joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4841c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b0788
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x48422a
cmp dword [edi + 0x18], eax
je 0x48422a
push ebx
push eax
call fcn.004020d0
test al, al
je 0x48422a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x484223
mov eax, dword [edi + 4]
jmp 0x484226
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x4843fe
jmp 0x484246
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x4843fe
cmp al, 0x5c
jne 0x484348
cmp esi, ecx
je 0x484363
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x484287.35
movzx eax, byte [eax + 0x484440]
jmp dword [eax*4 + 0x484418]
push 0x22
jmp 0x48434d
push 0x2f
jmp 0x48434d
push 0x5c
jmp 0x48434d
push 8
jmp 0x48434d
push 0xc
jmp 0x48434d
push 0xa
jmp 0x48434d
push 0xd
jmp 0x48434d
push 9
jmp 0x48434d
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.004844a0
test al, al
je 0x4843a0
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x40]
call fcn.004829c0
push 0
push eax
or eax, 0xffffffff
mov esi, edi
mov dword [esp + 0x88], ebx
call fcn.004792b0
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x58], 0x10
jb 0x48432a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00490210
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jmp 0x484354
mov edx, dword [esp + 0x20]
push edx
mov eax, ebx
call fcn.004064c0
cmp esi, dword [esp + 0x18]
jne 0x484242
jmp 0x4843fe
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x60]
call fcn.00401e00
mov eax, dword [esp + 0x88]
push ebp
push eax
mov edx, esi
lea ecx, [esp + 0x64]
mov dword [esp + 0x88], 0
call fcn.00484750
cmp dword [esp + 0x74], 0x10
mov bl, al
jb 0x4843fe
mov ecx, dword [esp + 0x60]
push ecx
jmp 0x4843f6
xor al, al
jmp 0x484400
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00401cf0
mov edx, dword [esp + 0x88]
push ebp
push edx
mov edx, esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], 2
call fcn.00484750
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x4843fe
mov eax, dword [esp + 0x28]
push eax
call fcn.00490210
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x485e9e
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x1c
push 0x4d3cd8
call fcn.00494b9c
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0xc], ebx
cmp eax, ebx
je 0x485ebe
mov dword [eax], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp edi, ebx
je 0x485ffd
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], ebx
je 0x485ffd
push 1
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call esi
mov dword [ebp - 0x1c], eax
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call edi
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x485f2f
push ebx
push ebx
push ebx
push 0x1000002
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x485f2f
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x485f2f
mov dword [ebp - 0x28], eax
push dword [ebp - 0x1c]
call esi
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x485fb3
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x485fa7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x485fa7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x485fa7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x485fa7
movzx ecx, word [eax]
cmp ecx, dword [ebp - 0x1c]
ja 0x485fa0
mov dword [ebp - 0x1c], ecx
add ecx, 3
and ecx, 0xfffffffc
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 0x28], 0xfeef04bd
je 0x485faa
jmp 0x485fa0
mov dword [ebp - 0x20], 0xd
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x485fba
mov dword [ebp - 0x20], 0xd
cmp dword [ebp + 0xc], ebx
je 0x485fc8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x24], ebx
je 0x485fd6
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0xffffffff
je 0x485fe5
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + eax + 4]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x485fff
xor eax, eax
call fcn.00494be1
ret
Function at 0x486005
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x20
push 0x4d3cb8
call fcn.00494b9c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, ebx
je 0x48603f
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], ebx
je 0x48603f
cmp dword [ebp + 0xc], 2
jae 0x486047
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call fcn.00494be1
ret
push 1
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call edi
mov dword [ebp - 0x24], eax
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call esi
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x48609e
push ebx
push ebx
push ebx
push 0x1000002
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x48609e
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x48609e
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1c], ebx
je 0x486131
push 0x10
xor edi, edi
inc edi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x48612e
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x48612e
mov dword [ebp - 4], ebx
movzx esi, word [eax]
mov dword [ebp - 0x24], esi
lea edx, [esi + esi + 4]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
jbe 0x4860f0
shr ecx, 1
sub ecx, 4
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], edi
jmp 0x4860f3
mov dword [ebp - 0x24], ebx
push esi
push eax
mov edi, dword [ebp + 0x10]
push edi
call fcn.00497a60
add esp, 0xc
mov dword [esi + edi], 0x58324546
cmp dword [ebp - 0x24], ebx
je 0x486110
mov word [edi], si
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x486131
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x28], ebx
je 0x48613f
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x2c], ebx
je 0x48614d
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0xffffffff
je 0x48615c
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
jmp 0x486041
Function at 0x4868e1
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
push edi
mov edi, eax
cmp dword [esi], ecx
je 0x4869ec
cmp dword [esi + 4], ecx
je 0x4869ec
mov dword [esi + 8], ecx
xor eax, eax
push ebx
mov ebx, dword [eax + 0x4e3000]
mov edx, dword [esi]
mov dword [eax + edx], ebx
add eax, 4
cmp eax, 0x48
jl 0x486901
xor eax, eax
mov edx, pe_nt_image_headers32
mov ebx, dword [eax + 0x4e3048]
mov ecx, dword [esi + 4]
mov dword [eax + ecx], ebx
add eax, 4
dec edx
jne 0x48691b
cmp eax, 0x1000
jl 0x486916
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov al, byte [ecx + edi]
mov byte [ebp + 0xb], al
lea eax, [ecx + 1]
cdq
idiv ebx
mov al, byte [edx + edi]
mov byte [ebp + 0xa], al
lea eax, [ecx + 2]
cdq
idiv ebx
mov al, byte [edx + edi]
mov byte [ebp + 9], al
lea eax, [ecx + 3]
cdq
idiv ebx
mov al, byte [edx + edi]
mov edx, dword [ebp - 4]
mov byte [ebp + 8], al
mov eax, dword [esi]
add eax, edx
mov edx, dword [ebp + 8]
xor dword [eax], edx
lea eax, [ecx + 4]
cdq
idiv ebx
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x48
mov ecx, edx
jl 0x48693c
and dword [ebp - 4], 0
and dword [ebp + 8], 0
xor edi, edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.00486184
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [edi + eax], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [edi + eax + 4], ecx
add edi, 8
cmp edi, 0x48
jl 0x48698e
xor edi, edi
mov ebx, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.00486184
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [edi + eax], ecx
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 4]
mov dword [eax + edi + 4], ecx
add edi, 8
dec ebx
jne 0x4869bc
cmp edi, 0x1000
jl 0x4869b7
pop ebx
pop edi
leave
ret 4

