joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402591
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.004053e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4025d6
push ebx
call fcn.00404ef0
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4025ed
mov eax, 0x41a2ac
push eax
push 1
mov ebx, 0x130
call fcn.004059e0
add esp, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402642
mov eax, dword [ebp - 4]
test eax, eax
je 0x40263d
push eax
mov ebx, eax
call fcn.00401606
inc eax
push eax
call fcn.00404ef6
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40264c
mov eax, 0x41a2ac
jmp 0x40264c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40265d
push ebx
call fcn.00404ef0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x40366c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4036b3
cmp ebx, 0x20
je 0x4036b3
cmp ebx, 0xffffffe0
je 0x4036b3
jne 0x4036bc
add eax, 1
cmp esi, eax
je 0x4036c9
jne 0x403698
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4036cd
jne 0x403694
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4
Function at 0x4036e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x4037a2
test ecx, ecx
je 0x4037a2
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x4037a2
test ebx, ebx
je 0x4037a2
mov ebx, eax
add ebx, edx
je 0x4037a2
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x4037a2
cmp dword [edx + eax + 0x14], 0
je 0x4037a2
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x4037a2
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x403792
test dl, dl
je 0x40378e
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x403792
add edi, 2
add esi, 2
test dl, dl
jne 0x403772
xor eax, eax
jmp 0x403797
sbb eax, eax
or eax, 1
test eax, eax
je 0x4037ae
inc ebp
cmp ebp, dword [esp + 4]
jb 0x40375f
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x4046a4
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4046d2
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4046c9
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4046c1
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4046f3
mov esp, ebp
pop ebp
ret

Function at 0x4046f7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x404763
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x404790
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40477f
xor ecx, eax
xor edx, ebx
dec edi
jne 0x404770
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x4047b6
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x404757
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4047e2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4059f0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x294
lea eax, [esp + 0x104]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x405a42
lea ecx, [esp + 4]
push 0x104
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x405a3d
lea edx, [esp + 4]
push edx
call dword [0x439ba4]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004062d0
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x294
ret

Function at 0x405dc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x405dde
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x405dd3
pop esi
ret
Function at 0x414bd6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x414c04
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x414c22
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00414b3c
jmp 0x414c22
mov eax, dword [esi + 0x14]
test eax, eax
je 0x414c22
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00414b3c
test edi, edi
mov eax, edi
jne 0x414c0c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x41c230
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x41c252
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c248
mov eax, 1
add ebx, ebx
jne 0x41c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c260
jne 0x41c27c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c260
xor ecx, ecx
sub eax, 3
jb 0x41c290
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c302
mov ebp, eax
add ebx, ebx
jne 0x41c29b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c2cc
inc ecx
add ebx, ebx
jne 0x41c2b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c2ad
jne 0x41c2c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c2ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c2ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c2dd
jmp 0x41c24e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c2ec
add edi, ecx
jmp 0x41c24e
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c30a
cmp byte [edi], 5
jne 0x41c30a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41c30f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c387
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21be8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c33c
mov ecx, edi
jns 0x41c36b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21bec]
or eax, eax
je 0x41c381
mov dword [ebx], eax
add ebx, 4
jmp 0x41c359
call dword [esi + 0x21bf0]
popal
jmp 0x401150

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021b0
push 0x4021b4
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10004340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push ecx
call fcn.100045a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
or eax, 0xf003f
push eax
push 0
push str.SOFTWAREIntelIRSTVolumeFlushPolicies
push 0x80000002
call esi
test eax, eax
je 0x100043a3
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREIntelIRSTVolumeFlushPolicies
push 0x80000002
call esi
test eax, eax
je 0x100043a3
lea eax, [ebp - 4]
push eax
push str.SOFTWAREIntelIRSTVolumeFlushPolicies
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100043c5
push 4
push dword [ebp + 0x10]
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100043d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
push ecx
call fcn.100045a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
or eax, 0xf003f
push eax
push 0
push str.SOFTWAREIntelIRSTVolumeFlushPolicies
push 0x80000002
call esi
test eax, eax
je 0x1000441d
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREIntelIRSTVolumeFlushPolicies
push 0x80000002
call esi
test eax, eax
jne 0x10004436
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push ecx
mov esi, edx
call fcn.100045a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
or eax, 0x20019
push eax
push 0
push esi
push 0x80000002
call edi
test eax, eax
je 0x10004494
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call edi
test eax, eax
jne 0x10004592
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [ebp + 0x14]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
test eax, eax
je 0x100044d5
cmp dword [ebx], esi
jae 0x100044d5
push dword [ebp - 8]
mov edi, 0xea
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x10004587
test eax, eax
je 0x10004585
push dword [ebx]
push edi
push eax
call fcn.10057490
add esp, 0xc
inc esi
mov dword [ebp - 4], esi
push esi
call fcn.10054c47
mov edi, eax
add esp, 4
mov dword [ebp - 0xc], edi
test edi, edi
je 0x1000456e
push esi
push 0
push edi
call fcn.10057490
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x10004551
push dword [ebx]
push eax
push dword [ebp + 0x10]
call fcn.10057490
mov esi, dword [ebp - 4]
add esp, 0xc
push esi
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.10057670
add esp, 0xc
mov dword [ebx], esi
push dword [ebp - 0xc]
call fcn.10055a53
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov edi, 0x7a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004c6c0
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, dword [0x10087590]
test cl, 1
jne 0x1004c6de
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
or ecx, 1
mov dword [0x10087590], ecx
mov dword [0x10087594], eax
test cl, 2
jne 0x1004c6f6
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
or ecx, 2
mov dword [0x10087590], ecx
mov dword [0x10087598], eax
test cl, 4
jne 0x1004c70e
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
or ecx, 4
mov dword [0x10087590], ecx
mov dword [0x1008759c], eax
cmp byte [0x100871bf], 0
jne 0x1004c817
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.IoctlLog.dll
call esi
mov dword [0x100875a0], eax
test eax, eax
jne 0x1004c756
push str.IoctlNet.dll
call esi
mov dword [0x100875a0], eax
test eax, eax
jne 0x1004c756
push str.IoctlSim.dll
call esi
mov dword [0x100875a0], eax
test eax, eax
je 0x1004c80e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ismInit
push eax
call esi
push str.ismExit
push dword [0x100875a0]
mov dword [0x1008757c], eax
call esi
push str.deviceIoControlSimEx
push dword [0x100875a0]
mov dword [0x10087578], eax
call esi
push str.CreateFileASimEx
push dword [0x100875a0]
mov dword [0x10087594], eax
call esi
push str.CloseHandleSimEx
push dword [0x100875a0]
mov dword [0x10087598], eax
call esi
mov ecx, dword [0x1008757c]
mov dword [0x1008759c], eax
test ecx, ecx
je 0x1004c80e
cmp dword [0x10087578], 0
je 0x1004c80e
cmp dword [0x10087594], 0
je 0x1004c80e
cmp dword [0x10087598], 0
je 0x1004c80e
test eax, eax
je 0x1004c80e
call ecx
mov eax, dword [0x1008757c]
mov dword [0x100874a0], eax
mov eax, dword [0x10087578]
mov dword [0x100874a4], eax
mov eax, dword [0x10087598]
mov dword [0x10087568], eax
mov eax, dword [0x1008759c]
mov dword [0x1008756c], eax
mov eax, dword [0x10087594]
mov dword [0x10087564], eax
mov byte [0x100871bf], 1
pop esi
ret
mov byte [0x100871bf], 1
ret
Function at 0x1004d3c0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10081010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
push 0x88
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xd0]
push 0
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], edi
call fcn.10057490
push 0x48c0
call fcn.10054c47
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1004d44b
push 0
lea eax, [ebp - 0x44]
push eax
push 0x48c0
push ebx
push 0
push 0
push 0x70050
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1004d460
push ebx
call fcn.10055a53
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054bb7
mov esp, ebp
pop ebp
ret 0x18
push 0
lea eax, [ebp - 0x44]
push eax
push 0x28
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x700a0
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004d442
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
cmp dword [ebx + 4], 0
mov dword [esi], 0
je 0x1004d551
xor edx, edx
mov dword [edi], 0
mov dword [edi + 4], 0
cmp dword [ebx + 4], edx
jbe 0x1004d4da
lea eax, [ebx + 0x48]
mov ecx, dword [eax]
cmp ecx, dword [esi]
jbe 0x1004d4cc
mov dword [esi], ecx
lea edi, [ebp - 0xd8]
lea esi, [eax - 0x18]
mov ecx, 0x24
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x40]
inc edx
add eax, 0x90
cmp edx, dword [ebx + 4]
jb 0x1004d4b1
mov edi, dword [ebp - 0x38]
cmp dword [esi], 0
je 0x1004d551
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xc4]
push 0
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xd0]
add ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [edi], ecx
mov esi, ecx
adc eax, edx
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov edi, dword [edi + 4]
mov eax, dword [eax]
push eax
push edi
push esi
mov dword [ebp - 0x30], eax
call fcn.100575f0
mov ecx, eax
or ecx, edx
je 0x1004d537
sub esi, eax
mov eax, dword [ebp - 0x38]
sbb edi, edx
add esi, dword [ebp - 0x30]
adc edi, 0
mov dword [eax], esi
mov dword [eax + 4], edi
mov ecx, dword [ebp - 0x48]
mov dword [ecx], 0
cmp dword [ebx], 1
jne 0x1004d551
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, 0x4000
mov dword [ecx], eax
push ebx
call fcn.10055a53
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.10054bb7
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1004d5f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
push esi
push edi
push 0
push eax
push 8
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x7405c
push dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1004d63a
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
mov esi, dword [ebp - 0xc]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.1004d3c0
test eax, eax
je 0x1004d6bc
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
je 0x1004d6ca
mov eax, esi
or eax, edi
je 0x1004d6bc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp ecx, edi
jb 0x1004d67d
ja 0x1004d6bc
cmp eax, esi
ja 0x1004d6bc
sub esi, eax
mov eax, dword [ebp - 4]
sbb edi, ecx
test edi, edi
ja 0x1004d69e
jb 0x1004d68e
cmp esi, eax
jae 0x1004d69e
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
jmp 0x1004d6a3
sub esi, eax
sbb edi, 0
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
jb 0x1004d6ca
mov eax, dword [ebp + 0xc]
ja 0x1004d6b3
cmp eax, esi
jbe 0x1004d6ca
sub eax, esi
mov dword [ebx], eax
sbb ecx, edi
mov dword [ebx + 4], ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1004d700
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10081010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push 0
push ecx
push 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x2d1080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004d7c3
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x214]
push str..Harddisk_uPartition_u
push 0x104
push eax
call fcn.10056889
add esp, 0x14
lea eax, [ebp - 0x20c]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1004d799
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054bb7
mov esp, ebp
pop ebp
ret 0x10
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.1004ced0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054bb7
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10054bb7
mov esp, ebp
pop ebp
ret 0x10