joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411cc8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434c44]
jne 0x411cd2
repz ret
jmp fcn.0041600b

Function at 0x4211c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416183
and dword [ebp - 4], 0
cmp dword [0x438a9c], 0
mov ebx, eax
jne 0x421271
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421322
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421322
push eax
call fcn.00416111
mov dword [esp], 0x42c870
push edi
mov dword [0x438a9c], eax
call esi
push eax
call fcn.00416111
mov dword [esp], 0x42c85c
push edi
mov dword [0x438aa0], eax
call esi
push eax
call fcn.00416111
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438aa4], eax
call esi
push eax
call fcn.00416111
pop ecx
mov dword [0x438aac], eax
test eax, eax
je 0x421271
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00416111
pop ecx
mov dword [0x438aa8], eax
mov eax, dword [0x438aa8]
cmp eax, ebx
je 0x4212c9
cmp dword [0x438aac], ebx
je 0x4212c9
push eax
call fcn.0041618c
push dword [0x438aac]
mov esi, eax
call fcn.0041618c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4212c9
test edi, edi
je 0x4212c9
call esi
test eax, eax
je 0x4212c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4212c0
test byte [ebp - 0xc], 1
jne 0x4212c9
or dword [ebp + 0x10], 0x200000
jmp 0x421302
mov eax, dword [0x438aa0]
cmp eax, ebx
je 0x421302
push eax
call fcn.0041618c
pop ecx
test eax, eax
je 0x421302
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421302
mov eax, dword [0x438aa4]
cmp eax, ebx
je 0x421302
push eax
call fcn.0041618c
pop ecx
test eax, eax
je 0x421302
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438a9c]
call fcn.0041618c
pop ecx
test eax, eax
je 0x421322
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421324
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ef2
Capabilities:
Get common file path

Disassembly:
push 0x470
mov eax, 0x424a63
call fcn.0040999c
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x460], ebx
mov dword [ebp - 4], esi
call fcn.004021fd
push 0xb0
lea eax, [ebp - 0x2fc]
push esi
push eax
call fcn.0040bfb0
pop ecx
lea ecx, [ebp - 0x2fc]
call fcn.00402a2e
push 0x104
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x2ec]
call fcn.004071da
mov edx, str.InstallerRazerInstaller
mov ecx, eax
call fcn.004071da
mov edx, 0x432460
mov ecx, eax
call fcn.004071da
xor edi, edi
inc edi
cmp edi, dword [ebp + 8]
jge 0x401f96
mov edx, 0x4324c0
lea ecx, [ebp - 0x2ec]
call fcn.004071da
mov edx, dword [ebx + edi*4]
mov ecx, eax
call fcn.004071da
inc edi
jmp 0x401f74
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.004029e3
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00402653
push esi
push 1
lea ecx, [ebp - 0x234]
call fcn.004053a1
lea ecx, [ebp - 0x294]
call fcn.004029ff
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004087bd
pop ecx
xor eax, eax
jmp 0x40215b
call fcn.004098e9
ret
Function at 0x402653
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x358
mov eax, 0x424b74
call fcn.0040992e
mov esi, ecx
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x10]
inc eax
push eax
call fcn.00402803
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x40268f
mov esi, dword [esi]
inc eax
push eax
push esi
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x280]
push ebx
push eax
call fcn.0040bfb0
xor eax, eax
mov dword [ebp - 0x280], esi
lea edi, [ebp - 0x340]
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040292b
mov esi, str.InstallerRazerInstaller
mov byte [ebp - 4], 1
push esi
call fcn.00401114
pop ecx
push eax
push esi
lea ecx, [ebp - 0x23c]
call fcn.00405471
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x340]
push ecx
lea ecx, [ebp - 0x280]
push ecx
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x224]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4027c9
push 0xb0
lea eax, [ebp - 0x330]
push ebx
push eax
call fcn.0040bfb0
pop ecx
lea ecx, [ebp - 0x330]
call fcn.00403d82
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, str.Failed_to_run_installer__
lea ecx, [ebp - 0x320]
call fcn.0040750e
mov ecx, eax
call fcn.004044f1
mov edx, 0x4324d4
mov ecx, eax
call fcn.0040750e
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x330]
call fcn.00403d37
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x4027ac
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x34c]
call fcn.00401050
push 0x435054
lea eax, [ebp - 0x34c]
push eax
call fcn.0040b5de
push dword [ebp - 0x340]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x33c]
call esi
push ebx
push 1
lea ecx, [ebp - 0x23c]
call fcn.004053a1
lea ecx, [ebp - 0x224]
call fcn.00404c6a
call fcn.004098d8
ret
Function at 0x403b25
