joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aca0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xe8
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0xe4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xf4]
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0x19]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x20], bl
call fcn.0047c020
push 0x3f
lea ecx, [esp + 0xc5]
push ebx
push ecx
mov byte [esp + 0xcc], bl
call fcn.0047c020
push 0x3f
lea edx, [esp + 0x71]
push ebx
push edx
call fcn.0047c020
add esp, 0x24
xor eax, eax
lea ecx, [ecx]
mov ecx, eax
shr ecx, 3
movsx edx, byte [ecx + esi]
mov ecx, eax
and ecx, 7
shl edx, cl
inc eax
sar edx, 7
and dl, 1
mov byte [esp + eax + 0x13], dl
cmp eax, 0x40
jb 0x45ad00
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x14]
call fcn.0045b170
mov ecx, 8
lea esi, [esp + 0xb4]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0xd4]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
lea esp, [esp]
lea eax, [esp + 0x94]
push eax
lea edx, [esp + 0x18]
mov ecx, 0xf
push edx
sub ecx, esi
mov edx, ebp
call fcn.0045aee0
inc esi
cmp esi, 0x10
jl 0x45ad60
mov ecx, 8
lea esi, [esp + 0x94]
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x14]
lea edi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
lea eax, [ebp + 0x641]
lea ebx, [ebx]
movsx edx, byte [ecx + 0x4a5868]
movzx edx, byte [esp + edx + 0x53]
mov byte [eax + ecx - 1], dl
movsx edx, byte [ecx + 0x4a5869]
movzx edx, byte [esp + edx + 0x53]
mov byte [eax + ecx], dl
movsx edx, byte [ecx + 0x4a586a]
movzx edx, byte [esp + edx + 0x53]
mov byte [eax + ecx + 1], dl
movsx edx, byte [ecx + 0x4a586b]
movzx edx, byte [esp + edx + 0x53]
mov byte [eax + ecx + 2], dl
add ecx, 4
cmp ecx, 0x40
jl 0x45adb0
xor ecx, ecx
mov dword [ebp + 0x688], ecx
mov dword [ebp + 0x68c], ecx
lea esi, [ecx + 2]
mov ecx, 0xfffff9c2
sub ecx, ebp
mov ebx, 0xfffff9bf
mov dword [esp + 0x10], ecx
sub ebx, ebp
lea ebx, [ebx]
lea edx, [ebx + eax]
mov ecx, edx
shr ecx, 3
lea edi, [ecx + ebp + 0x688]
and edx, 7
mov ecx, 7
sub ecx, edx
movzx edx, byte [eax - 1]
shl dl, cl
lea ecx, [esi - 1]
shr ecx, 3
or byte [edi], dl
lea edi, [ecx + ebp + 0x688]
lea edx, [esi - 1]
and edx, 7
mov ecx, 7
sub ecx, edx
movzx edx, byte [eax]
shl dl, cl
mov ecx, esi
shr ecx, 3
or byte [edi], dl
lea edi, [ecx + ebp + 0x688]
mov edx, esi
and edx, 7
mov ecx, 7
sub ecx, edx
movzx edx, byte [eax + 1]
shl dl, cl
mov ecx, dword [esp + 0x10]
add esi, 4
or byte [edi], dl
lea edx, [ecx + eax]
mov ecx, edx
shr ecx, 3
lea edi, [ecx + ebp + 0x688]
and edx, 7
mov ecx, 7
sub ecx, edx
movzx edx, byte [eax + 2]
shl dl, cl
add eax, 4
lea ecx, [ebx + eax]
or byte [edi], dl
cmp ecx, 0x40
jb 0x45ae20
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00476dfd
add esp, 0xe8
ret 4
Function at 0x45b170
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, str.:2_
mov edi, 0x4a55d9
mov ebp, 0x4a55da
mov edx, 0x4a55db
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
mov dword [esp + 0x10], 0x10
lea esp, [esp]
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
sub dword [esp + 0x10], 1
jne 0x45b1a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x45b1e0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, 0x4a561c
sub ebx, eax
push edi
mov dword [esp + 0x14], ebx
mov esi, 0x4a5618
mov edi, 0x4a5619
mov ebp, 0x4a561a
mov edx, 0x4a561b
mov ebx, 0x4a561d
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
sub ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 8
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
mov ebx, dword [esp + 0x14]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 4], bl
mov ebx, dword [esp + 0x18]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 5], bl
add eax, 6
sub dword [esp + 0x10], 1
jne 0x45b221
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x45b370
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x4a5848
mov edi, 0x4a5849
mov ebp, 0x4a584a
mov edx, 0x4a584b
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
mov dword [esp + 0x10], 8
lea esp, [esp]
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
sub dword [esp + 0x10], 1
jne 0x45b3a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x462140
Capabilities:
Get disk information

Disassembly:
sub esp, 0x634
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x630], eax
push esi
push 0x104
lea eax, [esp + 0x14]
push eax
mov esi, 0x1234abcd
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
cmp eax, ecx
je 0x46220f
cmp eax, 0x104
ja 0x46220f
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
mov ax, word [esp + 0x10]
cmp ax, 0x41
jb 0x462197
cmp ax, 0x5a
jbe 0x4621a4
mov eax, dword [esp + 0x10]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x4621ab
xor edx, edx
mov word [esp + 0x16], dx
push 0x104
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x462209
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.00476dfd
add esp, 0x634
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x634]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x634
ret

Function at 0x462230
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4c8f94]
push esi
mov esi, dword [0x4c8f9c]
push 0x104
push eax
lea ecx, [esi + 0x14]
push 0x105
push ecx
call fcn.0047835b
add esp, 0x10
cmp dword [esi], 0xffffffff
mov dword [esi + 0x224], 0x421780
mov dword [esi + 0x220], 0x421190
je 0x46227c
mov dword [esi + 0x10], 0
mov eax, 1
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x462320
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00477643
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4622b0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x224]
test eax, eax
je 0x4622c7
mov ecx, dword [esi + 0x228]
push ecx
push esi
call eax
add esp, 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x46230a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x462301
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
Function at 0x46d8c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x498052
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x4c8f40
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x4c2bdc], eax
call esi
push 0x4c77c0
push 0x20
mov dword [0x4c2bd8], eax
call fcn.004776f3
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebx
cmp esi, ebx
je 0x46d95e
push 4
call fcn.00476efa
add esp, 4
cmp eax, ebx
je 0x46d94c
mov dword [eax], esi
mov dword [esi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
jmp 0x46d960
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
jmp 0x46d960
xor esi, esi
lea eax, [esp + 0xc]
push eax
push 4
push ebx
push 0x46d600
push ebx
push ebx
mov dword [0x4c9440], esi
mov dword [esp + 0x24], ebx
call fcn.00477643
or ecx, 0xffffffff
add esp, 0x18
mov dword [0x4c2be0], eax
cmp eax, ecx
je 0x46d9bf
cmp dword [0x4c2bdc], ecx
je 0x46d9bf
cmp dword [0x4c2bd8], ecx
je 0x46d9bf
mov byte [0x4c943c], 1
mov byte [0x4c93e3], bl
lea eax, [ecx + 2]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x46d9e0
Capabilities:
Terminate thread

Disassembly:
mov al, 1
cmp byte [0x4c93e3], al
je 0x46d9fb
mov byte [0x4c93e3], al
mov eax, dword [0x4c2bdc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x4c2be0]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x46da23
mov edx, dword [0x4c2be0]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4c2be0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push eax
call esi
or edi, 0xffffffff
push 0x4c8f40
mov dword [0x4c2be0], edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x4c2bdc]
cmp eax, edi
je 0x46da59
push eax
call esi
mov dword [0x4c2bdc], edi
mov eax, dword [0x4c2bd8]
cmp eax, edi
je 0x46da6b
push eax
call esi
mov dword [0x4c2bd8], edi
mov esi, dword [0x4c9440]
test esi, esi
je 0x46da97
mov edi, esi
call fcn.00425460
mov ecx, dword [edi]
push ecx
call fcn.00476df2
push edi
call fcn.00476df2
add esp, 8
mov dword [0x4c9440], 0
pop edi
mov byte [0x4c943c], 0
pop esi
ret
Function at 0x46f960
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00473740
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.004737e0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x68
ret
Function at 0x46faf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4ada5c
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46fc81
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46fb83
cmp dword [esp + 0x14], 1
jne 0x46fc68
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x46fc68
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46fbc8
cmp dword [esp + 0x14], 1
jne 0x46fc68
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46fc68
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46fbff
cmp dword [esp + 0x14], 1
jne 0x46fc68
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46fc68
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x46fc68
cmp dword [esp + 0x14], 3
jne 0x46fc68
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x46fc68
lea eax, [esi + 0xc]
call fcn.0046f9d0
test eax, eax
je 0x46fc68
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4700b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00472280
add esp, 8
test eax, eax
jne 0x47011b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00476dfd
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x470130
push esi
lea ecx, [esp + 0x14]
call fcn.00473740
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.004737e0
test edi, edi
je 0x47014e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00476dfd
add esp, 0x6c
ret

Function at 0x470190
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00472480
add esp, 4
test eax, eax
jne 0x4701ee
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00476dfd
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.004737e0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00476dfd
add esp, 0x64
ret

Function at 0x470210
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00472570
add esp, 8
test eax, eax
jne 0x47028f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00476dfd
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00473330
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00476dfd
add esp, 0x74
ret

Function at 0x470bc0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x470bf2
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.00474620
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x470c17
push 0x4adbf0
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.00474750
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x4720f0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x47213d
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.00474620
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x4721d4
jg 0x472163
cmp ebx, ecx
jb 0x4721d4
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x472199
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.00474620
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00470bc0
test eax, eax
je 0x47218f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4721ba
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4721e1
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4721e1
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x472a90
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x472bd0
cmp dword [esp + 0x28], ebp
je 0x472bd0
push edi
push 0x2800
call fcn.004770ed
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x472af3
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00476dfd
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x472b00
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.00470a90
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x472ba6
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.0047c020
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x472b99
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x472b99
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00472840
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x472bb0
inc ebx
cmp ebx, 0x10
jl 0x472b00
push edi
call fcn.004771b7
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00476dfd
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.00476dfd
add esp, 0x1c
ret
Function at 0x472c80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x472cba
cmp dword [esp + 0x34], esi
je 0x472cba
push 0x200
call fcn.004770ed
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x472cc5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472e24
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x472dba
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x472d1d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472d93
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x472d88
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.00472bf0
cmp edx, ebx
jb 0x472d88
ja 0x472d82
cmp eax, dword [esp + 0x24]
jbe 0x472d88
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x472d10
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x472dd0
cmp dword [esp + 0x24], 0
jbe 0x472e24
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.00470a90
add esp, 0x10
test eax, eax
jne 0x472e09
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.004771b7
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push edi
push edx
push str.MAC:
call fcn.00472840
add esp, 0xc
mov dword [esp + 0x18], eax
push edi
call fcn.004771b7
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret