joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421fb0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop es
xchg ecx, eax
popfd
xor byte [ebx], al
pop es
pop es
pop ebx
invalid

Function at 0x42c2ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42c30c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42c326
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42c321
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42c32b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42c399
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42c3e2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42c357
inc dword [ebp - 0xc]
jmp 0x42c36f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42c36f
cmp dword [ebp - 0xc], 0
jle 0x42c36f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42c391
xor eax, eax
jmp 0x42c38d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42c38c
mov eax, esi
jmp 0x42c3e5
inc eax
cmp eax, ecx
jle 0x42c379
inc esi
cmp esi, dword [ebp - 8]
jl 0x42c343
jmp 0x42c3e2
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42c3e2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42c3ba
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42c3dc
xor eax, eax
jmp 0x42c3d8
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42c3d7
mov eax, esi
jmp 0x42c3e5
inc eax
cmp eax, ecx
jle 0x42c3c4
inc esi
cmp esi, dword [ebp - 8]
jl 0x42c3a2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c6490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4c6498
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4ed6e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6ea
ret

Function at 0x501d98
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6cb35c
test edx, edx
jne 0x501db7
xor eax, eax
jmp 0x501ed5
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x501dd4
push esi
push edx
push eax
call fcn.00501ef8
add esp, 0xc
jmp 0x501ed5
push esi
push edx
push eax
call fcn.005021b8
add esp, 0xc
jmp 0x501ed5
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c9cec
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret

Function at 0x5cd14c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6d6828
mov eax, esi
mov edx, 8
test al, 1
je 0x5cd168
shr eax, 1
xor eax, 0xedb88320
jmp 0x5cd16a
shr eax, 1
dec edx
jne 0x5cd15b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5cd154
pop esi
ret

Function at 0x5cd180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6d6824], 0
jne 0x5cd1aa
call fcn.005cd14c
mov dword [esp], 0x6d6824
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5cd1d4
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6d6828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5cd1b0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x605824
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cdf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605847
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cdf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x60aee0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x6b3568
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x6b358d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40b42f
pop dword [ebp - 0x18]
mov eax, 0x40b42f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc6cf007e
sub dword [ebp - 0x28], 0x787cbb33
mov dword [ebp - 0x24], 0x67b47230
sub dword [ebp - 0x24], 0x358125eb
mov dword [ebp - 0x20], 0x74eb355d
add dword [ebp - 0x20], 0xd7610ed1
mov dword [ebp - 0x1c], 0x95fb0714
add dword [ebp - 0x1c], 0x6a04f8ec
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf347269e
add dword [ebp - 0x28], 0x812b42b8
mov dword [ebp - 0x24], 0x9c6bd8f3
sub dword [ebp - 0x24], 0x5aff777e
mov dword [ebp - 0x20], 0x3427f607
sub dword [ebp - 0x20], 0xd0b8899b
mov dword [ebp - 0x1c], 0x8f44b6cc
sub dword [ebp - 0x1c], 0x8f44b6cc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37917
push 0
call eax
mov ecx, 0x3b07
mov esi, eax
mov edi, 0x8aa81fb
sub edi, 0x868c1fb
add edi, dword [ebp - 0x18]
mov edx, 0x64913dea
sub edx, 0x4db47306
add dword [ebp - 0x10], 0x65400b63
mov ebx, dword [edi]
add dword [ebp - 0x10], ebx
xor ebx, edx
mov dword [esi], ebx
add dword [ebp - 8], 0xcc9c07bc
add esi, 4
add edi, 0xa568dae6
add edi, 0x5a97251e
loop 0x40b53c
add eax, 0x2645c501
sub eax, 0x2644e612
mov ebx, eax
add eax, 0x10c3fad
add eax, 0xfef3c058
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x10017ce
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
je 0x1001801
cmp dword [ebp + 0xc], ebx
je 0x1001801
push esi
call dword [sym.imp.ntdll.dll_wcslen]
pop ecx
xor ecx, ecx
test eax, eax
mov dword [ebp - 0xc], eax
jbe 0x10017f7
cmp word [esi + ecx*2], 0x25
jne 0x1001757
inc ebx
inc ecx
cmp ecx, eax
jb 0x100174f
test ebx, ebx
je 0x10017f7
add ebx, eax
shl ebx, 1
lea eax, [ebx + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x1001809
xor ecx, ecx
mov dword [ebp + 0xc], ecx
cmp word [esi + ecx*2], 0x25
jne 0x10017c8
mov edx, dword [ebp - 4]
cmp ecx, edx
jbe 0x10017b3
sub ecx, edx
mov dword [ebp - 4], ecx
lea esi, [esi + edx*2]
lea edi, [eax + edi*2]
rep movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 4]
add dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov word [eax + edi*2], 0x25
mov word [eax + edi*2 + 2], 0x25
inc edi
inc edi
inc dword [ebp - 4]
mov dword [ebp - 8], edi
inc ecx
cmp ecx, dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
jb 0x1001785
mov edx, dword [ebp - 4]
cmp ecx, edx
jbe 0x10017f0
sub ecx, edx
shl ecx, 1
lea esi, [esi + edx*2]
mov edx, ecx
shr ecx, 2
lea edi, [eax + edi*2]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and word [ebx + eax], 0
jmp 0x10017fd
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov al, 1
jmp 0x100180b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1001d36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
push 0x47
pop ecx
push 7
xor eax, eax
push 0x40
push eax
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0x11c], 0x11c
mov word [ebp - 4], 0x110
call fcn.01002e0a
push edx
push eax
push 0x40
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
pop edi
leave
ret

Function at 0x1001d98
Capabilities:
Enumerate files on windows

Disassembly:
mov edx, dword [esp + 4]
movzx ecx, word [edx + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [edx + 0xc]
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
cmp dword [esp + 0x10], 0
rep stosb byte es:[edi], al
pop edi
pop esi
je 0x1001da5
mov eax, dword [edx + 0xc]
mov byte [eax], 1
ret 8
Function at 0x401380
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00402ea0
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x70]
add esp, 0x14
xor ecx, esp
call fcn.004841c7
add esp, 0x64
ret

Function at 0x4013f0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00402ea0
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x70]
add esp, 0x14
xor ecx, esp
call fcn.004841c7
add esp, 0x64
ret
Function at 0x401c80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00405d00
add esp, 8
test eax, eax
jne 0x401ce6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004841c7
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
test eax, eax
jbe 0x401cfd
push eax
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00402ea0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push ebx
call fcn.00402f40
add esp, 8
test esi, esi
je 0x401d1d
mov eax, dword [esp + 4]
xor edx, edx
cmp eax, dword [esp]
sete dl
mov dword [esi], edx
mov ecx, dword [esp + 0x64]
xor ecx, esp
mov eax, 1
call fcn.004841c7
add esp, 0x68
ret

Function at 0x401d80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x60], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405f00
add esp, 4
test eax, eax
jne 0x401ddc
pop edi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004841c7
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x6c]
add esp, 8
pop edi
xor ecx, esp
mov eax, 1
call fcn.004841c7
add esp, 0x68
ret

Function at 0x401e00
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00405fe0
add esp, 8
test eax, eax
jne 0x401e7f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004841c7
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.004074f0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004841c7
add esp, 0x74
ret

Function at 0x402e70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x403e90
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403ebd
push 0x4ccb98
push eax
push eax
mov edx, 0x4ccb98
call fcn.00408150
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x403ed6
push 0x4ccb98
call fcn.00408420
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x404cb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x404ce3
mov dword [esp + 0x10], 0xffffffff
jmp 0x404ce9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x404da2
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404da2
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x404d43
mov eax, 1
push 0x4ccb98
call fcn.00408420
add esp, 4
jmp 0x404dd5
cmp dword [esp + 0x40], ebx
je 0x404d7f
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x404d65
mov eax, 5
push 0x4ccb98
call fcn.00408420
add esp, 4
jmp 0x404dd5
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x404dcd
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x404d8d
mov ebx, esi
jmp 0x404d51
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x404dba
push 0x4ccb98
push 0
push 0
mov edx, 0x4ccb98
call fcn.00408150
add esp, 0xc
jmp 0x404dd5
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00403e90
test eax, eax
je 0x404dd5
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x404ddf
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004841c7
add esp, 0x28
ret
Function at 0x405b50
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x405b98
push 0x4ccb98
push ebp
push ebp
mov edx, 0x4ccb98
call fcn.00408150
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x405c2c
jg 0x405bc0
cmp ebx, ecx
jb 0x405c2c
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x405bf1
push 0x4ccb98
push eax
push eax
mov edx, 0x4ccb98
call fcn.00408150
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00403e90
test eax, eax
je 0x405be7
mov eax, dword [esp + 0x20]
test eax, eax
je 0x405c12
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405c39
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x405c39
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4066f0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x406830
cmp dword [esp + 0x28], ebp
je 0x406830
push ebx
push 0x2800
call fcn.004851f2
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x406753
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004841c7
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x406760
push edi
push 0x4cd348
mov ecx, 0x2800
call fcn.00403ba0
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406806
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004840d0
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4067f9
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x4067f9
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00406470
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x406810
inc edi
cmp edi, 0x10
jl 0x406760
push ebx
call fcn.0048457c
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004841c7
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.004841c7
add esp, 0x1c
ret
Function at 0x4068e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x40691a
cmp dword [esp + 0x34], esi
je 0x40691a
push 0x200
call fcn.004851f2
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x406925
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a84
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x406a1a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40697d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4069f3
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x4cd3dc
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4069e8
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.00406850
cmp edx, edi
jb 0x4069e8
ja 0x4069e2
cmp eax, dword [esp + 0x24]
jbe 0x4069e8
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x406970
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x406a30
cmp dword [esp + 0x24], 0
jbe 0x406a84
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.00403ba0
add esp, 0xc
test eax, eax
jne 0x406a69
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0048457c
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.00406470
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.0048457c
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret