 0x18
push dword [ebp - 0x230]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, esi
mov edx, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 4
Function at 0x41cb4c
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [0x482364], 0xffffffff
jne 0x41cb86
push ebx
push ebx
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [0x482364], eax
cmp dword [0x482368], 0xffffffff
jne 0x41cb94
call fcn.0041cae5
mov eax, dword [0x482364]
cmp eax, 0xffffffff
jne 0x41cba5
xor eax, eax
jmp 0x41cce0
push 2
push ebx
push ebx
push eax
call fcn.0044df99
cmp dword [0x4cd630], 1
jne 0x41cbc8
push 0x41ca4c
call fcn.00451fa4
pop ecx
jmp 0x41ccdd
push ebx
lea eax, [ebp - 0x258]
push eax
push 4
push str._r_n_r_n
push dword [0x482364]
call dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetLocalTime]
push 0x40
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x254]
push eax
push 1
push 0x400
call dword [sym.imp.___total_physical_size__lu_MB_GetDateFormatA]
lea eax, [ebp - 0x44]
push eax
push str.Jan__4_2013
push 0x469ec0
push str.Start_of__s_1.42___s__at__s
call fcn.0041c7ee
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
call fcn.004151f2
test eax, eax
mov eax, 0x46d6c8
je 0x41cc41
lea eax, [ebp - 0x144]
push eax
push str.Running_on__s
call fcn.0041c7ee
pop ecx
pop ecx
push 0x100
lea eax, [ebp - 0x244]
push eax
call fcn.00415942
test eax, eax
mov eax, str.unknown_memory____
je 0x41cc6e
lea eax, [ebp - 0x244]
push esi
push edi
push eax
push str.Memory_Info:__s
call fcn.0041c7ee
pop ecx
pop ecx
call dword [sym.imp.___total_physical_size__lu_MB_GetCommandLineA]
push eax
call fcn.004503c5
mov edi, eax
pop ecx
mov esi, edi
cmp byte [edi], bl
je 0x41ccbd
push 4
push str._pw
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x41ccb8
add esi, 4
jmp 0x41ccb4
cmp byte [esi], 0x20
je 0x41ccb8
mov byte [esi], 0x2a
inc esi
cmp byte [esi], bl
jne 0x41ccab
inc esi
cmp byte [esi], bl
jne 0x41cc92
push edi
push str.Command_line:__s
call fcn.0041c7ee
push edi
call fcn.0045038b
push 0x41ca4c
call fcn.00451fa4
add esp, 0x10
pop edi
pop esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 4

Function at 0x41d43d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4