joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca71c
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040573c
xor eax, eax
push ebp
push 0x4ca822
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ca80c
mov dword [ebp - 8], 0xfffffffe
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x15]
cmp byte [ebp - 0x15], 0
je 0x4ca803
mov dword [ebp - 8], 0xfffffffd
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x14]
call fcn.00409fc4
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4ca7f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca7fa
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.0040283c
ret
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca829
lea eax, [ebp - 4]
call fcn.0040528c
ret

Function at 0x4cc3ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.0040b6d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0040b6bc
mov eax, dword [ebp - 0xc]
call fcn.0040b71c
mov esp, ebp
pop ebp
ret
Function at 0x4d3208
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0040554c
dec eax
test eax, eax
jl 0x4d325b
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx]
xor al, byte [ebp - 8]
and eax, 0xff
mov eax, dword [eax*4 + 0x885180]
mov edx, dword [ebp - 8]
shr edx, 8
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4d3230
xor dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5050f4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xc
add esp, 0xfffff004
push eax
dec eax
jne 0x5050fd
mov eax, dword [ebp - 4]
add esp, 0xfffffc5c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040573c
xor eax, eax
push ebp
push 0x5051d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
push 0
call sub.advapi32.dll_OpenEventLogA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5051be
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_GetNumberOfEventLogRecords
test eax, eax
je 0x5051be
cmp dword [ebp - 0x18], 0
je 0x5051be
lea eax, [ebp - 0xc3a8]
xor ecx, ecx
mov edx, 0xc388
call fcn.00403464
jmp 0x505190
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc3a8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
jmp 0x5051b5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xc388
lea eax, [ebp - 0xc3a8]
push eax
push 0
push 9
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ReadEventLogA
test eax, eax
jne 0x505174
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_CloseEventLog
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5051db
lea eax, [ebp - 4]
call fcn.0040528c
ret

Function at 0x5052b8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040573c
xor eax, eax
push ebp
push 0x50536d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x50534d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 8
call fcn.00403464
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
push 0
call sub.advapi32.dll_OpenEventLogA
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x505325
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x505357
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov byte [0x8855ac], 0
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x505357
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505374
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x50551c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50570d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dword [ebp - 0x14], 0x400
xor eax, eax
push ebp
push 0x5056cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x505430]
call fcn.0040690c
add esp, 4
mov eax, dword [ebp - 4]
call fcn.00406750
mov edx, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
call fcn.00403464
mov eax, dword [ebp - 4]
call fcn.00406750
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.kernel32.dll_QueryDosDeviceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5055cd
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7a
jne 0x5055cd
mov eax, dword [ebp - 0x14]
add eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
ja 0x5055dc
cmp dword [ebp - 0x14], 0x1869f
jl 0x50556c
cmp dword [ebp - 0x18], 0
jbe 0x5056c5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
push ebp
mov eax, dword [ebp - 8]
call fcn.0050545c
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5056c1
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x420]
xor ecx, ecx
mov edx, 0x400
call fcn.00403464
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040574c
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jbe 0x5056b5
lea ecx, [ebp - 0x428]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x428]
push 0x505728
lea edx, [ebp - 0x42c]
lea eax, [ebp - 0x420]
call fcn.0040b6bc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
mov edx, 3
call fcn.0040560c
mov ecx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 0x10]
dec dword [ebp - 0x20]
jne 0x505618
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5056d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505714
lea eax, [ebp - 0x42c]
mov edx, 3
call fcn.004052b0
lea eax, [ebp - 0x1c]
call fcn.0040528c
lea eax, [ebp - 4]
mov edx, dword [0x505430]
call fcn.00406a0c
ret
Function at 0x50e414
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x50e46c
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0xc]
and eax, 0xff
mov eax, dword [eax*4 + 0x8855d8]
mov edx, dword [ebp - 0xc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x50e43a
xor dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x527208
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040573c
mov eax, dword [ebp - 8]
call fcn.0040573c
xor eax, eax
push ebp
push 0x5272fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040528c
xor eax, eax
push ebp
push 0x5272d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x401
lea eax, [ebp - 0x415]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.00403464
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5272cc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x415]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040574c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5272c3
cmp dword [ebp - 0x14], 0
jbe 0x5272c3
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x415]
call fcn.0040b6bc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5272e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527302
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052b0
ret
Function at 0x52af30
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52b0f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040528c
lea eax, [ebp - 0x146]
xor ecx, ecx
mov edx, 0x121
call fcn.00403464
lea eax, [ebp - 0x25]
xor ecx, ecx
mov edx, 0xd
call fcn.00403464
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.0040a78c
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, 0x52b108
call fcn.00405598
mov eax, dword [ebp - 0x14c]
call fcn.0040574c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x52b0c7
push 0
lea eax, [ebp - 0x14]
push eax
push 0x121
lea eax, [ebp - 0x146]
push eax
push 0xd
lea eax, [ebp - 0x25]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x52b0be
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
call fcn.0040a78c
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 0x52b124
call fcn.00405598
mov eax, dword [ebp - 0x154]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.005ac594
push dword [ebp - 0xc]
push 0x52b138
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
call fcn.0040a78c
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 0x15c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.005ac6e0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004052e0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b0f9
lea eax, [ebp - 0x160]
mov edx, 6
call fcn.004052b0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004052b0
ret
Function at 0x53aee4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
xor edx, edx
mov dword [ebp - 0x1060], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53b089
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100c]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403464
lea eax, [ebp - 0x105c]
xor ecx, ecx
mov edx, 0x50
call fcn.00403464
mov dword [ebp - 8], 0x50
mov word [ebp - 0x105c], 0x2c
mov byte [ebp - 0x1058], 0
mov byte [ebp - 0x1059], 0
mov byte [ebp - 0x1057], 0
mov byte [ebp - 0x1056], 0xc
mov byte [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0xbf0
mov dword [ebp - 0x104c], 5
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x1044], 0x30
mov byte [ebp - 0x1055], 0x20
mov byte [ebp - 0x1040], 0x1d
mov byte [ebp - 0x103f], 0
mov byte [ebp - 0x103e], 0
mov byte [ebp - 0x103d], 0xb
mov byte [ebp - 0x103c], 0xf0
mov byte [ebp - 0x100c], 0xe0
mov byte [ebp - 0x100a], 0xb
mov byte [ebp - 0x1009], 0xec
mov byte [ebp - 0x1008], 4
mov byte [ebp - 0x1006], 0x38
mov byte [ebp - 0x1004], 0xf3
mov byte [ebp - 0x1003], 9
mov byte [ebp - 0xff5], 1
mov byte [ebp - 0xfd4], 0xb0
mov byte [ebp - 0xfd3], 0xb
mov byte [ebp - 0xfcf], 1
mov byte [ebp - 0xfcc], 0xc
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x105c]
push eax
push 0x4d014
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x53b049
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0053abac
pop ecx
jmp 0x53b070
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1060]
call fcn.0040a878
mov ecx, dword [ebp - 0x1060]
mov eax, dword [ebp - 4]
mov edx, 0x53b09c
call fcn.00405598
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b090
lea eax, [ebp - 0x1060]
call fcn.0040528c
ret
Function at 0x53ffec
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54014e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040528c
lea eax, [ebp - 0x13e]
xor ecx, ecx
mov edx, 0x121
call fcn.00403464
lea eax, [ebp - 0x1d]
xor ecx, ecx
mov edx, 0xd
call fcn.00403464
push 0
lea eax, [ebp - 0x10]
push eax
push 0x121
lea eax, [ebp - 0x13e]
push eax
push 0xd
lea eax, [ebp - 0x1d]
push eax
push 0x2d1400
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x540123
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040a78c
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov edx, 0x540164
call fcn.00405598
mov eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 0x14
mov edx, dword [ebp - 0x12a]
call fcn.005ac594
push dword [ebp - 8]
push 0x540178
lea edx, [ebp - 0x150]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040a78c
push dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 0x14c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 0x14
mov edx, dword [ebp - 0x12a]
call fcn.005ac6e0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004052e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540155
lea eax, [ebp - 0x150]
mov edx, 4
call fcn.004052b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004052b0
ret
Function at 0x54c808
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 8], 0
je 0x54c833
cmp dword [ebp + 8], 0xffffffff
je 0x54c833
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_ResetEvent
mov eax, dword [ebp + 0x14]
add eax, 0xffffffec
xor ecx, ecx
mov edx, 0x14
call fcn.00403464
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [eax - 0xc], edx
lea eax, [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [edx - 4], eax
cmp byte [ebp - 5], 0
je 0x54c8a0
push 0x54c73c
mov eax, dword [ebp + 0x14]
add eax, 0xffffffec
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFileEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x54c891
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObjectEx
jmp 0x54c8e1
push 0x54c73c
mov eax, dword [ebp + 0x14]
add eax, 0xffffffec
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFileEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x54c8d4
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObjectEx
cmp byte [ebp - 0x11], 0
je 0x54c8ec
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x558e30
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x558e39
mov eax, dword [ebp - 4]
add esp, 0xffffffc0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0xc], 0x2000
jg 0x558f37
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x558f37
lea eax, [ebp - 0x2044]
xor ecx, ecx
mov edx, 0x2030
call fcn.00403464
mov dword [ebp - 0x2044], 0x31
xor eax, eax
mov dword [ebp - 0x2040], eax
mov dword [ebp - 0x203c], 3
mov dword [ebp - 0x2038], 1
mov dword [ebp - 0x202c], 0x28
mov dword [ebp - 0x2028], 0x2000
cmp byte [ebp - 5], 0
je 0x558ed8
xor eax, eax
mov dword [ebp - 0x2034], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2030], eax
jmp 0x558eea
mov dword [ebp - 0x2034], 1
xor eax, eax
mov dword [ebp - 0x2030], eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2030
lea eax, [ebp - 0x2044]
push eax
push 0x2d1400
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x558f37
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jbe 0x558f37
mov byte [ebp - 0xd], 1
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x2014]
mov ecx, dword [ebp + 0xc]
call fcn.00402a80
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x558f40
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x558f49
mov eax, dword [ebp - 4]
add esp, 0xffffffbc
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 7], 0
mov byte [ebp - 0xe], 0
cmp byte [ebp - 5], 0
je 0x558f74
mov byte [ebp - 0xe], 1
cmp dword [ebp + 0xc], 0x2000
jg 0x559099
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x559099
lea eax, [ebp - 0x2048]
xor ecx, ecx
mov edx, 0x2030
call fcn.00403464
mov dword [ebp - 0x2048], 0x31
xor eax, eax
mov dword [ebp - 0x2044], eax
mov dword [ebp - 0x2040], 3
mov dword [ebp - 0x203c], 2
xor eax, eax
mov al, byte [ebp - 6]
mov dword [ebp - 0x2038], eax
mov dword [ebp - 0x2034], 0xffffffff
cmp byte [ebp - 0xe], 0
je 0x558fec
xor eax, eax
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x2030], 0x28
mov dword [ebp - 0x202c], 0x2000
push 0
mov eax, dword [ebp + 8]
push eax
push 0x2030
lea eax, [ebp - 0x2048]
push eax
push 0x2030
lea eax, [ebp - 0x2048]
push eax
push 0x2d1400
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x559058
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jbe 0x559058
mov byte [ebp - 7], 1
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x2018]
mov ecx, dword [ebp + 0xc]
call fcn.00402a80
cmp byte [ebp - 0xe], 0
jne 0x559099
mov byte [ebp - 0xe], 1
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [ebp + eax - 0x2018], 0
jne 0x55907c
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jne 0x55906c
cmp dword [ebp - 0x18], 0x10
jne 0x55908f
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x558f91
mov al, byte [ebp - 7]
mov esp, ebp
pop ebp
ret 0xc