Function at 0x486fb0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0048ab80
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0048ac20
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0049021b
add esp, 0x68
ret
Function at 0x487120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4872b1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4871b3
cmp dword [esp + 0x14], 1
jne 0x487298
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x487298
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4871f8
cmp dword [esp + 0x14], 1
jne 0x487298
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x487298
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x48722f
cmp dword [esp + 0x14], 1
jne 0x487298
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x487298
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x487298
cmp dword [esp + 0x14], 3
jne 0x487298
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x487298
lea eax, [esi + 0xc]
call fcn.00487020
test eax, eax
je 0x487298
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x487680
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.004896c0
add esp, 8
test eax, eax
jne 0x4876eb
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0049021b
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x487700
push esi
lea ecx, [esp + 0x14]
call fcn.0048ab80
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0048ac20
test edi, edi
je 0x48771e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0049021b
add esp, 0x6c
ret

Function at 0x487780
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004898b0
add esp, 4
test eax, eax
jne 0x4877de
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0049021b
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0048ac20
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0049021b
add esp, 0x64
ret

Function at 0x487800
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00489990
add esp, 8
test eax, eax
jne 0x48787f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0049021b
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0048a770
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0049021b
add esp, 0x74
ret

Function at 0x488230
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48825b
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x488274
push 0x4c4788
call fcn.0048b6f0
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x488b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x488b43
mov dword [esp + 0x10], 0xffffffff
jmp 0x488b49
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x488b77
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
jmp 0x488c57
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x488ba7
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
jmp 0x488c57
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x488bc9
mov eax, 1
push 0x4c4788
call fcn.0048b6f0
add esp, 4
jmp 0x488c57
cmp dword [esp + 0x40], ebx
je 0x488c05
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x488beb
mov eax, 5
push 0x4c4788
call fcn.0048b6f0
add esp, 4
jmp 0x488c57
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x488c4f
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x488c13
mov ebx, esi
jmp 0x488bd7
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x488c3c
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
jmp 0x488c57
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00488230
test eax, eax
je 0x488c57
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x488c61
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049021b
add esp, 0x28
ret
Function at 0x489540
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x489586
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x489618
jg 0x4895ae
cmp ebx, ecx
jb 0x489618
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4895dd
push 0x4c4788
mov eax, 0x4c4788
call fcn.0048b680
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00488230
test eax, eax
je 0x4895d3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4895fe
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x489625
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x489625
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x489ed0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x48a010
cmp dword [esp + 0x28], ebp
je 0x48a010
push edi
push 0x2800
call fcn.004914f2
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x489f33
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0049021b
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x489f40
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.004880d0
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x489fe6
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00494b20
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x489fd9
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x489fd9
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00489c60
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x489ff0
inc ebx
cmp ebx, 0x10
jl 0x489f40
push edi
call fcn.00490c9e
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0049021b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0049021b
add esp, 0x1c
ret
Function at 0x48a0c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x48a0fa
cmp dword [esp + 0x34], esi
je 0x48a0fa
push 0x200
call fcn.004914f2
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x48a105
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48a264
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x48a1fa
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x48a15d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48a1d3
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48a1c8
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.0048a030
cmp edx, ebx
jb 0x48a1c8
ja 0x48a1c2
cmp eax, dword [esp + 0x24]
jbe 0x48a1c8
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x48a150
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x48a210
cmp dword [esp + 0x24], 0
jbe 0x48a264
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.004880d0
add esp, 0x10
test eax, eax
jne 0x48a249
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00490c9e
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push edi
push edx
push str.MAC:
call fcn.00489c60
add esp, 0xc
mov dword [esp + 0x18], eax
push edi
call fcn.00490c9e
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret