joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1000aed3
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.1000bee0
add esp, 4
test eax, eax
jne 0x1000aee5
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x1000afa6
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x1000b023
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x1000af2e
mov esi, dword [ebx]
jmp 0x1000af42
push ebx
call fcn.1000bf10
mov esi, eax
add esp, 4
test esi, esi
je 0x1000af86
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x1000af6d
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000af6d
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x1000af7a
push esi
call fcn.1000cc42
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000b023
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x1000af1e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x1000b023
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x1000b023
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x1000afd7
mov esi, dword [ebx]
jmp 0x1000afeb
push ebx
call fcn.1000bf10
mov esi, eax
add esp, 4
test esi, esi
je 0x1000b015
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x1000b008
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x1000b015
push esi
call fcn.1000cc42
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x1000afc7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret

Function at 0x1000b6e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000b6fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000b6f3
pop esi
ret
Function at 0x401db8
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401dbe
call fcn.0045e790
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0044e000
push dword [esp + 0x2c]
call fcn.0045ac20
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x401e6e
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [esp + 0x18]
call sub.kernel32.dll_CreateFileW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
je 0x401e65
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x34]
push dword [esp + 0x10]
push dword [esp + 0x20]
call sub.kernel32.dll_ReadFile
push dword [esp + 0x14]
push dword [esp + 8]
push dword [esp + 0x24]
call sub.ntdll.dll_RtlComputeCrc32
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x401e24
push dword [esp + 0x10]
call sub.kernel32.dll_CloseHandle
push dword [esp + 4]
call fcn.0045ac40
mov eax, dword [esp + 0x1c]
jmp 0x401e76
push dword [esp + 0xc]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x20
pop ebx
ret 0xc
Function at 0x401f41
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
mov edx, 0x2b
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401f48
call fcn.0045e790
push dword [esp + 0xc0]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str..PHYSICALDRIVE
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, dword [esp + 0xe0]
cdq
push edx
push eax
call fcn.0044f300
pop eax
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_CreateFileW
call fcn.0044e2f0
mov dword [esp + 0x9c], eax
mov ebx, dword [esp + 0x9c]
cmp ebx, 0xffffffff
jne 0x401fe9
jmp 0x402189
push 0x400
call fcn.0045ac20
mov dword [esp + 0xa4], eax
cmp dword [esp + 0xa4], 0
je 0x402162
push 0
lea eax, [esp + 0x94]
push eax
push 0x400
push dword [esp + 0xb0]
push dword [esp + 0xac]
call sub.kernel32.dll_ReadFile
and eax, eax
je 0x402156
push 0
lea eax, [esp + 0xa4]
push eax
push 0x90
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x70048
push dword [esp + 0xb8]
call sub.kernel32.dll_DeviceIoControl
push dword [esp + 0x9c]
call sub.kernel32.dll_CloseHandle
lea ebp, [esp]
cmp dword [ebp], 0
je 0x40208c
mov dword [esp + 0x94], 1
jmp 0x402156
cmp dword [esp + 0xbc], 0
je 0x4020b7
mov ebp, dword [esp + 0xa4]
movsx ebx, word [ebp]
cmp ebx, 0xffffc033
jne 0x4020b7
mov ebp, dword [esp + 0xbc]
mov dword [ebp], 1
mov ebx, dword [esp + 0xa4]
add ebx, 0x1be
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x98], 1
jmp 0x4020d8
mov eax, 4
cmp eax, dword [esp + 0x98]
jl 0x402156
mov ebp, dword [esp + 0xa8]
movzx ebx, byte [ebp]
push ebx
mov ebx, pe_nt_image_headers32
cmp ebx, dword [esp]
jne 0x402118
mov ebx, dword [esp + 0x98]
add ebx, dword [esp + 0x9c]
mov dword [esp + 0x98], ebx
add esp, 4
jmp 0x402156
mov ebx, 5
cmp ebx, dword [esp]
je 0x40212c
mov ebx, 0xf
cmp ebx, dword [esp]
jne 0x40213b
mov ebx, dword [esp + 0x98]
dec ebx
mov dword [esp + 0x98], ebx
pop eax
mov ebx, dword [esp + 0xa8]
add ebx, 0x10
mov dword [esp + 0xa8], ebx
inc dword [esp + 0x98]
jno 0x4020d8
push dword [esp + 0xa4]
call fcn.0045ac40
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x98]
push dword [esp + 0xc0]
call fcn.0041aff0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x402193
call fcn.0045e820
mov word [eax], 0
add esp, 0xac
pop ebx
pop ebp
ret 8
Function at 0x402cc4
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0045e790
call sub.kernel32.dll_GetConsoleWindow
mov dword [esp], eax
cmp dword [esp], 0
je 0x402db2
call sub.user32.dll_GetForegroundWindow
mov dword [esp + 4], eax
push dword [esp]
call sub.user32.dll_SetForegroundWindow
and eax, eax
je 0x402db2
push 0
push 0
mov eax, str.FARADMINMODE
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
and eax, eax
je 0x402d77
push 0
push 1
push 0
push 0xa2
call sub.user32.dll_keybd_event
push 0
push 1
push 0
push 0x4f
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x4f
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0xa2
call sub.user32.dll_keybd_event
jmp 0x402da9
push 0
push 1
push 0
push 0xd
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0xd
call sub.user32.dll_keybd_event
push dword [esp + 4]
call sub.user32.dll_SetForegroundWindow
xor eax, eax
add esp, 8
ret
Function at 0x404184
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x28]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x100
call fcn.0044f2b0
lea eax, [esp + 8]
push eax
call fcn.0045e660
mov eax, dword [esp + 4]
push eax
push 0x100
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x404282
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x10]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x10], ebx
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x18]
call fcn.0044f2b0
lea eax, [esp + 0x10]
push eax
call fcn.0045e660
mov eax, dword [esp + 0xc]
push eax
pop eax
mov dword [esp], eax
mov dword [esp + 8], 1
jmp 0x404232
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 8]
jl 0x404279
push dword [esp + 0x14]
call sub.kernel32.dll_GetDriveTypeW
mov ebx, eax
cmp ebx, dword [esp + 0x24]
jne 0x404268
mov ebp, dword [esp + 0x14]
movzx eax, word [ebp]
push eax
mov ebp, dword [esp + 4]
pop eax
mov word [ebp], ax
mov ebx, dword [esp]
add ebx, 2
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
add ebx, 8
mov dword [esp + 0x14], ebx
inc dword [esp + 8]
jno 0x404232
mov ebp, dword [esp]
mov word [ebp], 0
mov edx, dword [esp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x4042aa
push dword [esp + 0xc]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0x18
pop ebx
pop ebp
ret 4
Function at 0x40acbb
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40acc2
call fcn.0045e790
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x40acf7
xor eax, eax
jmp 0x40ae1b
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 1
push dword [esp + 0x14]
call fcn.0044f540
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044ff80
lea eax, [esp + 4]
push eax
call fcn.0045e660
mov eax, dword [esp]
push eax
pop eax
mov dword [esp + 4], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x100
call fcn.0044f2b0
lea eax, [esp + 0xc]
push eax
call fcn.0045e660
mov eax, dword [esp + 8]
push eax
push 0x100
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x40ae19
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x14]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 1
jmp 0x40adaf
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
jl 0x40ae19
mov ebp, dword [esp + 4]
movzx ebx, word [ebp]
mov ebp, dword [esp + 0x10]
movzx eax, word [ebp]
cmp ebx, eax
jne 0x40ae08
push dword [esp + 0x10]
call sub.kernel32.dll_GetDriveTypeW
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 2
je 0x40adee
mov ebx, dword [esp + 0x18]
cmp ebx, 3
je 0x40adee
jmp 0x40adf5
mov eax, 1
jmp 0x40adf7
xor eax, eax
and eax, eax
je 0x40ae04
mov eax, 1
jmp 0x40ae1b
xor eax, eax
jmp 0x40ae1b
mov ebx, dword [esp + 0x10]
add ebx, 8
mov dword [esp + 0x10], ebx
inc dword [esp + 0xc]
jno 0x40adaf
xor eax, eax
push dword [esp]
call fcn.0045e7f0
push dword [esp + 8]
call fcn.0045e7f0
add esp, 0x1c
pop ebx
pop ebp
ret 4

Function at 0x40b18d
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
call fcn.0045e790
push dword [esp + 8]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
call fcn.0045e850
lea eax, [esp + 4]
push eax
call fcn.0045e660
push 0x104
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, dword [esp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x40b1fd
push dword [esp]
call fcn.0045e7f0
add esp, 4
ret
Function at 0x40c1f9
Capabilities:
Get disk size

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40c1ff
call fcn.0045e790
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0044e000
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
push dword [esp + 0x18]
push dword [esp + 0x18]
push 0
push 0x100000
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0044e010
mov dword [esp], eax
mov dword [esp + 4], edx
pop eax
pop edx
jmp 0x40c264
push edx
push dword [esp + 4]
call fcn.0045e7f0
pop edx
add esp, 0x1c
pop ebx
ret 4

Function at 0x40c276
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40c27c
call fcn.0045e790
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x34]
lea ecx, [esp + 4]
call fcn.0044e000
push dword [esp + 4]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x40c2c8
mov ebp, dword [0x473568]
push dword [ebp]
pop eax
mov dword [esp + 8], eax
jmp 0x40c2df
push 2
push 0
push dword [esp + 0xc]
call sub.kernel32.dll_LoadLibraryExW
mov dword [esp + 8], eax
push dword [esp + 0x30]
push dword [esp + 4]
push dword [esp + 0x34]
push dword [esp + 0x14]
call sub.kernel32.dll_FindResourceExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x40c373
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.kernel32.dll_SizeofResource
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40c371
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.kernel32.dll_LoadResource
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x40c371
push dword [esp + 0x14]
call sub.kernel32.dll_LockResource
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x40c371
push dword [esp + 0x10]
call fcn.0045ac20
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x40c368
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0045ada0
push dword [esp + 0x18]
call sub.kernel32.dll_FreeResource
jmp 0x40c373
push dword [esp + 4]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
jne 0x40c38d
push dword [esp + 8]
call sub.kernel32.dll_FreeLibrary
mov eax, dword [esp + 0x1c]
jmp 0x40c395
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x20
pop ebp
ret 0x10
Function at 0x40cfad
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40cfb4
call fcn.0045e790
mov edx, dword [esp + 0x3c]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
call fcn.0044f9d0
mov ebx, eax
add ebx, ebx
add ebx, 4
push ebx
call fcn.0045ac20
push eax
lea ebp, [esp + 8]
pop eax
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x40d049
mov eax, dword [esp]
push eax
lea ebp, [esp + 8]
push dword [ebp + 8]
call sub.MSVCRT.dll_wcscpy
add esp, 8
lea ebp, [esp + 4]
mov dword [ebp + 4], 3
mov word [ebp + 0x10], 0x614
lea eax, [esp + 4]
push eax
call sub.shell32.dll_SHFileOperationW
mov ebx, eax
and ebx, ebx
jne 0x40d034
mov dword [esp + 0x28], 1
jmp 0x40d03d
call sub.kernel32.dll_GetLastError
mov dword [esp + 0x2c], eax
lea ebp, [esp + 4]
push dword [ebp + 8]
call fcn.0045ac40
cmp dword [esp + 0x28], 0
je 0x40d054
xor eax, eax
jmp 0x40d059
mov eax, 1
and eax, eax
je 0x40d05d
mov eax, dword [esp + 0x28]
jmp 0x40d065
push dword [esp]
call fcn.0045e7f0
add esp, 0x30
pop ebx
pop ebp
ret 4

Function at 0x40d075
Capabilities:
Get token membership

Disassembly:
push ebp
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0045e790
lea ebp, [esp + 8]
push ebp
pop ebp
mov byte [ebp + 5], 5
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x30]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [esp], eax
cmp dword [esp], 0
je 0x40d0de
cmp dword [esp + 4], 0
je 0x40d0de
mov eax, 1
jmp 0x40d0e0
xor eax, eax
and eax, eax
je 0x40d117
lea eax, [esp]
push eax
push dword [esp + 8]
push 0
call sub.advapi32.dll_CheckTokenMembership
and eax, eax
je 0x40d0fe
xor eax, eax
jmp 0x40d103
mov eax, 1
and eax, eax
je 0x40d10e
mov dword [esp], 0
push dword [esp + 4]
call sub.advapi32.dll_FreeSid
mov eax, dword [esp]
jmp 0x40d11e
add esp, 0x10
pop ebp
ret

Function at 0x40dfc2
Capabilities:
Open registry key via offline registry library

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.0044e000
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40dfe4
xor eax, eax
jmp 0x40e005
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push dword [esp + 0x18]
call sub.Toolsx86offreg.dll_OROpenKey
mov ebx, eax
and ebx, ebx
jne 0x40e003
mov eax, dword [esp + 4]
jmp 0x40e005
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 8
pop ebx
ret 8
Function at 0x40e0ef
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x20]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
lea eax, [esp + 4]
push eax
call fcn.0045e660
mov edx, 0x46165c
lea ecx, [esp + 0x10]
call fcn.0044e008
mov eax, dword [esp + 0x10]
push eax
pop eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
jmp 0x40e14c
mov eax, 0x1a
cmp eax, dword [esp + 8]
jl 0x40e1b8
push 0x104
mov eax, dword [esp + 4]
push eax
push dword [esp + 0x14]
call sub.kernel32.dll_QueryDosDeviceW
and eax, eax
je 0x40e19f
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, dword [esp + 4]
push edx
call fcn.0045e6f0
mov edx, 0x4629b0
push edx
call fcn.0045e6f0
lea eax, [esp + 8]
push eax
call fcn.0045e660
mov ebp, dword [esp + 0xc]
movzx ebx, word [ebp]
inc ebx
push ebx
mov ebp, dword [esp + 0x10]
pop eax
mov word [ebp], ax
inc dword [esp + 8]
jno 0x40e14c
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x40e1e0
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp + 0x10]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40fc55
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0x18f
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40fc5c
call fcn.0045e790
push dword [esp + 0x648]
call fcn.0044e2f0
mov dword [esp + 8], 0x104
lea eax, [esp]
push eax
push 1
push 0
mov eax, str.SYSTEMSetup
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x40fd50
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
mov eax, str.SystemPartition
push eax
push dword [esp + 0x14]
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x40fd48
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 7
lea edx, [esp + 0x18]
push edx
call fcn.0045e620
pop edx
push eax
push 0x105
push edx
call fcn.0045e880
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f540
call fcn.0045e850
mov edx, str.ramdisk
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x40fd48
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x40ff08
push dword [esp]
call sub.advapi32.dll_RegCloseKey
lea edx, [esp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push 0x105
push edx
call fcn.0045e880
call fcn.0045e850
mov edx, 0x46105e
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x40fda3
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x40ff08
lea eax, [esp + 0x21c]
push eax
push 0x100
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x638], eax
cmp dword [esp + 0x638], 0
je 0x40fefe
lea eax, [esp + 0x21c]
push eax
pop eax
mov dword [esp + 0x218], eax
mov ebx, dword [esp + 0x638]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x638], ebx
mov dword [esp + 0x428], 1
jmp 0x40fe01
mov eax, dword [esp + 0x638]
cmp eax, dword [esp + 0x428]
jl 0x40fefe
mov ebx, dword [esp + 0x218]
add ebx, 4
mov dword [esp + 0x218], ebx
mov ebp, dword [esp + 0x218]
mov word [ebp], 0
mov ebx, dword [esp + 0x218]
add ebx, 0xfffffffc
mov dword [esp + 0x218], ebx
push 0x100
lea eax, [esp + 0x430]
push eax
push dword [esp + 0x220]
call sub.kernel32.dll_QueryDosDeviceW
and eax, eax
je 0x40fee0
lea edx, [esp + 0x42c]
push edx
call fcn.0045e620
pop edx
push eax
push 0x105
push edx
call fcn.0045e880
call fcn.0045e850
lea edx, [esp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push 0x105
push edx
call fcn.0045e880
call fcn.0044e340
mov edx, eax
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x40fee0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x228]
call fcn.0045ac80
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x40ff08
mov ebx, dword [esp + 0x218]
add ebx, 8
mov dword [esp + 0x218], ebx
inc dword [esp + 0x428]
jno 0x40fe01
call fcn.0045e820
mov word [eax], 0
add esp, 0x63c
pop ebx
pop ebp
ret
Function at 0x41061b
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x410622
call fcn.0045e790
push dword [esp + 0x30]
call fcn.0044e2f0
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push edx
call fcn.0045e620
pop edx
push eax
mov edx, 0x464f08
push edx
call fcn.0045e6f0
mov edx, dword [esp + 0x20]
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_CreateFileW
call fcn.0044e2f0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
jne 0x4106cd
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x410849
push 0x400
call fcn.0045ac20
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x4107c9
push 0
lea eax, [esp + 0xc]
push eax
push 0x400
push dword [esp + 0x1c]
push dword [esp + 0x14]
call sub.kernel32.dll_ReadFile
and eax, eax
je 0x4107c9
mov dword [esp + 0x1c], pe_nt_image_headers32
jmp 0x410714
mov eax, 0x3e8
cmp eax, dword [esp + 0x1c]
jl 0x4107c9
push 0xa
mov ebp, str.NTLDR
push ebp
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x24]
push ebx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x41074a
mov byte [esp + 0x14], 1
push 5
mov ebp, 0x46fe8c
push ebp
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x24]
push ebx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x410771
mov byte [esp + 0x14], 1
push 0xe
mov ebp, 0x46fe91
push ebp
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x24]
push ebx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x410798
mov byte [esp + 0x18], 1
push 7
mov ebp, 0x46fe9f
push ebp
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x24]
push ebx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x4107bf
mov byte [esp + 0x18], 1
inc dword [esp + 0x1c]
jno 0x410714
push dword [esp + 4]
call sub.kernel32.dll_CloseHandle
cmp byte [esp + 0x18], 0
je 0x4107fa
mov edx, str.BOOTMGR
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x410849
cmp byte [esp + 0x14], 0
je 0x410820
mov edx, 0x462640
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x410849
mov edx, str.UNBOOTABLE___
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x410849
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x20
pop ebx
pop ebp
ret 4