joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458d24
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458ecf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x458eb0
mov dl, 1
mov eax, dword [0x4174e4]
call fcn.0040373c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044d8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x458e9f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446274
test al, al
je 0x458e92
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458ee0
lea eax, [ebp - 0x254]
call fcn.00409534
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x458e92
xor eax, eax
push ebp
push 0x458e8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458f18
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458e74
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404740
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458e74
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e92
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x458d95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b658
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458ed6
lea eax, [ebp - 0x260]
call fcn.004044d8
ret

Function at 0x459804
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46cc2c]
cmp byte [eax + 0xa5], 0
jne 0x459875
cmp dword [0x46cc44], 0
jne 0x459836
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4597c0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46cc44], eax
cmp dword [0x46cc40], 0
jne 0x459851
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46cc40], eax
cmp dword [0x46cc48], 0
jne 0x459875
push esp
push 0
push 0
push 0x459764
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46cc48], eax
pop edx
ret
Function at 0x45996c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459983
add esp, 0xfffffff0
call fcn.00403ad0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042104c
mov eax, dword [0x46b164]
cmp word [eax + 2], 0
jne 0x4599ab
mov eax, dword [0x46b164]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b030
mov eax, dword [0x46b200]
cmp word [eax + 2], 0
jne 0x4599c5
mov eax, dword [0x46b200]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b228
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416ff4]
call fcn.0040373c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416ff4]
call fcn.0040373c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423594]
call fcn.0042af64
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x459b4c
mov eax, dword [0x46b094]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b334
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b7a8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46b094]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b8c0
test eax, eax
je 0x459aba
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408e90
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b8e8
test eax, eax
je 0x459ace
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404740
mov eax, dword [0x46af6c]
cmp byte [eax], 0
jne 0x459b02
mov eax, ebx
call fcn.00459c74
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045b984
mov eax, ebx
call fcn.0045c334
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459b42
call fcn.00403b28
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459ee8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46cc2c]
cmp dword [eax + 0x30], 0
je 0x459f92
cmp dword [ebx + 0x94], 0
jne 0x459f8c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459e78
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459f8c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x459f52
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459f8c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419694
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x459f61
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45aa70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45aaa5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045c8
jmp 0x45aab2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040452c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45bb60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45bba1
mov eax, esi
call fcn.0044196c
test al, al
je 0x45bba1
mov eax, dword [ebx + 0x84]
call fcn.00441668
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45bba1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441668
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45c84c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416678]
call fcn.00404ee0
xor eax, eax
push ebp
push 0x45c990
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46adb4], 0
jne 0x45c89f
mov ecx, dword [0x46af7c]
mov dl, 1
mov eax, dword [0x407900]
call fcn.0040ae50
call fcn.00403f38
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040305c
mov eax, ebx
call fcn.00404d50
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45c9a0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406260
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d60
test eax, eax
jle 0x45c937
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45c930
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404758
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404740
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408718
test eax, eax
jne 0x45c930
mov ebx, 0x15
jmp 0x45c93c
mov ebx, 0x10
jmp 0x45c93c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46adb4]
call fcn.0045c7a4
mov eax, dword [ebp - 8]
call fcn.0045c7a4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c997
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044fc
lea eax, [ebp - 0x10]
mov edx, dword [0x416678]
call fcn.00404fb0
ret
Function at 0x4030e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x403112
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004031ef
cmp eax, esi
jl 0x4031e9
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.004031ef
mov ebx, eax
cmp ebx, esi
jl 0x4031e7
cmp dword [ebp + 0x10], esi
jne 0x4031b5
cmp dword [ebp + 8], esi
jle 0x4031e7
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403177
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405e05
test eax, eax
je 0x4031b1
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x403166
jmp 0x4031e7
push 0xfffffffffffffffe
jmp 0x4031db
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4031c0
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4031de
push 0xfffffffffffffffd
pop eax
jmp 0x4031e9
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10

Function at 0x405d2e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d4d
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405d53
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405d82
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a580]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a584]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405dd2
test edi, edi
jne 0x405d8f
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405dcc
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
sub esp, 0x514
push esi
push edi
push 0x405740
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401160
mov edi, str.BootInst.log
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push 0x404034
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov esi, eax
test esi, esi
pop ebp
je 0x401160
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 0xa], ecx
push edx
mov dword [esp + 0x12], ecx
mov word [esp + 0xc], 0
mov dword [esp + 0x16], ecx
mov word [esp + 0x1a], cx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
and ecx, 0xffff
and eax, 0xffff
and edx, 0xffff
push eax
mov eax, dword [esp + 0x12]
push ecx
mov ecx, dword [esp + 0x12]
push edx
mov edx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x134]
push str._d__02d__02d__02d:_02d:_02d_:
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x20
lea ecx, [esp + 0x11c]
push ecx
push esi
call edi
mov eax, dword [esp + 0x528]
lea edx, [esp + 0x52c]
push edx
push eax
push esi
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0x14
push 0x404010
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
push 0x405740
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x514
ret

Function at 0x401180
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x4011b3
push ebx
push esi
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x40533c]
xor eax, edx
inc ecx
dec esi
jne 0x401193
pop esi
pop ebx
not eax
ret

Function at 0x4011c0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x40533c
mov eax, edx
mov esi, 8
test al, 1
je 0x4011dc
shr eax, 1
xor eax, 0xedb88320
jmp 0x4011de
shr eax, 1
dec esi
jne 0x4011cf
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x40573c
jl 0x4011c8
pop esi
ret
Function at 0x401790
Capabilities:
Delete file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x104
call fcn.00402170
test eax, eax
jne 0x401845
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 0x80
push 0x404b18
call ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x404b18
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x405758
push str.DefaultBackup
push 0x404370
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40182e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0xc]
push 0x404b18
push ecx
push str.default
push str.boot_loader
call esi
push 0x404b18
push 0
push 0
push 0x404370
call esi
pop esi
push 7
push 0x404b18
call ebx
pop edi
mov eax, 1
pop ebx
add esp, 0x104
ret
call fcn.00402430
test eax, eax
je 0x401855
push str._set_bootmgr_path_EFIMicrosoftBootORMLdr.efi
jmp 0x40185a
push str._default_current
push 0x40502c
call fcn.004028f0
add esp, 8
push 0x80
push 0x405130
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x405130
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0x104
ret
Function at 0x401890
Capabilities:
Delete file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
call fcn.00401790
call fcn.00402170
test eax, eax
jne 0x4019a3
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x404c1c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x404c1c
call edi
push 0x80
push 0x404d20
call esi
push 0x404d20
call edi
push 0x80
push 0x404b18
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x404b18
push 0
push 0x404c1c
push str.operating_systems
call ebx
push 0x404b18
push 0x4044e8
push str.timeout
push str.boot_loader
call ebx
push 7
push 0x404b18
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x404b18
lea eax, [esp + 0x10]
push 0x104
push eax
push 0x405758
push str.DefaultBackup
push 0x404370
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401a4d
lea ecx, [esp + 0xc]
push 0x404b18
push ecx
push str.default
push str.boot_loader
call ebx
push 0x404b18
push 0
push 0
push 0x404370
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
call fcn.00402430
test eax, eax
je 0x4019dc
push str._set_bootmgr_path_EFIMicrosoftBoot_bootmgfw.efi
push 0x40502c
call fcn.004028f0
push str._timeout_0
push 0x40502c
call fcn.004028f0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x404c1c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x404c1c
call edi
push 0x80
push 0x404d20
call esi
push 0x404d20
call edi
push str._default_current
push 0x40502c
call fcn.004028f0
push str._delete_3919457F_2759_4187_8912_C68B887E407D
push 0x40502c
call fcn.004028f0
push str._deletevalue_bootmgr_path
push 0x40502c
call fcn.004028f0
push str._timeout_0
push 0x40502c
call fcn.004028f0
add esp, 0x20
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x401fb0
Capabilities:
Get disk information via ioctl

Disassembly:
mov eax, 0x130c
call fcn.004029e0
mov eax, dword [esp + 0x1310]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1320]
xor ebx, ebx
push edi
mov ecx, 0xff
mov dword [esi], ebx
mov dword [eax], ebx
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
mov dword [esp + 0x1c], ebx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0x1c]
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40212f
mov ecx, 0x3c0
xor eax, eax
lea edi, [esp + 0x41c]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x420]
push eax
push 0xf00
push ecx
push ebx
push ebx
push 0x70050
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40205e
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4020d3
mov eax, dword [esp + 0x41c]
cmp eax, ebx
jne 0x40207b
mov edx, dword [esp + 0x420]
mov eax, dword [esi]
shr edx, 2
add eax, edx
mov dword [esi], eax
jmp 0x4020d3
mov ecx, dword [esp + 0x420]
mov edi, dword [esi]
add edi, ecx
cmp eax, 1
mov ecx, edi
mov dword [esi], edi
mov dword [esp + 0x14], ecx
jne 0x4020d3
xor edx, edx
cmp ecx, ebx
jle 0x4020d3
lea eax, [esp + 0x46c]
cmp dword [eax - 0x20], 1
jne 0x4020c7
mov ecx, 4
mov edi, 0x4030f8
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x402143
mov esi, dword [esp + 0x1324]
mov ecx, dword [esp + 0x14]
inc edx
add eax, 0x90
cmp edx, ecx
jl 0x4020a0
xor ebx, ebx
mov eax, dword [esp + 0x10]
inc eax
cmp ebp, 0xffffffff
mov dword [esp + 0x10], eax
je 0x40212f
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x20]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x402020
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x130c
ret
mov ecx, dword [esp + 0x1320]
mov eax, dword [esp + 0x10]
inc edx
pop edi
mov dword [ecx], eax
mov eax, dword [esp + 0x1320]
pop esi
pop ebp
mov dword [eax], edx
mov eax, 1
pop ebx
add esp, 0x130c
ret

Function at 0x402170
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0x94
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 8]
pop edi
cmp edx, 6
sbb eax, eax
inc eax
add esp, 0x94
ret
Function at 0x402720
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x520
push ebx
lea eax, [esp + 8]
push esi
lea ecx, [esp + 0x10]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
call fcn.00401fb0
add esp, 8
test eax, eax
je 0x4028d7
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x42d]
mov byte [esp + 0x42c], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x434]
push str.DeviceHarddisk_uPartition_u
push ecx
call esi
mov al, byte [0x40486e]
mov ecx, 0x40
mov byte [esp + 0x22], al
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
mov dx, word [0x40486c]
add esp, 0x10
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
mov word [esp + 0x18], dx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x120]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x2a], bl
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x329]
mov byte [esp + 0x328], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
push edx
lea eax, [esp + 0x330]
push str.Harddisk_uPartition_u
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x224]
lea edx, [esp + 0x328]
push 0x104
push ecx
push edx
call ebp
lea esi, [esp + 0x120]
lea eax, [esp + 0x224]
pop edi
pop ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402896
cmp cl, bl
je 0x402892
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402896
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402872
xor eax, eax
jmp 0x40289b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4028ad
pop esi
mov eax, 1
pop ebx
add esp, 0x520
ret
mov esi, dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
mov ebx, 0x30
lea eax, [esp + 0x424]
lea ecx, [esp + 8]
push eax
push ecx
push 7
mov byte [esp + 0x14], bl
call esi
test eax, eax
jne 0x40289f
inc ebx
cmp ebx, 0x39
jle 0x4028b8
pop esi
xor eax, eax
pop ebx
add esp, 0x520
ret