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x424c8c
call fcn.0040992e
mov esi, ecx
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
cmp ecx, ebx
sete al
test al, al
je 0x403b51
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x403cb5
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x403b7f
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x403b7f
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x403cb5
cmp dword [esi + 0x4c], 0
je 0x403cb3
mov ecx, esi
call fcn.00405aab
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x403bb3
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.0040e85b
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x403cb3
push ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
lea ecx, [ebp - 0x2c]
push 8
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], 0xf
call fcn.0040560f
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x18]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
lea edx, [ebp - 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x3c]
call dword [edi + 0x1c]
test eax, eax
js 0x403ca7
cmp eax, 1
jg 0x403c8a
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp edi, 0x10
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x40], edx
je 0x403c5b
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0040f4a8
mov edx, dword [ebp - 0x40]
add esp, 0x10
cmp edx, eax
jne 0x403ca7
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x11]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x403c85
test edx, edx
jne 0x403bdb
cmp dword [ebp - 0x1c], 0x20
jae 0x403ca7
push edx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040576c
jmp 0x403bd8
mov ebx, dword [ebp + 8]
jmp 0x403ca7
cmp eax, 3
jne 0x403ca7
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
movsx eax, byte [ebp - 0x11]
push eax
call fcn.0040e85b
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405515
mov eax, ebx
call fcn.004098d8
ret 4
Function at 0x405b33
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x424e25
call fcn.0040992e
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x405c33
cmp byte [ebx + 0x3d], 0
je 0x405c33
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x405b6d
xor al, al
jmp 0x405c35
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040560f
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x405bcb
sub eax, 1
je 0x405bcf
dec eax
sub eax, 1
je 0x405c21
xor bl, bl
jmp 0x405c23
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x405c07
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0040f4a8
add esp, 0x10
cmp esi, eax
jne 0x405bc7
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x405c21
test esi, esi
jne 0x405b91
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040576c
jmp 0x405b8b
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405515
mov al, bl
jmp 0x405c35
mov al, 1
call fcn.004098d8
ret

Function at 0x416326
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161a5

Function at 0x41cccf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c97d
Function at 0x402800
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push ebx
lea eax, [ebp - 0x184]
push 0x104
push eax
call fcn.004030e1
lea eax, [ebp - 0x184]
push 0x409308
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x402859
lea eax, [ebp - 0x184]
push eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push str.Cant_open__s_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 1
pop eax
jmp 0x4028a9
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edi
mov edi, 0x80
push ebx
push edi
lea eax, [ebp - 0x80]
push 1
push eax
call esi
add esp, 0x10
test eax, eax
je 0x40289d
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
push eax
lea eax, [ebp - 0x80]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
push edi
lea eax, [ebp - 0x80]
push 1
push eax
call esi
add esp, 0x20
jmp 0x402873
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x402e56
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00402f32
pop ecx
test al, al
pop ecx
jne 0x402e82
push 1
push str.Error:_could_not_find_Java_2_Runtime_Environment.
call fcn.004033f0
pop ecx
pop ecx
push 2
call dword [sym.imp.MSVCRT.dll_exit]
push 0
call fcn.00402e50
push eax
push dword [ebp + 0x10]
call fcn.004028ac
add esp, 0xc
cmp eax, 1
jge 0x402eb0
push 1
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.004033f0
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040152c
push dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
mov edi, eax
and byte [ebx], 0
push ebx
push edi
mov dword [ebp + 0x14], edi
push dword [ebp + 0x10]
call fcn.00402ffa
add esp, 0x1c
test al, al
jne 0x402f2e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
mov esi, str.Error:_no___s_JVM_at___s.
add edx, ecx
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
call fcn.00402168
push ebx
mov edi, eax
push dword [ebp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
push 1
push edi
call fcn.004033f0
add esp, 0x1c
push 4
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4034ef
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, 0x104
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [ebp - 0x114]
xor eax, eax
push esi
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
test eax, eax
jne 0x40358e
mov ebx, dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp + 8]
inc dword [ebp - 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x114]
push eax
call fcn.0040459f
pop ecx
test eax, eax
pop ecx
je 0x403573
cmp dword [ebp - 8], 0
je 0x403562
push dword [ebp - 8]
lea eax, [ebp - 0x114]
push eax
call fcn.004044d0
pop ecx
test eax, eax
pop ecx
jle 0x403573
push dword [ebp - 8]
call ebx
pop ecx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x114]
push esi
push eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x403526
mov edi, dword [ebp - 8]
test edi, edi
jne 0x403592
xor eax, eax
jmp 0x403608
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push edi
je 0x4035b5
call ebx
cmp dword [ebp - 4], 0
pop ecx
jmp 0x4035df
call ebx
pop ecx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x114]
xor esi, esi
push eax
push esi
push esi
push str.JavaHome
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4035ec
cmp dword [ebp - 4], esi
je 0x40358e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40358e
cmp dword [ebp - 4], esi
je 0x4035fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403daa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 4], 0xffffffff
je 0x403e05
cmp dword [esi], 0xffffffff
je 0x403e05
push 0
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0xc
test eax, eax
jl 0x403e05
mov eax, dword [esi + 4]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x403e05
mov edi, dword [esi + 4]
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, edi
je 0x403e0c
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp eax, ecx
jne 0x403e1c
and byte [edi + ebx], cl
mov eax, ebx
jmp 0x403e07
cmp eax, 8
jne 0x403e05
push 0x38
push 0x409bb4
lea eax, [ebp - 0x38]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edi
call fcn.004048e1
add esp, 0x10
test eax, eax
jl 0x403dfd
mov eax, dword [esi]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x403dfd
mov eax, dword [esi]
push 1
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], edi
call fcn.004049cb
pop ecx
test eax, eax
pop ecx
jge 0x403e82
mov esi, dword [sym.imp.MSVCRT.dll_free]
push ebx
call esi
push edi
call esi
pop ecx
jmp 0x403e04
mov eax, dword [esi]
mov esi, dword [sym.imp.MSVCRT.dll_free]
push ebx
and byte [eax + edi], 0
call esi
lea eax, [ebp - 0x38]
push eax
call fcn.004048a3
pop ecx
test eax, eax
pop ecx
jge 0x403ea8
push edi
call esi
jmp 0x403e04
mov eax, edi
jmp 0x403e07
Function at 0x404136
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__lseek]
push edi
push 2
push 0xffffffffffffffea
push dword [ebp + 8]
call esi
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jl 0x40426a
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll__read]
push 0x16
push ebx
push dword [ebp + 8]
call edi
add esp, 0xc
test eax, eax
jl 0x40426a
movzx ecx, byte [ebx + 1]
xor eax, eax
mov ah, byte [ebx + 3]
mov al, byte [ebx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebx]
shl eax, 8
or eax, ecx
cmp eax, 0x6054b50
jne 0x4041a0
mov eax, dword [ebp - 4]
jmp 0x40426d
push 2
push 0
push dword [ebp + 8]
call esi
add esp, 0xc
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x40426a
mov ebx, 0x10015
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x4041c6
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
push 2
neg eax
push eax
push dword [ebp + 8]
call esi
add esp, 0xc
test eax, eax
jl 0x40426a
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
mov dword [ebp - 8], esi
je 0x40426a
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call edi
add esp, 0xc
test eax, eax
jl 0x404262
add eax, esi
mov dword [ebp + 8], eax
lea ebx, [eax - 0x16]
cmp ebx, esi
jb 0x404262
cmp byte [ebx], 0x50
jne 0x40423f
movzx edx, byte [ebx + 1]
xor ecx, ecx
mov ch, byte [ebx + 3]
mov cl, byte [ebx + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40423f
xor ecx, ecx
mov ch, byte [ebx + 0x15]
mov cl, byte [ebx + 0x14]
lea ecx, [ecx + ebx + 0x16]
cmp ecx, eax
je 0x404242
dec ebx
jmp 0x404207
mov edi, dword [ebp + 0xc]
push 5
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 8]
movsw word es:[edi], word [esi]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, ebx
pop ecx
sub eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
jmp 0x40426d
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp word [esi], bx
je 0x401502
push esi
push str.GetDriverInfoReg__s_...
push 3
call fcn.00449e4d
push esi
lea eax, [ebp - 0x610]
push str.SYSTEMCurrentControlSetControlClass_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test byte [0x4a05c8], 1
mov dword [ebp + 8], ebx
jne 0x40142e
or dword [0x4a05c8], 1
mov eax, dword [0x505634]
neg eax
sbb eax, eax
and eax, 0x100
inc eax
mov dword [0x4a05c4], eax
jmp 0x401433
mov eax, dword [0x4a05c4]
lea ecx, [ebp + 8]
push ecx
push eax
push ebx
lea eax, [ebp - 0x610]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4014ed
cmp dword [ebp + 8], ebx
je 0x4014ed
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.InfPath
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x104
call esi
test eax, eax
jne 0x4014c5
push 0x5c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
lea eax, [ebp - 0x210]
push eax
je 0x4014af
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4014c5
push 0x505738
push str._sinf_s
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push ebx
push str.DriverDate
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401502
call fcn.0044744a
push eax
push str._err_S
push 2
call fcn.00449e4d
add esp, 0xc
pop esi
pop ebx
leave
ret 0xc
Function at 0x402085
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
je 0x40217d
cmp dword [edi + 8], ebx
je 0x40217d
cmp dword [0x506370], ebx
jne 0x40217d
mov si, word [ebp + 8]
push 0x3a
pop eax
push 0x5c
mov word [ebp - 6], ax
pop eax
mov word [ebp - 4], ax
xor eax, eax
push 0x66
mov word [ebp - 2], ax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push ebx
push eax
mov word [ebp - 8], si
call fcn.00444396
add esp, 0xc
push 0x34
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x40217d
mov eax, dword [edi + 8]
push dword [eax]
lea eax, [ebp - 0x70]
push eax
movzx eax, si
push eax
push str.CheckNewDriveLetter__c_...____vn_s__c_i
push 4
call fcn.00449e4d
mov eax, dword [edi + 8]
add esp, 0x14
cmp dword [eax], ebx
jle 0x40217d
mov esi, dword [eax + ebx*4 + 4]
test esi, esi
je 0x402175
push dword [esi + 0x840]
lea ecx, [esi + 0x930]
push dword [esi + 0xc]
lea eax, [esi + 0x848]
push dword [esi + 8]
push ecx
push eax
push ebx
push str._Volumes__i__vn_s_mp_s_used_i_present_i_devnum_i
push 4
call fcn.00449e4d
add esp, 0x20
cmp dword [esi + 8], 0
je 0x402175
cmp dword [esi + 0xc], 0
je 0x402175
cmp dword [esi + 0x840], 0
je 0x402175
lea eax, [ebp - 0x70]
push eax
lea eax, [esi + 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402186
mov eax, dword [edi + 8]
inc ebx
cmp ebx, dword [eax]
jl 0x402119
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, esi
call fcn.00406371
mov ecx, dword [0x508064]
push 1
push dword [esi + 0x14]
call fcn.0040788c
test eax, eax
je 0x4021af
push 1
mov ecx, eax
call fcn.0040abaa
call fcn.00435a10
cmp dword [0x49db08], 0
je 0x4021d5
mov ecx, dword [0x508064]
push 0
push dword [esi + 0x10]
call fcn.0040788c
test eax, eax
je 0x4021d5
push 1
mov ecx, eax
call fcn.0040abaa
lea eax, [esi + 0x18]
jmp 0x40217f
Function at 0x4028bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push dword [ebp + 8]
call fcn.00401cf7
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x4029ad
push ebx
push edi
lea edi, [esi + 0x10a8]
mov dword [ebp + 8], eax
cmp word [edi], ax
jne 0x40295a
cmp word [esi + 0xc30], ax
je 0x40295a
mov ebx, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
push edi
lea eax, [esi + 0xc38]
push eax
call ebx
test eax, eax
jne 0x40295a
push 0x44f2ec
lea eax, [esi + 0xc30]
push eax
call fcn.00427832
test eax, eax
je 0x40295a
lea eax, [esi + 0xc30]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x44f0b8
push 0x44f2ec
lea eax, [ebp - 0x208]
push eax
call fcn.00428504
push 0x104
push edi
lea eax, [ebp - 0x200]
push eax
call ebx
cmp word [edi], 0
mov ebx, dword [ebp + 0xc]
je 0x402972
push edi
call fcn.0042962e
mov dword [ebx], eax
mov dword [ebp + 8], 1
lea eax, [esi + 0x13b0]
cmp word [eax], 0
je 0x40298d
push eax
call fcn.0042962e
mov ecx, dword [ebp + 8]
inc dword [ebp + 8]
mov dword [ebx + ecx*4], eax
add esi, 0x1330
cmp word [esi], 0
je 0x4029a8
push esi
call fcn.0042962e
mov ecx, dword [ebp + 8]
inc dword [ebp + 8]
mov dword [ebx + ecx*4], eax
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop esi
leave
ret 0xc