joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57b268
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
movsx eax, byte [ebp + 8]
push eax
push str._c:_syslinux.cfg
lea edx, [ebp - 0x20c]
push edx
call fcn.006712b0
add esp, 0xc
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x57b2a9
mov eax, 1
jmp 0x57b440
movsx edx, byte [ebp + 8]
push edx
push str._c:_syslinux_syslinux.cfg
lea ecx, [ebp - 0x20c]
push ecx
call fcn.006712b0
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x57b2e1
mov eax, 1
jmp 0x57b440
movsx edx, byte [ebp + 8]
push edx
push str._c:_boot_syslinux_syslinux.cfg
lea ecx, [ebp - 0x20c]
push ecx
call fcn.006712b0
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x57b319
mov eax, 1
jmp 0x57b440
mov dl, byte [0xd206a0]
test dl, dl
jne 0x57b33a
movsx ecx, byte [ebp + 8]
push ecx
push 0x8203ab
push 0xd206a0
call fcn.006712b0
add esp, 0xc
mov dword [ebp - 4], 0xd206a0
push dword [ebp - 4]
push str._sisolinux.cfg
lea eax, [ebp - 0x108]
push eax
call fcn.006712b0
add esp, 0xc
push dword [ebp - 4]
push str._s_syslinux.cfg
lea edx, [ebp - 0x20c]
push edx
call fcn.006712b0
add esp, 0xc
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x57b3e7
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066ebe8
add esp, 8
test eax, eax
je 0x57b3e7
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x108]
push ecx
push 0x5aad
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 0x10
mov edx, 0xa00988
or ecx, 0xffffffff
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f95c
push 1
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CopyFileA
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066ebe8
add esp, 8
test eax, eax
je 0x57b43b
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x4eaa
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 0x10
mov edx, 0xa00988
mov ecx, 6
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f95c
xor eax, eax
jmp 0x57b440
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57e714
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x61c]
test edx, edx
je 0x57e751
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x61c]
add eax, 0xc
push eax
lea edx, [ebp - 0x128]
push edx
call fcn.0066ce08
add esp, 8
jmp 0x57e76e
mov ecx, dword [ebp - 4]
push dword [ecx + 0x510]
push 0x821f58
lea eax, [ebp - 0x128]
push eax
call fcn.006712b0
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea edx, [ebp - 0x128]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
jne 0x57e7f5
call sub.KERNEL32.DLL_GetLastError
cmp eax, 5
jne 0x57e7b9
push 0x5a86
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
jmp 0x57e7d8
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x5aa4
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 0xc
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57e8ce
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00674900
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x57e864
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x57e864
push 0x4ef2
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57e8ce
push 0
lea edx, [ebp - 0x18]
push edx
push pe_nt_image_headers32
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x57e88e
mov eax, dword [ebp - 0x18]
cmp eax, 0x200
je 0x57e8c1
push 0x4ef2
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57e8ce
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57e8d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x518
push eax
push 0x4ef4
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 0xc
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462c64
add esp, 8
test eax, eax
jne 0x57e929
xor eax, eax
jmp 0x57eaf1
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x61c]
test ecx, ecx
je 0x57e954
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x61c]
add edx, 0xc
push edx
lea ecx, [ebp - 0x128]
push ecx
call fcn.0066ce08
add esp, 8
jmp 0x57e971
mov eax, dword [ebp - 4]
push dword [eax + 0x510]
push 0x821f6c
lea edx, [ebp - 0x128]
push edx
call fcn.006712b0
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x128]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x57e9f8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 5
jne 0x57e9bc
push 0x5a86
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
jmp 0x57e9db
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x5aa4
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 0xc
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57eaf1
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00674900
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x57ea6a
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x57ea6a
push 0x4e97
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57eaf1
push 0
lea edx, [ebp - 0x18]
push edx
push pe_nt_image_headers32
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_WriteFile
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x57ea94
mov eax, dword [ebp - 0x18]
cmp eax, 0x200
je 0x57eac7
push 0x4e97
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
xor eax, eax
jmp 0x57eaf1
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
push 0x4ef3
call fcn.00402b9c
pop ecx
push eax
mov eax, dword [ebp - 4]
call fcn.00640b4c
push eax
call fcn.00462ac8
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57f2e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.0066cc88
add esp, 0xc
lea edx, [ebp - 0x124]
push edx
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jge 0x57f3f0
lea ecx, [ebp - 0x124]
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
cmp edx, 2
je 0x57f358
mov ecx, dword [ebp - 0x14]
cmp ecx, 3
jne 0x57f3d1
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp + eax - 0x124]
mov byte [ebp - 0x15], dl
movsx ecx, byte [ebp - 0x15]
cmp ecx, 0x61
jl 0x57f37b
movsx eax, byte [ebp - 0x15]
cmp eax, 0x7a
jg 0x57f37b
add byte [ebp - 0x15], 0xe0
mov edx, dword [ebp - 0x14]
cmp edx, 2
jne 0x57f395
movsx ecx, byte [ebp - 0x15]
cmp ecx, 0x41
je 0x57f3df
movsx eax, byte [ebp - 0x15]
cmp eax, 0x42
je 0x57f3df
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
push ecx
mov al, byte [ebp - 0x15]
push eax
call fcn.005660c4
add esp, 0xc
test al, al
je 0x57f3df
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x510]
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jne 0x57f3d1
mov edx, dword [ebp - 8]
inc edx
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
jne 0x57f3d1
mov al, byte [ebp - 0x15]
jmp 0x57f3f2
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x124]
test cl, cl
jne 0x57f3ce
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jl 0x57f334
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x57f3f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
movsx eax, byte [ebp - 5]
push eax
push str._c:_
lea edx, [ebp - 0x1c]
push edx
call fcn.006712b0
add esp, 0xc
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x10], eax
push 0x100
push 0
push dword [ebp - 0xc]
call fcn.0066cc88
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x128]
push ecx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
push edx
push 0
push 0x100
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
call sub.KERNEL32.DLL_GetVolumeInformationA
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetErrorMode
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x586d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [0x823ab0]
mov edx, dword [0x823ab4]
xor dword [ebp + 8], eax
xor dword [ebp + 0xc], edx
cmp dword [ebp + 0x10], 0
jne 0x586e13
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x586dad
cmp eax, 0
je 0x586dcf
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
shrd eax, edx, 1
shr edx, 1
xor eax, dword [0x823aa8]
xor edx, dword [0x823aac]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jmp 0x586de1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
shrd eax, edx, 1
shr edx, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jb 0x586d97
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax*8 + 0xd2084c], edx
mov edx, dword [ebp - 8]
mov dword [eax*8 + 0xd20850], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x100
jb 0x586d87
jmp 0x586e58
cmp dword [ebp + 0x14], 0
je 0x586e58
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
xor al, byte [edx]
and al, 0xff
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
shrd eax, edx, 8
shr edx, 8
xor ecx, ecx
mov cl, byte [ebp - 1]
xor eax, dword [ecx*8 + 0xd2084c]
xor edx, dword [ecx*8 + 0xd20850]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
dec dword [ebp + 0x14]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x586e19
mov eax, dword [0x823ab0]
mov edx, dword [0x823ab4]
xor dword [ebp + 8], eax
xor dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x58d430
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 8]
dec eax
je 0x58d471
dec eax
je 0x58d457
sub eax, 2
je 0x58d482
jmp 0x58d4bb
lea edx, [ebp - 0x94]
push edx
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x58d4bb
lea edx, [ebp - 0x30]
push edx
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], ecx
jmp 0x58d4bb
mov dword [ebp - 0x70], 0x40
push 1
call fcn.0058d430
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatusEx
test eax, eax
je 0x58d4bb
cmp dword [ebp - 8], 0xffffffff
je 0x58d4bb
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
call fcn.0067499b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5a578c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
call fcn.0067997c
pop ecx
mov ebx, eax
call fcn.00677ac8
shl eax, 0x10
xor ebx, eax
push ebx
call fcn.00675708
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00675734
and al, 0xff
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], al
cmp dword [ebp - 4], 7
jne 0x5a57e1
mov eax, dword [ebp - 8]
mov dl, byte [eax + 7]
and dl, 0xf
or dl, 0x40
mov ecx, dword [ebp - 8]
mov byte [ecx + 7], dl
cmp dword [ebp - 4], 8
jne 0x5a57f9
mov eax, dword [ebp - 8]
mov dl, byte [eax + 8]
and dl, 0x3f
or dl, 0x80
mov ecx, dword [ebp - 8]
mov byte [ecx + 8], dl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x5a57b9
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x5a6da9
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x7405c
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x5a6dea
call sub.KERNEL32.DLL_GetLastError
push eax
call fcn.005a690c
pop ecx
mov dword [0xd220e0], eax
mov eax, 0xffffffff
mov edx, eax
jmp 0x5a6df0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5a6df4
Capabilities:
Get volume information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push 0
lea eax, [ebp - 0xc]
push eax
push 0x60
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0x90064
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x5a6e35
call sub.KERNEL32.DLL_GetLastError
push eax
call fcn.005a690c
pop ecx
mov dword [0xd220e0], eax
mov eax, 0xffffffff
mov edx, eax
jmp 0x5a6e53
mov eax, dword [ebp - 0x44]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
call fcn.00674900
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5ac44c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 8
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0066cc88
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x5ac48b
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, ebx
jmp 0x5ac54c
push edi
call fcn.0066c62c
pop ecx
mov esi, eax
test esi, esi
jne 0x5ac4aa
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, ebx
jmp 0x5ac54c
push esi
push edi
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
jne 0x5ac4d1
push esi
call fcn.0066c63c
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 4], ecx
jmp 0x5ac54c
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x827d2a
push esi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
jne 0x5ac4fe
push esi
call fcn.0066c63c
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, ebx
jmp 0x5ac54c
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x10]
shr ecx, 0x10
mov word [ebp - 0x10], cx
mov eax, dword [ebp - 4]
mov dx, word [eax + 0x10]
and dx, 0xffff
mov word [ebp - 0xe], dx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
shr eax, 0x10
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 4]
mov cx, word [edx + 0x14]
and cx, 0xffff
mov word [ebp - 0xa], cx
push esi
call fcn.0066c63c
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ac554
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x827d2c
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp dword [ebp - 4], 0
je 0x5ac5a0
push ebx
call fcn.0066ce38
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push 0x827d42
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
pop ebx
pop ecx
pop ebp
ret

Function at 0x5ac5a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWARE_aheadNero___Burning_RomInfo
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp dword [ebp - 4], 0
je 0x5ac5fb
lea edx, [ebp + 0xc]
lea eax, [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
push ecx
push eax
push 0
push str.Serial5
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x5ac5f2
mov ebx, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5b1994
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x9e], 0
je 0x5b1abb
mov edx, dword [esi]
mov eax, edx
sub eax, 0x200
je 0x5b19c0
add eax, 0xffff4500
sub eax, 2
jae 0x5b19c4
mov al, 1
jmp 0x5b19c6
xor eax, eax
test al, al
je 0x5b1a6a
sub edx, 0x200
je 0x5b19e3
sub edx, 0xbb00
je 0x5b19f3
dec edx
je 0x5b1a08
jmp 0x5b1a25
mov eax, dword [esi + 4]
test al, 8
setne byte [esp]
test al, 4
setne al
jmp 0x5b1a2b
mov ax, word [esi + 4]
cmp ax, 0x11
sete byte [esp]
cmp ax, 4
sete al
jmp 0x5b1a2b
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
setl byte [esp]
push 4
call sub.USER32.DLL_GetKeyState
test ax, ax
setl al
jmp 0x5b1a2b
mov byte [esp], 0
xor eax, eax
xor edi, edi
cmp byte [esp], 0
je 0x5b1a36
or edi, 8
test al, al
je 0x5b1a3d
or edi, 4
mov dl, 1
mov eax, ebx
call sym.UltraISO.exe__Taocntrr_TtaoController_DropEffectsSource_qqro
mov dword [esp + 0xc], eax
lea edx, [esp + 0xc]
mov eax, edi
call sym.UltraISO.exe__Taocntrr_KeyStateToDropEffect_qqriri
mov edx, dword [esp + 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x9c]
mov edx, dword [ebx + 0x34]
mov word [edx + 0x7a], ax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebx + 0x38]
push eax
mov eax, dword [ebx + 0x60]
push eax
call sub.USER32.DLL_CallWindowProcA
mov dword [esi + 0xc], eax
cmp dword [esi], 0x200
jne 0x5b1abb
lea edx, [esp + 1]
mov eax, dword [esi + 8]
call fcn.005cbf64
lea eax, [esp + 1]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.USER32.DLL_ClientToScreen
lea eax, [esp + 1]
call fcn.00638bb4
test eax, eax
jne 0x5b1abb
mov eax, ebx
call sym.UltraISO.exe__Taocntrr_TtaoController_OleDragDrop_qqrv
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5c728c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x828df8
call fcn.0066d220
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.0066c62c
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x5c7301
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x5c7301
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.0066c64c
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x5c7301
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x5c731e
cmp dword [ebp - 0x34], 0
je 0x5c731e
mov edx, dword [ebp - 0x34]
jmp 0x5c7323
mov edx, 0x828a6c
lea eax, [ebp - 4]
call fcn.0067d2d0
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.0066c63c
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0067d4ec
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0067d4bc
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x5c73a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ddfa4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0xd22230
cmp dword [edi], 0
jne 0x5de020
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0xd2222c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x829b94
mov ecx, 2
call fcn.005f37b8
mov edx, 0x5ddf7c
lea eax, [esi + 5]
call fcn.005ddf9c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.005ddf9c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x5ddff5
mov dword [0xd2222c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5e215c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.005f5520
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x5e2175
test al, 0x10
jne 0x5e2179
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret