joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448290
Capabilities:
Get storage device properties

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
jne 0x4482de
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
push 3
push edi
push 3
push SysReAllocStringLen
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4482c3
xor eax, eax
cmp eax, edi
mov esi, eax
jne 0x4482dd
push edi
push edi
push 3
push edi
push 3
push edi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4482db
xor eax, eax
mov esi, eax
pop ebp
cmp eax, 0xffffffff
je 0x44836a
cmp eax, edi
je 0x44836a
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
push edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
lea edx, [esp + 0x4c]
push edx
push 0x28
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x24]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x2d1400
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0x28
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, edi
mov ebx, dword [esp + 0x34]
je 0x448361
cmp esi, 0xffffffff
je 0x448361
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x34
ret
cmp esi, edi
je 0x44837a
cmp esi, 0xffffffff
je 0x44837a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x34
ret
Function at 0x448390
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e67c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movzx ecx, word [0x518dc4]
mov edx, dword [esp + 0x34]
push ebp
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
or ecx, 0x2001b
push ecx
xor ebp, ebp
push ebp
push edx
push eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x44855c
push ebx
mov bl, byte [esp + 0x40]
test bl, 1
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
je 0x448407
mov ecx, dword [esp + 0x10]
push 0x4ebd38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebp
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
push ebp
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov dword [esp + 0x18], edi
jae 0x448445
mov ecx, eax
mov dword [esp + 0x14], ecx
lea eax, [ecx*4 + 8]
xor esi, esi
cmp eax, ebp
mov dword [esp + 0x28], esi
jl 0x448470
lea ecx, [eax + eax + 2]
push ecx
call fcn.00445f00
mov esi, eax
add esp, 4
cmp esi, ebp
mov dword [esp + 0x28], esi
je 0x448470
mov word [esi], bp
cmp edi, ebp
mov dword [esp + 0x38], ebp
jne 0x448534
test bl, 4
je 0x4484d8
mov edi, dword [esp + 0x20]
dec edi
cmp edi, ebp
jl 0x4484d8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x3c]
push ecx
lea eax, [edx*4 + 1]
push esi
mov dword [esp + 0x44], eax
mov word [esi], bp
mov edx, dword [esp + 0x28]
push edi
push edx
call ebx
cmp eax, ebp
jne 0x4484cd
cmp word [esi], bp
je 0x4484d1
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebp
je 0x4484d1
mov dword [esp + 0x18], eax
dec edi
jns 0x448490
mov bl, byte [esp + 0x48]
test bl, 2
je 0x448534
mov edi, dword [esp + 0x24]
dec edi
cmp edi, ebp
jl 0x448534
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea esp, [esp]
mov ecx, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x3c]
push eax
lea edx, [ecx*4 + 1]
push esi
mov dword [esp + 0x44], edx
mov word [esi], bp
mov ecx, dword [esp + 0x28]
push edi
push ecx
call ebx
cmp eax, ebp
jne 0x44852d
cmp word [esi], bp
je 0x448531
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [0x519298]
cmp eax, ebp
je 0x448531
mov dword [esp + 0x18], eax
dec edi
jns 0x4484f0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x448555
mov ecx, dword [0x51927c]
add esi, 0xfffffff8
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x448690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
push esi
push 0x20019
push eax
mov dword [esp + 0xc], 0x32
mov dword [esp + 0x10], 1
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov esi, eax
test esi, esi
je 0x448704
push edi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.Class
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x448704
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x448704
mov eax, 1
pop esi
add esp, 0x3c
ret
xor eax, eax
pop esi
add esp, 0x3c
ret

Function at 0x448fe0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4e78c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
push 0x5194ec
mov edi, ecx
mov dword [esp + 0x10], 0x5194ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x88]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x449047
mov eax, dword [edi + 0x18]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x88]
push ecx
push 2
push 0x466
push eax
mov dword [edi + 0x88], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [edi + 0x18]
call fcn.00442240
cmp dword [edi + 0xb0], ebx
je 0x44906e
mov edx, dword [edi + 0xbc]
mov eax, dword [edi + 0xb8]
push ebx
push edx
push eax
call fcn.00443a40
add esp, 0xc
cmp dword [edi + 0xa0], ebx
je 0x449141
mov ecx, dword [edi + 0xac]
mov esi, dword [ecx]
dec esi
js 0x449141
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4490a0
mov edx, dword [edi + 0xa8]
mov eax, dword [edx]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x449139
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4490fc
mov ecx, dword [eax + 0x18]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 0xa8]
mov eax, dword [edx]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x18]
push 4
push 1
push 1
push 0xfffffffffffffff8
push 0xfffffffffffffff8
push 0
push eax
call ebx
mov ecx, dword [edi + 0xa8]
mov edx, dword [ecx]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x18]
push 0
push edx
call ebp
mov eax, dword [edi + 0xa8]
mov ecx, dword [eax]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ecx + 4]
cmp edx, 4
jne 0x449115
cmp dword [ecx + 0x40], 0
jg 0x449121
cmp edx, 0xa
jne 0x449139
cmp word [ecx + 0x4c], 0
je 0x449139
mov edx, dword [eax]
mov ecx, dword [edx + esi*4]
test ecx, ecx
lea eax, [edx + esi*4]
mov dword [eax], 0x519368
je 0x449139
mov eax, dword [ecx]
push 1
call dword [eax]
dec esi
jns 0x4490a0
pop ebp
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x449e00
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e6618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x30]
push esi
push 0x80
push 3
push esi
push 7
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], esi
call fcn.004167bc
mov ebp, dword [esp + 0x10]
cmp ebp, esi
je 0x449e75
lea ecx, [esp + 0x1c]
or eax, 0xffffffff
push ecx
push ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
mov edi, eax
mov ebx, ecx
jg 0x449e79
jl 0x449e75
cmp eax, esi
jae 0x449e79
xor edi, edi
xor ebx, ebx
push 2
call fcn.00445f00
mov esi, eax
add esp, 4
test esi, esi
je 0x449e8c
mov byte [esi], 0
test ebx, ebx
jl 0x449edb
jg 0x449e96
test edi, edi
jbe 0x449edb
lea eax, [edi + 6]
push esi
call fcn.00445f60
mov esi, eax
add esp, 4
test esi, esi
je 0x449ead
mov byte [edi + esi + 5], 0
push 0
lea edx, [esp + 0x18]
push edx
push edi
push esi
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp eax, ebx
jl 0x449ed7
jg 0x449ed5
cmp ecx, edi
jbe 0x449ed7
mov ecx, edi
mov byte [ecx + esi], 0
movzx eax, word [0x51e010]
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x34]
mov ecx, dword [edi]
mov ebx, eax
lea ebp, [ebx + 2]
lea eax, [ebp + ebp + 4]
push ecx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x449f12
mov word [eax + ebp*2 + 2], 0
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
push ebp
push edx
push ebx
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
test ebp, ebp
jge 0x449f2d
xor ebp, ebp
mov ecx, dword [edi]
mov word [ecx + ebp*2], 0
mov edx, dword [edi]
lea eax, [ebp + ebp + 4]
push edx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x449f51
mov word [eax + ebp*2 + 2], 0
test esi, esi
je 0x449f67
mov eax, dword [0x51927c]
add esi, 0xfffffff8
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x449f7f
cmp eax, 0xffffffff
je 0x449f7f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x44a320
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x44a340
xor ecx, ecx
cmp word [eax], 0x26
jne 0x44a33a
add eax, 2
inc ecx
cmp word [eax], 0x26
je 0x44a330
cmp word [eax], 0
jne 0x44a346
mov eax, 0x4ee160
ret
test ecx, ecx
push esi
jne 0x44a37a
push edi
push ecx
mov edi, eax
mov esi, 0x4ee164
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
pop edi
jne 0x44a3a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jmp 0x44a399
xor edx, edx
cmp ecx, 1
mov ecx, dword [esp + 8]
setle dl
push 0xffffffffffffffff
dec edx
and edx, ecx
push edx
push eax
call fcn.0041e533
test eax, eax
mov esi, 0x4ee164
jne 0x44a3a0
mov esi, 0x4ee160
mov eax, esi
pop esi
ret

Function at 0x44a530
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0x10]
test al, al
je 0x44a557
mov eax, dword [esi + 8]
test eax, eax
jle 0x44a557
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 8]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44a578
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x44a591
cmp eax, 0xffffffff
je 0x44a591
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
pop ecx
ret

Function at 0x44a860
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e5b38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x54], ebx
call fcn.004167bc
mov esi, dword [esp + 8]
cmp esi, ebx
jne 0x44a8c1
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20
lea edx, [esp + 0x1c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00442510
add esp, 0xc
cmp esi, 0xffffffff
mov bl, al
je 0x44a8f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x44acc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e5b8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x200002
mov ebp, 1
mov word [esp + 0x1c], bx
call fcn.00445f00
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x14], edi
je 0x44ad05
mov word [edi], bx
cmp dword [esp + 0x240], ebx
mov dword [esp + 0x22c], ebx
jne 0x44ad3c
lea eax, [esp + 0x18]
push eax
push 0x104
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
cmp esi, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x240], ecx
je 0x44ae5c
cmp ebp, ebx
mov esi, 0xa0000000
mov dword [esp + 0x10], ebx
je 0x44ad4e
mov esi, 0xe0000000
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
mov ebx, dword [esp + 0x244]
push 3
push esi
push ebx
call dword [0x5192b8]
mov edi, eax
test edi, edi
jne 0x44ad99
lea esp, [esp]
cmp ebp, 1
jne 0x44addc
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 3
and esi, 0xbfffffff
push esi
push ebx
mov ebp, 2
call dword [0x5192b8]
mov edi, eax
test edi, edi
je 0x44ad70
mov ecx, dword [esp + 0x240]
push ecx
push edi
call dword [0x5192bc]
mov esi, eax
test esi, esi
jne 0x44adb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov edx, dword [esp + 0x23c]
push edx
push edi
call dword [0x5192c0]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x44adea
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x44ae42
test edi, edi
jne 0x44ad99
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x44ae58
test esi, esi
je 0x44ae42
xor ebx, ebx
test ebp, ebp
jne 0x44adf9
mov ebx, 0x200
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ecx
call dword [0x5192c4]
mov esi, eax
test esi, esi
jne 0x44ae3e
cmp ebp, 2
jne 0x44ae34
mov edx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
or ebx, 0x200
push ebx
push edx
push eax
call dword [0x5192c4]
mov esi, eax
test esi, esi
jne 0x44ae3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x44ae4d
push ebx
call dword [0x5192c8]
test edi, edi
je 0x44ae58
push edi
call dword [0x5192c8]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x44ae73
mov ecx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x224]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x44ae90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
movzx ecx, word [0x518dc4]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x1c]
or ecx, 0x20019
push ecx
xor ebx, ebx
push ebx
push edx
push eax
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test ebp, ebp
jne 0x44af6d
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [edi], 0xffa
mov ecx, dword [esi]
push ecx
mov eax, 0xfff
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44aef8
mov byte [eax + 0xffe], 0
mov edx, dword [esi]
mov ebx, dword [esp + 0x20]
push edi
mov byte [edx], 0
mov eax, dword [esi]
mov edx, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
cmp ebp, 0xea
jne 0x44af5b
mov ebp, dword [edi]
add ebp, 0xa
mov dword [edi], ebp
mov ecx, dword [esi]
lea eax, [ebp + 5]
push ecx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44af42
mov byte [eax + ebp + 4], 0
mov edx, dword [esi]
mov ecx, dword [esp + 0x18]
push edi
push edx
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
test ebp, ebp
je 0x44af80
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44af77
mov dword [eax], ebp
pop edi
pop esi
pop ebp
lea eax, [ebx - 1]
pop ebx
pop ecx
ret
cmp dword [edi], 0
jge 0x44af8b
mov dword [edi], 0
mov ecx, dword [edi]
mov eax, dword [esi]
mov byte [eax + ecx], 0
mov ecx, dword [edi]
mov eax, dword [esi]
add eax, ecx
mov word [eax + 2], 0
mov word [eax], 0
mov edi, dword [edi]
mov edx, dword [esi]
add edi, 5
lea eax, [edi + 1]
push edx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x44afc1
mov byte [eax + edi], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x44b1b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
neg esi
sbb esi, esi
push edi
mov eax, ecx
push ecx
xor eax, 0xa
and esi, 0x2000000
push ebp
add esi, 0x2000000
mov dword [esp + 0x1c], eax
call fcn.0041fda4
mov edx, dword [esp + 0x38]
add esp, 8
test edx, edx
lea ecx, [ebp + eax*2]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0
mov ebx, eax
mov edi, ebp
jne 0x44b216
mov dword [esp + 0x24], ecx
mov ebp, ecx
jmp 0x44b23c
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
cmp ebp, ecx
jae 0x44b2f8
mov edi, ebp
mov ax, word [ebp]
add ebp, 2
cmp word [esp + 0x14], ax
je 0x44b232
cmp ebp, ecx
jb 0x44b220
mov ebx, ebp
sub ebx, edi
mov dword [esp + 0x24], ebp
sar ebx, 1
cmp edi, ebp
mov eax, edi
jae 0x44b24c
xor word [eax], dx
add eax, 2
cmp eax, ebp
jb 0x44b242
push 0
push 0
push ebx
push edi
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp]
mov dword [esp + 0x1c], eax
lea eax, [eax + ecx + 1]
mov dword [esp + 0x18], eax
lea eax, [eax + eax + 2]
push edx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [ebp], eax
je 0x44b294
mov ecx, dword [esp + 0x18]
mov word [eax + ecx*2], 0
mov edx, dword [ebp]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
push ecx
lea ebp, [edx + eax*2]
push ebp
push ebx
push edi
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
lea ecx, [ebx + ebx]
mov ebx, ecx
shr ecx, 2
mov edx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
test edx, edx
rep stosb byte es:[edi], al
jle 0x44b20a
mov ecx, dword [esp + 0x2c]
add ecx, edx
dec edx
mov dword [esp + 0x2c], ecx
js 0x44b20a
lea eax, [edx + 1]
mov dx, word [esp + 0x30]
xor word [ebp], dx
add ebp, 2
dec eax
jne 0x44b2e4
jmp 0x44b20a
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov esi, dword [esp + 0x2c]
pop edi
mov word [ecx + esi*2], dx
mov eax, dword [eax]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x44b310
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x414
call fcn.00445f00
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 4], esi
je 0x44b32e
mov word [esi], 0
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov word [esi], 0
mov eax, edi
mov ecx, str.Device_
mov edx, 7
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x44b35f
dec edx
jns 0x44b346
jmp 0x44b390
push 0xc
push edi
push str.DosDevices_
call fcn.00440450
add esp, 0xc
test al, al
jne 0x44b390
cmp word [edi], 0
je 0x44b395
cmp word [edi + 2], 0
je 0x44b395
push 0x3a
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x44b395
or dword [esp + 0x24], 1
mov eax, edi
mov ecx, 0x4f4ba8
mov edx, 0xa
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebp, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
mov ebp, dword [esp + 0x1c]
jne 0x44b3d1
dec edx
jns 0x44b3a1
mov ecx, dword [esp + 0x24]
mov bl, byte [esp + 0x28]
and ecx, 0xfffffffe
test bl, bl
mov dword [esp + 0x24], ecx
jne 0x44b3f2
jmp 0x44b3d5
mov bl, byte [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov esi, eax
test esi, esi
jne 0x44b401
test bl, bl
jl 0x44b44d
mov esi, dword [esp + 0x10]
xor bl, bl
push 0x208
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x44b432
test bl, bl
jle 0x44b44d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push 0x208
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x44b44d
mov ecx, dword [esp + 0x24]
push edi
push ebp
or ecx, 0xe
push ecx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test bl, bl
mov esi, eax
jl 0x44b44d
test esi, esi
jne 0x44b44d
or bl, 0xff
jmp 0x44b3d5
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop ebp
pop ebx
je 0x44b46a
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x44b470
Capabilities:
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x4e5bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
push esi
push edi
xor edi, edi
mov dword [esp + 8], edi
mov eax, dword [esp + 0x1b8]
push edi
push 0x20000000
push 3
push edi
push 3
push 0x100080
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1cc], edi
call fcn.004167bc
mov esi, dword [esp + 8]
cmp esi, edi
je 0x44b4fa
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0xc
lea edx, [esp + 0x18]
push edx
push edi
push edi
push 0x2d1080
push esi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x44b514
cmp esi, 0xffffffff
je 0x44b4fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
add esp, 0x1ac
ret
cmp esi, 0xffffffff
mov edi, dword [esp + 0x10]
je 0x44b524
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1a8]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1ac
ret