joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c774
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x50c7cf
mov edi, dword [ebp + 0xc]
test edi, 0xffff0000
jne 0x50c799
sub edi, dword [ebx + esi + 0x10]
jmp 0x50c7ea
mov ecx, dword [ebx + esi + 0x20]
xor eax, eax
add ecx, esi
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp dword [ebx + esi + 0x18], eax
jbe 0x50c7cf
mov eax, dword [ecx + eax*4]
add eax, esi
push edi
push eax
call fcn.004fce90
pop ecx
pop ecx
test eax, eax
je 0x50c7d8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x50c7ad
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x50c7cf
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx edi, word [eax + esi]
cmp edi, 0xffffffff
je 0x50c7cf
cmp edi, dword [ebx + esi + 0x14]
jae 0x50c7cf
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x50c7d1
Function at 0x50ddc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x48]
lea esi, [ebx + 0x28]
mov edx, dword [ebx + 4]
add eax, 0x28
mov ecx, dword [ebx]
add eax, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
test edx, edx
jne 0x50de13
cmp ecx, 0x20
jae 0x50de13
mov edi, dword [ebp + 8]
mov ebx, dword [ebx + 0x18]
add ebx, 0x165667c5
mov edi, dword [edi + 0x1c]
adc edi, 0x27d4eb2f
jmp 0x50deaa
push dword [ebx + 0x24]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x12
push dword [ebx + 0x24]
push dword [ebx + 0x20]
call fcn.0050bf3c
push 0xc
push dword [ebx + 0x1c]
mov edi, eax
mov esi, edx
push dword [ebx + 0x18]
call fcn.0050bf3c
push 7
push dword [ebx + 0x14]
add edi, eax
push dword [ebx + 0x10]
adc esi, edx
call fcn.0050bf3c
push 1
push dword [ebx + 0xc]
add edi, eax
push dword [ebx + 8]
adc esi, edx
call fcn.0050bf3c
add esp, 0x30
add edi, eax
adc esi, edx
push esi
push edi
call fcn.00505ce8
add esp, 0x10
push edx
push eax
call fcn.00505ce8
add esp, 0x10
push edx
push eax
call fcn.00505ce8
add esp, 0x10
push edx
push eax
call fcn.00505ce8
mov esi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edi, edx
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov edx, dword [ebp - 0x10]
add ebx, ecx
lea ecx, [esi + 8]
adc edi, edx
jmp 0x50df04
push 0x1b
push esi
call fcn.005b54c8
push edx
push eax
push 0
push 0
call fcn.004fb698
add esp, 0x14
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.0050bf3c
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.004fcff8
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
mov edi, edx
adc edi, 0x85ebca77
add esi, 8
add ecx, 8
mov dword [ebp - 8], ecx
cmp ecx, eax
jbe 0x50deb3
lea ecx, [esi + 4]
mov dword [ebp - 0x10], ecx
cmp ecx, eax
ja 0x50df67
push 0x17
push esi
call fcn.004fb7e4
pop ecx
mov ecx, eax
mov eax, 0x9e3779b1
mul ecx
mov esi, eax
mov eax, 0x85ebca87
mul ecx
add esi, edx
xor eax, ebx
xor esi, edi
push esi
push eax
call fcn.0050bf3c
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.004fcff8
mov esi, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov edi, edx
adc edi, 0x165667b1
cmp esi, eax
jae 0x50dfab
movzx eax, byte [esi]
push 0xb
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.004fcff8
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.0050bf3c
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.004fcff8
inc esi
mov ebx, eax
mov edi, edx
cmp esi, dword [ebp - 4]
jb 0x50df6b
push 0xc2b2ae3d
xor eax, eax
mov ecx, edi
push 0x27d4eb4f
shr ecx, 1
xor eax, edi
xor ecx, ebx
push eax
push ecx
call fcn.004fcff8
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.004fcff8
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
leave
ret
Function at 0x5b24d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebx + ecx]
mov dword [ebp - 4], eax
cmp ecx, 0x20
jb 0x5b2637
add eax, 0xffffffe0
mov dword [ebp - 0x20], eax
mov eax, esi
add eax, 0xadc0b5d6
mov dword [ebp - 0x14], eax
mov eax, edi
adc eax, 0x60ea27ee
mov dword [ebp - 0x10], eax
mov eax, esi
add eax, 0x27d4eb4f
mov dword [ebp - 0xc], eax
mov eax, edi
adc eax, 0xc2b2ae3d
mov dword [ebp - 8], eax
mov eax, esi
add eax, 0x7a143579
mov dword [ebp - 0x18], eax
mov eax, edi
adc eax, 0x61c8864e
mov dword [ebp - 0x1c], eax
push ebx
call fcn.005b54c8
push edx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004fb698
add ebx, 8
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 0x10], edx
call fcn.005b54c8
push edx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004fb698
add ebx, 8
mov dword [ebp - 0xc], eax
push ebx
mov dword [ebp - 8], edx
call fcn.005b54c8
push edx
push eax
push edi
push esi
call fcn.004fb698
add ebx, 8
mov esi, eax
push ebx
mov edi, edx
call fcn.005b54c8
add esp, 0x40
push edx
push eax
push dword [ebp - 0x1c]
invalid
invalid
Function at 0x401120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ecx, 0xe18
test eax, eax
je 0x401241
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401241
cmp eax, edx
jae 0x401241
mov ebx, 0x6a08
mov eax, 0x4d4873ed
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401150
mov ebx, 0xce
jmp 0x401170
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401170
inc edi
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x4011a0
add edi, 2
cmp edi, 0x1eef
jl 0x401180
mov edi, dword [ebp + 8]
sub dword [ebp + 0xc], edi
mov esi, 0x542a
mov eax, 0x4fec04ff
imul esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011b3
mov edx, 0xbc
mov ecx, 0x5316
lea esi, [edx - 0x65]
mov eax, 0x19
jmp 0x4011e0
cmp eax, 0xbc
cmovg eax, edx
dec ecx
jne 0x4011e0
mov ecx, 0x5d5f
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011f0
mov eax, 0x3ac2
mov ecx, 0x8e
nop
cmp ebx, ecx
cmovl ebx, ecx
dec eax
jne 0x401210
mov eax, 0x4387
mov ecx, 0xff
cmp esi, ecx
cmovg esi, ecx
dec eax
jne 0x401222
mov edx, dword [ebp + 0xc]
xor ecx, ecx
test edx, edx
je 0x401241
mov al, byte [ecx + edi + 1]
add al, 0x79
xor byte [ecx + edi], al
inc ecx
cmp ecx, edx
jb 0x401233
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4034b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40350d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x4034c0
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x10001000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x10001027
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x110
push ebx
push esi
push edi
push 0x104
call fcn.100011f5
push 0x44
pop ebx
push ebx
mov dword [ebp + 0x74], eax
xor esi, esi
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.10001260
push 0x10
lea eax, [ebp + 0x44]
push esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.10001260
push str.C:Documents_and_SettingsAll_UsersApplication_DataUninstall_Informationkernl5c.exe
push dword [ebp + 0x74]
call fcn.100012e0
push dword [ebp + 0x74]
call fcn.10001000
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
test al, al
je 0x100010a5
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp + 0x44]
call edi
push dword [ebp + 0x48]
call edi
push ebx
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.10001260
push 0x10
lea eax, [ebp + 0x34]
push esi
push eax
mov dword [ebp - 0x54], ebx
call fcn.10001260
push str.C:Documents_and_SettingsAll_UsersApplication_DataUninstall_Informationwinc8cit32c.exe
push dword [ebp + 0x74]
call fcn.100012e0
push dword [ebp + 0x74]
call fcn.10001000
add esp, 0x24
test al, al
je 0x100010fd
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp + 0x34]
call edi
push dword [ebp + 0x38]
call edi
lea eax, [ebp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp + 0x68], 2
je 0x1000111c
cmp word [ebp + 0x68], 4
je 0x1000111c
cmp word [ebp + 0x68], 6
jne 0x1000117d
push ebx
lea eax, [ebp - 0x98]
push esi
push eax
call fcn.10001260
push 0x10
lea eax, [ebp + 0x54]
push esi
push eax
mov dword [ebp - 0x98], ebx
call fcn.10001260
push str.C:Documents_and_SettingsAll_UsersApplication_DataUninstall_Informationwinc8cachec.exe
push dword [ebp + 0x74]
call fcn.100012e0
push dword [ebp + 0x74]
call fcn.10001000
add esp, 0x24
test al, al
je 0x1000117d
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x98]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp + 0x54]
call edi
push dword [ebp + 0x58]
call edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x78
leave
ret

Function at 0x10001188
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b040]
jne 0x10001192
repz ret
jmp fcn.100016c8
Function at 0x100060d5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10001fa1
xor ebx, ebx
cmp dword [0x1000c70c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x100061aa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x10006115
xor eax, eax
jmp 0x1000626e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000610e
push eax
call fcn.10001f3e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000c70c], eax
call esi
push eax
call fcn.10001f3e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000c710], eax
call esi
push eax
call fcn.10001f3e
mov dword [0x1000c714], eax
lea eax, [ebp - 8]
push eax
call fcn.10001cff
test eax, eax
pop ecx
pop ecx
je 0x10006178
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10004590
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x100061aa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10001f3e
cmp eax, ebx
pop ecx
mov dword [0x1000c71c], eax
je 0x100061aa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10001f3e
pop ecx
mov dword [0x1000c718], eax
mov eax, dword [0x1000c718]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10006223
cmp dword [0x1000c71c], esi
je 0x10006223
push eax
call fcn.10001faa
pop ecx
call eax
cmp eax, ebx
je 0x100061f0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1000c71c]
call fcn.10001faa
pop ecx
call eax
test eax, eax
je 0x100061f0
test byte [ebp - 0x18], 1
jne 0x10006223
lea eax, [ebp - 0xc]
push eax
call fcn.10001d36
test eax, eax
pop ecx
je 0x1000620b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10004590
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1000621a
or dword [ebp + 0x10], 0x200000
jmp 0x10006254
or dword [ebp + 0x10], 0x40000
jmp 0x10006254
mov eax, dword [0x1000c710]
cmp eax, esi
je 0x10006254
push eax
call fcn.10001faa
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10006254
mov eax, dword [0x1000c714]
cmp eax, esi
je 0x10006254
push dword [ebp - 4]
push eax
call fcn.10001faa
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1000c70c]
call fcn.10001faa
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405d1f
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405d26
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0041e000
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 8]
push 0
push 0
push 3
push 0
push 3
push 0
push dword [esp + 0x18]
call sub.KERNEL32.dll_CreateFileW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
cmp ebx, 0xffffffff
je 0x405dca
push 0
lea eax, [esp + 0x20]
push eax
push 0xc
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x2d1080
push dword [esp + 0x30]
call sub.KERNEL32.dll_DeviceIoControl
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x405dc1
lea ebp, [esp + 8]
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 4]
jmp 0x405dd2
push dword [esp]
call fcn.00431170
add esp, 0x20
pop ebx
pop ebp
ret 4
Function at 0x4061b3
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
mov edx, 0x113
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4061ba
call fcn.004310a0
push dword [esp + 0x45c]
call fcn.00430f40
mov edx, dword [esp + 0x458]
lea ecx, [esp]
call fcn.0041e000
call fcn.00430e40
push eax
mov edx, 0x4374b4
call fcn.00430f90
mov edx, dword [esp + 4]
call fcn.00430f90
lea eax, [esp + 8]
push eax
call fcn.00430eb0
push 0
push 0
push 3
push 0
push 3
push 0
push dword [esp + 0x1c]
call sub.KERNEL32.dll_CreateFileW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
cmp ebx, 0xffffffff
je 0x4063c3
mov edx, 0x434032
lea ecx, [esp + 0xc]
call fcn.0041e008
lea eax, [esp + 0x10]
lea eax, [esp + 0x1c]
push 0
lea eax, [esp + 0x448]
push eax
push 0x423
lea eax, [esp + 0x28]
push eax
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push dword [esp + 0x24]
call sub.KERNEL32.dll_DeviceIoControl
mov dword [esp + 0x440], eax
cmp dword [esp + 0x440], 0
je 0x4063c3
lea ebp, [esp + 0x1c]
movsx ebx, word [ebp + 0x1c]
push ebx
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4062b1
jmp 0x406358
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4062ce
mov edx, str.SCSI
lea ecx, [esp + 0x10]
call fcn.0041e008
jmp 0x406358
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4062e8
mov edx, str.P_ATA
lea ecx, [esp + 0x10]
call fcn.0041e008
jmp 0x406358
mov ebx, 3
cmp ebx, dword [esp]
jne 0x406302
mov edx, str.S_ATA
lea ecx, [esp + 0x10]
call fcn.0041e008
jmp 0x406358
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40630e
jmp 0x406358
mov ebx, 5
cmp ebx, dword [esp]
jne 0x40631a
jmp 0x406358
mov ebx, 6
cmp ebx, dword [esp]
jne 0x406326
jmp 0x406358
mov ebx, 7
cmp ebx, dword [esp]
jne 0x406332
jmp 0x406358
mov ebx, 8
cmp ebx, dword [esp]
jne 0x40634c
mov edx, str.RAID
lea ecx, [esp + 0x10]
call fcn.0041e008
jmp 0x406358
mov ebx, 0x7f
cmp ebx, dword [esp]
jne 0x406358
jmp 0x406358
pop eax
mov edx, str.HDD_Controller:__t
lea ecx, [esp + 0x448]
call fcn.0041e008
lea ebp, [esp + 0x1c]
mov ebx, dword [ebp + 0x10]
and ebx, ebx
jle 0x4063c3
mov edx, dword [esp + 0x448]
call fcn.00430e40
push eax
call fcn.00430f90
call fcn.00430e40
push eax
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0x30]
mov ebx, eax
lea ebp, [esp + 0x30]
add ebx, dword [ebp + 0x10]
push ebx
call fcn.00430010
pop eax
mov edx, 0x434176
call fcn.00430f90
lea eax, [esp + 0x44c]
push eax
call fcn.00430eb0
push dword [esp + 0xc]
mov edx, 0x434032
pop ecx
call fcn.00431020
jne 0x406406
mov edx, dword [esp + 0x448]
call fcn.00430e40
push eax
call fcn.00430f90
mov edx, str.BusTyp:__t
call fcn.00430f90
mov edx, dword [esp + 0x10]
call fcn.00430f90
lea eax, [esp + 0x44c]
push eax
call fcn.00430eb0
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [esp + 0x448]
call fcn.00430e40
push eax
call fcn.00430f90
pop eax
push eax
call fcn.00430e80
pop edx
add eax, edx
jmp 0x406437
push dword [esp + 4]
call fcn.00431170
push dword [esp]
call fcn.00431170
push dword [esp + 0x448]
call fcn.00431170
push dword [esp + 0xc]
call fcn.00431170
add esp, 0x44c
pop ebx
pop ebp
ret 4
Function at 0x40b604
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40b60a
call fcn.004310a0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0041e000
mov dword [esp + 4], 0xffffffff
mov edx, dword [esp]
xor ecx, ecx
call fcn.00431020
jne 0x40b7a5
lea eax, [esp + 8]
push eax
mov ebx, dword [esp + 0x34]
or ebx, 0x10008
push ebx
push 0
push dword [esp + 0xc]
push dword [esp + 0x3c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x40b7a5
call fcn.00430e40
push eax
push eax
push 0x200
call fcn.0041e500
lea eax, [esp + 0x10]
push eax
call fcn.00430eb0
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x40b6a4
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40b6a4
mov eax, 1
jmp 0x40b6a6
xor eax, eax
and eax, eax
je 0x40b79c
mov dword [esp + 0x14], 0x200
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x20]
push dword [esp + 0x30]
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov dword [esp + 4], eax
inc dword [esp + 0x18]
mov ebx, dword [esp + 4]
cmp ebx, 0x103
jne 0x40b76e
push str.Advapi32.dll
push 0xffffffff
call fcn.0041fd4f
mov dword [esp + 0x1c], eax
push str.RegDeleteKeyExW
push dword [esp + 0x20]
call fcn.0041fd8c
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x40b741
push 0
push dword [esp + 0x34]
mov eax, dword [esp + 8]
push eax
push dword [esp + 0x38]
push dword [esp + 0x30]
call fcn.0041fdf9
mov dword [esp + 4], eax
jmp 0x40b75b
mov eax, dword [esp]
push eax
push dword [esp + 0x30]
push str.RegDeleteKeyW
push dword [esp + 0x28]
call fcn.0041fcb2
mov dword [esp + 4], eax
push dword [esp + 0x1c]
call fcn.0041fbd6
mov dword [esp + 0x10], 1
jmp 0x40b797
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x40b797
dec dword [esp + 0x18]
push dword [esp + 0xc]
push dword [esp + 0x34]
push dword [esp + 0x10]
call fcn.0040b604
and eax, eax
je 0x40b797
mov dword [esp + 4], 0
jmp 0x40b68d
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x40b7b6
mov eax, 1
jmp 0x40b7bc
xor eax, eax
jmp 0x40b7bc
push dword [esp + 0xc]
call fcn.00431170
push dword [esp]
call fcn.00431170
add esp, 0x24
pop ebx
ret 0xc

Function at 0x40b7d4
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0041e000
push dword [esp]
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
jmp 0x40b7f8
push dword [esp]
call fcn.00431170
add esp, 8
ret 4
Function at 0x40d7c6
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
call fcn.004310a0
push dword [esp + 0x10]
call fcn.00430f40
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0041e000
call fcn.00430e40
push eax
push eax
push 0x104
call fcn.0041e500
lea eax, [esp + 8]
push eax
call fcn.00430eb0
push 0
push 0
push 0
push 0
push 0
push 0x104
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call sub.KERNEL32.dll_GetVolumeInformationW
mov edx, dword [esp + 4]
call fcn.00430e40
push eax
call fcn.00430f90
pop eax
push eax
call fcn.00430e80
pop edx
add eax, edx
jmp 0x40d850
push dword [esp + 4]
call fcn.00431170
push dword [esp]
call fcn.00431170
add esp, 8
ret 4
Function at 0x413eb6
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x413ebe
call fcn.004310a0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov dword [esp + 4], eax
call fcn.00430e40
push eax
push eax
push dword [esp + 0xc]
call fcn.0041e500
lea eax, [esp + 0x10]
push eax
call fcn.00430eb0
mov eax, dword [esp + 0xc]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 4]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x18]
jl 0x413fb2
mov edx, dword [esp]
push dword [edx]
call fcn.0042ec67
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
inc ebx
mov eax, ebx
inc eax
mov edx, dword [esp]
lea edx, [edx]
push edx
push eax
call fcn.0042ee9d
call fcn.00430e40
push eax
push eax
call fcn.00430e40
push eax
push eax
push 2
push dword [esp + 0x24]
call fcn.0042ff90
call fcn.00430e92
add dword [esp], edx
call fcn.0041e3c0
mov ebx, dword [esp + 0x20]
inc ebx
mov edx, dword [esp + 4]
mov ebp, dword [edx]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00430eb0
add dword [esp + 0x10], 8
inc dword [esp + 0x18]
jno 0x413f3a
mov eax, dword [esp + 0x14]
jmp 0x413fba
push dword [esp + 0xc]
call fcn.00431170
add esp, 0x20
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41539c
Capabilities:
Delete registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4153a2
call fcn.004310a0
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.0041e000
mov edx, dword [esp + 0x34]
lea ecx, [esp + 4]
call fcn.0041e000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
call fcn.0041e000
call fcn.00430e40
push eax
push eax
push 1
push dword [esp + 0xc]
call fcn.0041e7e0
call fcn.00430ff0
mov edx, 0x434770
call fcn.00431060
mov ecx, eax
call fcn.00431020
je 0x41542e
call fcn.00430e40
push eax
push eax
push dword [esp + 8]
call fcn.0041f200
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0041e550
lea eax, [esp + 4]
push eax
call fcn.00430eb0
push dword [esp + 8]
mov edx, 0x434032
pop ecx
call fcn.00431020
je 0x415467
lea eax, [esp + 0x10]
push eax
mov ebx, dword [esp + 0x30]
or ebx, 0xf003f
push ebx
push 0
push dword [esp + 0xc]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41549d
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4154d1
mov eax, dword [esp + 4]
push eax
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegDeleteValueW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4154c9
mov dword [esp + 0x1c], 1
jmp 0x4154d1
mov dword [esp + 0x1c], 0
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0x1c]
jmp 0x4154e2
push dword [esp + 4]
call fcn.00431170
push dword [esp + 8]
call fcn.00431170
push dword [esp]
call fcn.00431170
add esp, 0x20
pop ebx
ret 0x14