joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430070
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430114
call fcn.00430010
test eax, eax
jne 0x430114
mov eax, 1
test byte [0x4f1904], al
jne 0x4300e3
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0042ff40
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x430147
test ecx, ecx
je 0x43010d
test eax, eax
je 0x43010d
test ecx, 0x1ff
jne 0x43010d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x430160
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430207
call fcn.00430010
test eax, eax
jne 0x430207
mov eax, 1
test byte [0x4f1904], al
jne 0x4301d3
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x8e
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0042ff40
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x43023a
test ecx, ecx
je 0x430200
test eax, eax
je 0x430200
test ecx, 0x1ff
jne 0x430200
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x432700
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4327a4
call fcn.004326a0
test eax, eax
jne 0x4327a4
mov eax, 1
test byte [0x4f1904], al
jne 0x432773
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.004325d0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4327d7
test ecx, ecx
je 0x43279d
test eax, eax
je 0x43279d
test ecx, 0x1ff
jne 0x43279d
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x438600
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
push ebx
push edi
lea edx, [esp + 8]
xor ebx, ebx
push edx
mov dword [esp + 0xc], ebx
call eax
mov edi, eax
cmp edi, ebx
je 0x4386ed
push 0x3fe
lea ecx, [esp + 0x16]
push ebx
push ecx
mov word [esp + 0x1c], bx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x400
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_wcsrchr]
add esp, 8
cmp eax, ebx
je 0x4386ed
push esi
push 0x3fe
lea ecx, [esp + 0x41a]
push ebx
mov word [eax], bx
push ecx
mov word [esp + 0x420], bx
call sub.ntdll.dll_memset
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x424]
push str._sLdmData.dmp
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x18
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4386ec
mov eax, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x14]
push edx
push eax
push edi
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 0x810]
pop edi
pop ebx
xor ecx, esp
call fcn.00462b77
add esp, 0x80c
ret

Function at 0x439e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46569c
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4e9028]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], vtable.COperation.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x51c], ecx
mov dword [eax + 0x520], ecx
mov dword [eax + 0x524], ecx
mov dword [eax + 0x528], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x43c010
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c098
mov eax, 1
test byte [0x4f1904], al
jne 0x43c06e
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x3e9
add esi, 8
call fcn.00439d30
mov ecx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push 0x4f18dc
call ecx
add esp, 0x10
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push str.SystemPartition
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
sbb esi, esi
push eax
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x43df50
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x43dfa4
mov eax, dword [esp + 8]
test eax, eax
je 0x43df8a
cmp eax, 1
jne 0x43dfa4
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00462b77
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00462b77
add esp, 0x118
ret

Function at 0x43e050
Capabilities:
Get disk information

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
push edi
xor edi, edi
cmp cx, di
mov esi, edx
je 0x43e0ff
cmp cx, 0x2a
je 0x43e0ff
xor eax, eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
movzx eax, cx
push eax
lea ecx, [esp + 0x24]
push str._c:_
push ecx
mov word [esp + 0x2c], di
call dword [sym.imp.MSVCR80.dll__swprintf]
push 0xfe
lea edx, [esp + 0x42]
push edi
push edx
mov word [esp + 0x48], di
call sub.ntdll.dll_memset
add esp, 0x18
push 0x80
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push 0x40
push ebx
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop edi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00462b77
add esp, 0x22c
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43e104
sub eax, edx
sar eax, 1
je 0x43e226
push 0xfe
lea edx, [esp + 0x136]
push edi
push edx
mov word [esp + 0x13c], di
call sub.ntdll.dll_memset
add esp, 0xc
test byte [0x4f190c], 1
jne 0x43e151
or dword [0x4f190c], 1
mov dword [0x4f1908], 0x4db424
mov eax, dword [0x4f1908]
mov edx, dword [eax + 0x64]
push 0x80000000
push esi
mov ecx, 0x4f1908
call edx
mov esi, eax
cmp esi, 0xffffffff
je 0x43e205
test byte [0x4f18e8], 1
jne 0x43e18b
or dword [0x4f18e8], 1
mov dword [0x4f18e4], 0x4db4c0
push 0x40
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x4f18e4]
lea eax, [esp + 0x20]
push eax
mov eax, dword [edx + 4]
push 0x40
push ebx
push esi
mov ecx, 0x4f18e4
call eax
test eax, eax
push esi
jne 0x43e1e3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x4d
add esi, 8
call fcn.0043dca0
mov ecx, dword [esi]
push eax
push str._s:_Call_GetVolumeInfoByHandle_to_fail.
push edi
call ecx
jmp 0x43e223
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00462b77
add esp, 0x22c
ret
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x56
add esi, 8
call fcn.0043dca0
mov edx, dword [esi]
push eax
push str._s:_OpenDevVolume_failed.
push edi
call edx
add esp, 0x10
mov ecx, dword [esp + 0x230]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00462b77
add esp, 0x22c
ret
Function at 0x43fb90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43fc34
call fcn.0043fb30
test eax, eax
jne 0x43fc34
mov eax, 1
test byte [0x4f1904], al
jne 0x43fc03
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0043fa10
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x43fc67
test ecx, ecx
je 0x43fc2d
test eax, eax
je 0x43fc2d
test ecx, 0x1ff
jne 0x43fc2d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x43fc80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43fd27
call fcn.0043fb30
test eax, eax
jne 0x43fd27
mov eax, 1
test byte [0x4f1904], al
jne 0x43fcf3
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x8e
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0043fa10
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x43fd5a
test ecx, ecx
je 0x43fd20
test eax, eax
je 0x43fd20
test ecx, 0x1ff
jne 0x43fd20
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x440140
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor eax, eax
xor edi, edi
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push 8
mov esi, ecx
mov edx, dword [esi + 4]
lea ecx, [esp + 0x2c]
push ecx
push edi
push edi
push 0x7405c
push edx
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push edi
add eax, 0x1ff
push 0x200
adc ecx, edi
push ecx
push eax
call sub.ntdll.dll__alldiv
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
mov ebx, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
call edx
test eax, eax
je 0x4401f5
mov eax, dword [esp + 0x10]
mul dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
cmp edx, ebx
jb 0x4401f5
ja 0x4401f9
cmp eax, ebp
ja 0x4401f9
mov edx, ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4402e0
Capabilities:
Check os version
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x57c
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x574], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x28]
push eax
mov esi, ecx
mov dword [esp + 0x2c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x2c], 6
jb 0x440508
xor edi, edi
push 0x3e
lea ecx, [esp + 0x146]
push edi
push ecx
mov word [esp + 0x14c], di
call sub.ntdll.dll_memset
mov edx, dword [esi + 8]
push edx
lea eax, [esp + 0x150]
push 0x4db4d4
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x18
push edi
push 0x80
push 3
push edi
push 3
push 0xc0000000
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44039f
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x11e
mov ecx, str..disk.cpp
add esi, 8
call fcn.0043fa10
mov edx, dword [esi]
push eax
push str._s:_Failed_to_open_disk_in__IsOfflineDisk.
push edi
call edx
add esp, 0x10
jmp 0x440508
push edi
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
push edi
push 0x70024
push esi
mov dword [esp + 0x44], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x440501
push 0x3fe
lea ecx, [esp + 0x186]
push edi
push ecx
xor ebp, ebp
mov dword [esp + 0x24], 0x200
mov dword [esp + 0x28], edi
mov word [esp + 0x18c], di
call sub.ntdll.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push edi
lea edx, [esp + 0x20]
push edx
push 0x200
push esi
call ebx
cmp eax, 0xffffffff
jne 0x440431
call fcn.0041e870
mov ebx, eax
mov edi, dword [ebx]
push 0x137
mov ecx, str..disk.cpp
add edi, 8
call fcn.0043fa10
push eax
mov eax, dword [edi]
push str._s:_Failed_to_SetFilePointer_in__IsOfflineDisk.
push ebx
call eax
jmp 0x4404fe
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x18c]
push edx
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4404d8
cmp dword [esp + 0x14], 0x200
jne 0x4404d8
mov ecx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x440497
call fcn.0041e870
mov ebx, eax
mov edi, dword [ebx]
push 0x14e
mov ecx, str..disk.cpp
add edi, 8
call fcn.0043fa10
push eax
push str._s:_Failed_to_SetFilePointer_in__IsOfflineDisk.
jmp 0x4404f9
push edi
lea eax, [esp + 0x18]
push eax
push 0x200
lea ecx, [esp + 0x18c]
push ecx
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4404c3
cmp dword [esp + 0x14], 0x200
je 0x4404c8
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp ebp, edi
setne al
jmp 0x44050a
call fcn.0041e870
mov ebx, eax
mov edi, dword [ebx]
push 0x13f
mov ecx, str..disk.cpp
add edi, 8
call fcn.0043fa10
push eax
push str._s:_Failed_to_ReadFile_in__IsOfflineDisk.
mov edx, dword [edi]
push ebx
call edx
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x584]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00462b77
add esp, 0x57c
ret
Function at 0x440800
Capabilities:
Check os version

Disassembly:
sub esp, 0x8ac
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x8a4], eax
push esi
push edi
push 0x1ff
lea eax, [esp + 0x4ad]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x4b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [esi + 0x38], 0
je 0x440856
mov ecx, dword [esi + 8]
push ecx
call fcn.0045b8c0
push 0
push 1
push edx
push eax
lea edx, [esp + 0x4b8]
push edx
jmp 0x440866
push 0
push 1
push 0
push 6
lea eax, [esp + 0x4b8]
push eax
mov edi, dword [esi + 4]
call fcn.0043fb90
mov ecx, 0x61
lea esi, [esp + 0x4bc]
lea edi, [esp + 0x134]
rep movsd dword es:[edi], dword [esi]
add esp, 0x14
push 0x1fe
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x2ae]
push 0
push ecx
movsb byte es:[edi], byte [esi]
mov word [esp + 0x2b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100
lea edx, [esp + 0x1d4]
push edx
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.ntdll.dll_mbstowcs]
add esp, 0xc
push 0x1fe
lea ecx, [esp + 0x6ae]
push 0
push ecx
mov word [esp + 0x6b4], 0
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0x6a8]
call fcn.00440530
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jb 0x440969
lea eax, [esp + 0x2a8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440920
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0x6b2]
push ecx
call dword [sym.imp.ntdll.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4409c2
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x8a4]
xor ecx, esp
call fcn.00462b77
add esp, 0x8ac
ret
lea edx, [esp + 0x2a8]
lea ecx, [esp + 0x6a8]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x44099d
test ax, ax
je 0x440999
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x44099d
add ecx, 4
add edx, 4
test ax, ax
jne 0x440977
xor eax, eax
jmp 0x4409a2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4409c2
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x8a4]
xor ecx, esp
call fcn.00462b77
add esp, 0x8ac
ret
mov ecx, dword [esp + 0x8ac]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00462b77
add esp, 0x8ac
ret

Function at 0x440cf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
xor edi, edi
test ebp, ebp
jbe 0x440d47
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push esi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x440d51
cmp dword [esp + 0x18], 0
je 0x440d51
mov dl, byte [esi]
add edi, 1
add esi, 1
cmp dl, 0xa
je 0x440d47
cmp edi, ebp
jb 0x440d12
mov eax, edi
pop edi
mov byte [esi], 0
pop esi
pop ebp
pop ebx
ret
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x440d60
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
test esi, esi
jne 0x440d74
lea eax, [esi + 1]
pop esi
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edi
push ebp
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x440dc8
cmp dword [esp + 0xc], 0
je 0x440dc8
cmp esi, 2
mov eax, 1
jb 0x440db2
cmp byte [edi + esi - 2], 0xd
jne 0x440db2
cmp byte [edi + esi - 1], 0xa
je 0x440e28
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x4dde9c
push ebp
call ebx
pop ebx
pop esi
pop ebp
pop ecx
ret
mov eax, 1
test byte [0x4f1904], al
jne 0x440dfc
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0xd2
mov ecx, str.d:workDDCIncludeFileIO.h
add esi, 8
call fcn.00440c20
mov edx, dword [esi]
push eax
push str._s:_Failed_to_WriteFile_in_WriteLine_for_CHAR.
push 0x4f18dc
call edx
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x440f50
Capabilities:
Manipulate boot configuration

Disassembly:
sub esp, 0x610
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, 1
test byte [0x4f190c], bl
mov esi, ecx
mov dword [esi], edi
jne 0x440f8a
or dword [0x4f190c], ebx
mov dword [0x4f1908], 0x4db424
push 0xfe
lea eax, [esp + 0x116]
push edi
push eax
mov word [esp + 0x11c], di
call sub.ntdll.dll_memset
mov edx, dword [0x4f1908]
mov eax, dword [edx + 0x28]
add esp, 0xc
push 0x80
lea ecx, [esp + 0x114]
push ecx
mov ecx, 0x4f1908
call eax
test eax, eax
jne 0x44103c
test byte [0x4f1904], bl
jne 0x440ff8
or dword [0x4f1904], ebx
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x56
mov ecx, str.._boot.cpp
add esi, 8
call fcn.00440c20
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_IVol.GetSystemVolumeDevice_in_IsExistBootIni.
push 0x4f18dc
call ecx
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.00462b77
add esp, 0x610
ret
push 0xfe
lea edx, [esp + 0x16]
push edi
push edx
mov word [esp + 0x1c], di
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x14]
push 0x80
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push 0x1fe
lea edx, [esp + 0x216]
push edi
push edx
mov word [esp + 0x21c], di
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1fe
lea eax, [esp + 0x416]
push edi
push eax
mov word [esp + 0x41c], di
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push str._s_boot.ini
lea edx, [esp + 0x218]
call fcn.00404520
lea edx, [esp + 0x18]
push edx
push str._s_ntldr
lea edx, [esp + 0x420]
call fcn.00404520
add esp, 0x10
lea eax, [esp + 0x210]
call fcn.00440e90
test eax, eax
je 0x4410fc
lea eax, [esp + 0x410]
call fcn.00440e90
test eax, eax
je 0x4410fc
mov dword [esi], ebx
mov ecx, dword [esp + 0x614]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00462b77
add esp, 0x610
ret