joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d0a4
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [ecx + 0x14]
dec eax
lea eax, [ecx + eax + 0x18]
movzx ecx, word [ecx + 6]
test ecx, ecx
je 0x41d0de
sub ecx, 1
dec eax
lea ecx, [ecx + ecx*4]
dec esp
lea ecx, [eax + ecx*8 + 0x28]
inc esp
mov eax, dword [eax + 0xc]
dec ecx
cmp eax, edx
dec esp
mov ecx, eax
ja 0x41d0d5
add ecx, dword [eax + 8]
dec eax
cmp edx, ecx
jb 0x41d0e0
dec eax
add eax, 0x28
dec esp
cmp eax, ecx
jne 0x41d0c1
xor eax, eax
repz ret

Function at 0x432ac1
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445781
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ecx], 0x44a43c
mov dword [ecx + 8], esi
mov eax, dword [ebx]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 0x14], eax
lea eax, [ebp + 0x20]
push eax
add ecx, 0x18
call fcn.0042cf74
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x18]
push ebx
push eax
lea eax, [ebp + 0x20]
add ecx, 0x20
push eax
mov edx, esi
call fcn.00432ff2
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x28], edi
mov eax, dword [ecx]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 4]
lea ecx, [esi + 0x3c]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
mov dword [esi], 0x44a748
mov dword [esi + 0x38], eax
lea eax, [ebp + 0x18]
push eax
call fcn.0042cf74
lea eax, [ebp + 0x20]
push eax
lea ecx, [esi + 0x44]
call fcn.0042cf74
mov eax, dword [ebx]
xor edi, edi
mov dword [esi + 0x50], eax
xor ecx, ecx
mov eax, dword [ebx + 4]
inc edi
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x432b8f
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
je 0x432ba4
mov ecx, dword [ebp + 0x1c]
call fcn.0042e1a0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], edi
cmp dword [ebp + 0x24], 0
je 0x432bb8
mov ecx, dword [ebp + 0x24]
call fcn.0042e1a0
mov ecx, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x432bcd
mov dword [ebp - 4], 2
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x43a3c2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x43a3d5
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x43a3f1
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x43a3e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x43dc4b
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444a4c
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4570cc]
push ecx
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x100]
push eax
lea eax, [ecx + 0xe0]
push eax
lea eax, [ecx + 0xc4]
push eax
push ecx
push ecx
lea eax, [ecx + 0xa8]
push eax
lea eax, [ecx + 0x98]
push eax
lea eax, [ecx + 0x78]
push eax
lea eax, [ecx + 0x68]
push eax
lea eax, [ecx + 0x60]
push eax
lea eax, [ecx + 0x48]
push eax
lea eax, [ecx + 0x30]
push eax
lea eax, [ecx + 0x18]
lea edx, [ecx + 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.0043996c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x440c85
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446000
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [0x469540], 0x20
je 0x440cda
push dword [ebx + 0xc]
mov edx, 0x44b870
push dword [ebx + 8]
call fcn.0043f641
mov eax, dword [0x4575f4]
mov ecx, 0x4575f4
push 0x1c135e
call dword [eax + 4]
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 0x14], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x20], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 0x14]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x20]
jne 0x440d2a
cmp ecx, edi
je 0x440d5a
mov esi, eax
mov dword [ebp - 0x20], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 0x14]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x440d2a
cmp ecx, dword [ebp - 0x20]
jne 0x440d2a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x4442b6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4451c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
and dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
inc eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x4494a8
and dword [ebx + 0x14], 0
mov dword [ebx], 0x44bda0
mov dword [ebx + 0x10], 0x44bd80
mov dword [ebx + 0x18], esi
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebx + 0x20], 0x4494a8
mov dword [ebx], 0x44bd48
mov dword [ebx + 0x10], 0x44bd38
mov dword [ebx + 0x20], 0x44bd00
mov eax, dword [esi + 0x20]
mov esi, dword [esi + 0x14]
mov edi, dword [eax + 0x428]
xor eax, eax
push eax
push eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
call dword [fcn.004481dc]
and dword [ebx + 0x48], 0
lea eax, [esi + 0x10]
mov dword [ebx + 0x4c], eax
lea ecx, [ebx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
push 0x44bc98
push edi
mov dword [ebx + 0x454], eax
call fcn.004439fa
mov dword [ebx + 0x450], eax
xor eax, eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x458], eax
mov byte [ebx + 0x45c], al
mov eax, ebx
mov dword [ebx + 0x460], 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4447a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444b6a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [edi], 0x44be1c
inc eax
lea ecx, [edi + 0x18]
mov dword [edi + 8], eax
xor ebx, ebx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0x4494a8
mov dword [ecx], ebx
push ebx
mov dword [edi + 0x14], ebx
call fcn.0042efd0
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x38]
mov dword [edi], 0x44bd10
mov dword [edi + 0x10], 0x44bcac
mov dword [edi + 0x28], eax
mov dword [ecx], ebx
mov dword [edi + 0x3c], ebx
push ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
call fcn.0042efd0
push ebx
lea ecx, [edi + 0x3c]
call fcn.0042efd0
mov ecx, dword [ebp + 8]
mov dword [edi + 0x24], ebx
mov dword [edi + 0x20], ecx
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0x32
pop eax
push 0xff
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
lea eax, [edi + 0x48]
push ebx
push eax
call fcn.00464129
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x455331
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445340
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
je 0x45536c
mov al, 1
jmp 0x4553bb
mov eax, dword [esi + 0x10]
cmp byte [eax], 0
je 0x455388
and dword [ebp - 4], 0
mov ecx, 0x4578dc
mov eax, dword [0x4578dc]
call dword [eax]
test al, al
jne 0x455368
cmp byte [esi + 0x14], 0
jne 0x455392
xor al, al
jmp 0x4553bb
lea ecx, [ebp - 0x20]
call fcn.004318e8
mov edx, esi
mov ecx, dword [eax]
sub ecx, dword [esi + 8]
mov eax, dword [eax + 4]
sbb eax, dword [esi + 0xc]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.004558b7
neg al
sbb al, al
inc al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40df1d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x44c]
push 0x401280
push eax
call esi
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x444], 0x18
mov dword [ebp - 0x43c], eax
xor ecx, ecx
lea eax, [ebp - 0x444]
mov dword [ebp - 0x440], ecx
push eax
push 0x20019
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], 0x40
push eax
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jns 0x40df9c
xor al, al
jmp 0x40e014
push 0x4012e8
lea eax, [ebp - 0x458]
push eax
call esi
lea eax, [ebp - 0x450]
push eax
push 0x210
lea eax, [ebp - 0x428]
push eax
push 2
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x42c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x40df98
mov esi, dword [sym.imp.ntdll.dll_wcsstr]
lea eax, [ebp - 0x41c]
push 0x401310
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x40e012
lea eax, [ebp - 0x41c]
push 0x401318
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x40df98
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00478d4e
mov esp, ebp
pop ebp
ret
Function at 0x40f577
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov ax, word [ecx + 0xc]
add ax, ax
mov dword [ebp - 0x28], 0x18
mov word [ebp - 8], ax
mov word [ebp - 6], ax
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push ebx
mov dword [ebp - 0x20], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp byte [ebp + 8], al
push esi
setne al
mov dword [ebp - 0x1c], 0x40
push edi
mov edi, dword [ebp + 0xc]
dec eax
push 0x20
and eax, 2
mov dword [ebp - 0x18], ebx
or eax, 1
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x100003
push edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jns 0x40f619
cmp dword [ebp + 0x14], ebx
je 0x40f68b
xor ecx, ecx
cmp esi, 0xc0000022
push 0x401054
setne cl
dec ecx
and ecx, 0x3fe
add ecx, 0x7d7
push ecx
push dword [ebp + 0x14]
call fcn.00416cfc
add esp, 0xc
jmp 0x40f68b
push 0x11
push 4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
jns 0x40f66b
cmp esi, 0x80000010
je 0x40f659
cmp esi, 0x80000011
je 0x40f652
cmp esi, 0xc00000a3
je 0x40f652
mov eax, 0x7d6
jmp 0x40f65e
mov eax, 0x830
jmp 0x40f65e
mov eax, 0xbe7
cmp dword [ebp + 0x14], ebx
je 0x40f68b
push 0x401054
push eax
jmp 0x40f60c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
push 0x90083
mov dword [ecx], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [edi]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410544
Capabilities:
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 6
xor ebx, ebx
mov ecx, 0x800
push edi
mov dword [ebp - 0xc], ebx
call fcn.004143f5
mov edi, eax
test edi, edi
jne 0x41057e
mov eax, 0xc000009a
jmp 0x4105cf
push 0x800
push ebx
push edi
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x800
push edi
push 0xc
push eax
push 0x2d1400
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x24]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x4105b9
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x4105c0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, edi
mov dword [esi + 0x140], eax
call fcn.0041457e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478d4e
mov esp, ebp
pop ebp
ret
Function at 0x41309d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x47d100], 0
push esi
je 0x4130c4
xor eax, eax
inc eax
jmp 0x4131d5
push 0x14
pop eax
push 0x16
mov word [ebp - 0x74], ax
xor ecx, ecx
pop eax
push 0x5a
mov word [ebp - 0x72], ax
pop eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7c]
push 0x5c
pop esi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x94]
push eax
push 0x20019
lea eax, [ebp - 0x6c]
mov byte [0x47d100], 1
push eax
mov dword [ebp - 0x70], 0x401584
mov dword [ebp - 0x78], 0x4015a0
mov word [ebp - 0x7a], si
mov dword [ebp - 0x94], 0x18
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x88], 0x40
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x4131d3
lea eax, [ebp - 0xa8]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
push 1
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, 0x80000005
je 0x4131d3
push dword [ebp - 0x6c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4131d3
cmp dword [ebp - 0x5c], 0
je 0x4131d3
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x68]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
add eax, ecx
push eax
lea eax, [ebp - 0xa4]
push eax
call esi
push 0x4015fc
lea eax, [ebp - 0x9c]
push eax
call esi
push 1
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.ntdll.dll_RtlPrefixUnicodeString]
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x30002
add ecx, 0x10000
mov dword [0x47a008], ecx
jmp 0x4130bc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00478d4e
mov esp, ebp
pop ebp
ret
Function at 0x4143f5
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
or esi, 0xffffffff
mov dword [esp + 8], ecx
xor edx, edx
mov dword [esp + 0xc], 0xffffd8f0
push edi
mov dword [esp + 0x14], esi
inc edx
mov ebx, 0x47d104
xor eax, eax
lock cmpxchg dword [ebx], edx
xor ecx, ecx
test eax, eax
je 0x41445b
xor esi, esi
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtDelayExecution]
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x41443d
or esi, 0xffffffff
xor ecx, ecx
mov edi, dword [0x47a010]
mov eax, edi
mov ebx, dword [0x47a014]
and eax, ebx
cmp eax, esi
jne 0x414519
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [esp + 0x1c]
push ecx
push 0x2c
push eax
push ecx
call edi
test eax, eax
jns 0x414499
mov ecx, 0x47d104
lock xadd dword [ecx], esi
dec esi
xor eax, eax
jmp 0x414564
xor ecx, ecx
lea eax, [esp + 0x48]
push ecx
push 0x158
push eax
push 2
call edi
test eax, eax
js 0x414488
mov eax, dword [esp + 0x74]
mul dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x38]
mov ebx, edx
xor edx, edx
mov edi, eax
cmp edx, ebx
ja 0x4144d2
jb 0x4144ce
cmp ecx, edi
jae 0x4144d2
mov edi, ecx
mov ebx, edx
mov eax, edi
and eax, ebx
cmp eax, esi
jne 0x4144df
push 0xfffffffffffffffe
pop edi
mov ebx, esi
cmp ebx, edx
ja 0x4144ff
jb 0x4144ed
cmp edi, 0x19000
ja 0x4144ff
mov edi, edx
mov ebx, edx
mov dword [0x47a010], edi
mov dword [0x47a014], ebx
jmp 0x41451b
push edx
push 0xa
push ebx
push edi
call sub.ntdll.dll__aulldiv
sub edi, eax
mov dword [0x47a010], edi
sbb ebx, edx
mov dword [0x47a014], ebx
xor edx, edx
cmp edx, ebx
jb 0x414532
ja 0x414488
mov ebx, dword [esp + 0xc]
cmp ebx, edi
jbe 0x414536
jmp 0x414488
mov ebx, dword [esp + 0xc]
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
je 0x41455a
sub dword [0x47a010], ebx
push 0
pop ecx
sbb dword [0x47a014], ecx
mov ecx, 0x47d104
lock xadd dword [ecx], esi
dec esi
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00478d4e
mov esp, ebp
pop ebp
ret

Function at 0x41996b
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push esi
push edi
push 4
push 0x28
push eax
lea eax, [ebp - 0x3c]
mov esi, ecx
push eax
push esi
mov edi, edx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x4199a2
xor al, al
jmp 0x4199c2
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebx], eax
lea eax, [ebp - 0x34]
push 0x28
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], edi
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
setns al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478d4e
mov esp, ebp
pop ebp
ret 4
Function at 0x4199da
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
xor edi, edi
mov esi, edx
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x4199f7
mov al, 1
jmp 0x419aae
mov eax, dword [ecx + 8]
mov dword [ebp - 8], eax
mov ax, word [ecx + 0xc]
add ax, ax
mov dword [ebp - 0x38], 0x18
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push 1
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], edi
push eax
push 0x12019f
lea eax, [ebp - 4]
mov dword [ebp - 0x2c], 0x40
push eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
cmp eax, 0xc000000f
je 0x419a51
cmp eax, 0xc0000034
jne 0x419a75
push edi
push edi
push 0x40
push 5
push edi
push 0x80
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x12019f
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x419a7d
xor al, al
jmp 0x419aae
or dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x18]
or dword [ebp - 0x14], 0xffffffff
push edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtWriteFile]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
setns al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x419b82
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xa
mov dword [ebp - 0x190], ecx
lea edi, [ebp - 0x2c]
pop ecx
mov esi, edx
mov dword [ebp - 0x18c], eax
xor edx, edx
xor eax, eax
mov dword [ebp - 0x30], edx
push 0x154
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], edx
push eax
call sub.ntdll.dll_memset
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x30]
add esp, 0xc
push 0
push 0x2c
push eax
push 0
call edi
test eax, eax
jns 0x419bf2
xor al, al
jmp 0x419c50
push 0
push 0x158
lea eax, [ebp - 0x188]
push eax
push 2
call edi
test eax, eax
js 0x419bee
mov eax, dword [ebp - 0x190]
mov edi, dword [ebp - 0x28]
test eax, eax
je 0x419c17
mov dword [eax], edi
test ebx, ebx
je 0x419c27
mov eax, dword [ebp - 0x15c]
and dword [ebx + 4], 0
mov dword [ebx], eax
test esi, esi
je 0x419c34
mov eax, dword [ebp - 0x24]
and dword [esi + 4], 0
mov dword [esi], eax
mov ecx, dword [ebp - 0x18c]
test ecx, ecx
je 0x419c4e
mov eax, dword [ebp - 0x10]
xor edx, edx
sub eax, dword [ebp - 0x14]
div edi
and dword [ecx + 4], 0
mov dword [ecx], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478d4e
mov esp, ebp
pop ebp
ret 8
Function at 0x419c92
Capabilities:
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x38]
push edi
mov dword [ebp - 0x20], edx
call fcn.004180a8
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0
push 0x20
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x10], 0
pop edi
push edi
mov dword [ebp - 0x14], 1
call fcn.00418110
test eax, eax
je 0x419d75
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push esi
push 0xc
push eax
push 0x2d1400
xor ecx, ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
push ecx
push ecx
push dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x419d75
cmp dword [esi], edi
jne 0x419d75
cmp dword [esi + 4], edi
jne 0x419d75
cmp dword [ebp - 0x18], edi
jne 0x419d75
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x419d43
mov al, byte [esi + 0x18]
mov edx, 0x401984
cmp al, 0xe
jae 0x419d37
movzx eax, al
mov edx, dword [eax*4 + 0x401a34]
push 0xffffffffffffffff
push edx
call fcn.00413735
test al, al
je 0x419d75
test ebx, ebx
je 0x419d70
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 8]
test al, al
je 0x419d75
movzx eax, word [esi + 0x1c]
mov ecx, dword [ebx]
push eax
movzx eax, word [esi + 0x1a]
push eax
push 0x401a18
push ebx
call dword [ecx + 0x10]
add esp, 0x10
test al, al
je 0x419d75
xor ebx, ebx
inc ebx
jmp 0x419d77
xor bl, bl
lea ecx, [ebp - 0x38]
call fcn.004180f3
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478d4e
mov esp, ebp
pop ebp
ret 4

Function at 0x41a816
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0041a785
lea eax, [eax*2 + 2]
push eax
push esi
push 7
push 0x401abc
push 0x401ad4
push 2
call dword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
xor ecx, ecx
test eax, eax
pop esi
setns al
ret