joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dedc1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
push esi
xor esi, esi
xor eax, eax
push edi
cmp dword [ebp + 0xc], esi
je 0x4dee9b
push 0x7fe
mov word [ebp - 0x85c], ax
lea eax, [ebp - 0x85a]
push esi
push eax
call fcn.004fe380
add esp, 0xc
lea eax, [ebp - 0x85c]
cmp dword [ebp + 0x10], esi
je 0x4dee17
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x4dee29
push dword [ebp + 0xc]
push 0x5d7fa8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004fe380
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x85c]
push eax
push esi
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4dee9b
push 0x4e20
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc
Function at 0x4def12
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x5ff294
push dword [ebp + 8]
call fcn.004fc169
mov esi, eax
xor edi, edi
pop ecx
pop ecx
cmp esi, edi
jne 0x4def47
push dword [ebp + 8]
push str.Open_ScrFile_ERR:_s_n
call fcn.004f9cd6
pop ecx
pop ecx
xor al, al
jmp 0x4df042
push 0x5ff298
push dword [ebp + 0xc]
call fcn.004fc169
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x4def75
push dword [ebp + 0xc]
push str.Open_DesFile_ERR:_s_n
call fcn.004f9cd6
push esi
call fcn.004f9951
add esp, 0xc
jmp 0x4def40
push ebx
push 2
push edi
push esi
call fcn.004f9855
push esi
call fcn.004f975d
push edi
push edi
push esi
mov ebx, eax
call fcn.004f9855
mov eax, ebx
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
test eax, eax
jge 0x4defa1
fadd qword [0x6005a8]
fmul qword [0x6005a0]
fadd qword [0x600598]
call fcn.00581986
push ebx
mov dword [ebp - 8], eax
call fcn.004f6dde
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x1c], 0
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
push esi
xor edi, edi
push 5
inc edi
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004f95a3
push esi
push 4
lea eax, [ebp - 8]
push edi
push eax
call fcn.004f95a3
add esp, 0x40
push edi
push 4
push esi
call fcn.004f9855
push dword [ebp - 8]
call fcn.004f6dde
push esi
add ebx, 0xfffffff3
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call fcn.004f95a3
add esp, 0x20
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4df046
push str.read_err_n
call fcn.004f9cd6
push esi
call fcn.004f9951
push dword [ebp - 0x10]
call fcn.004f9951
push dword [ebp - 4]
call fcn.004f6d01
push dword [ebp - 0xc]
call fcn.004f6d01
add esp, 0x14
xor al, al
pop ebx
pop edi
pop esi
leave
ret
push 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call fcn.0057f710
test eax, eax
je 0x4df097
push eax
push str.LzmaUncompress:_d_n
call fcn.004f9cd6
pop ecx
pop ecx
xor bl, bl
push esi
call fcn.004f9951
push dword [ebp - 0x10]
call fcn.004f9951
push dword [ebp - 4]
call fcn.004f6d01
push dword [ebp - 0xc]
call fcn.004f6d01
add esp, 0x10
mov al, bl
jmp 0x4df041
push dword [ebp - 0x10]
push dword [ebp - 8]
push edi
push dword [ebp - 0xc]
call fcn.004fa893
add esp, 0x10
mov bl, 1
jmp 0x4df072
Function at 0x4e6280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x593d6b
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov esi, edx
mov edx, dword [esp + 0x2c]
xor eax, eax
mov dword [esi + 0x28], 7
mov dword [esi + 0x24], 0
mov dword [esp + 0x14], esi
mov word [esi + 0x14], ax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.004e6320
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004f673f
add esp, 0x14
ret 0x14
Function at 0x4e7cf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x4e7d04
mov dword [edi], ebx
cmp dword [esi + 4], ebx
jne 0x4e7d1c
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x24
ret 0x14
mov al, byte [esp + 0x34]
mov edx, dword [esp + 0x44]
cmp al, bl
je 0x4e7d2e
mov byte [esp + 0x34], bl
jmp 0x4e7d35
cmp edx, ebx
setne byte [esp + 0x34]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x44], ebx
cmp edx, ebx
jne 0x4e7d8f
cmp al, bl
mov eax, dword [esi + 0x18]
je 0x4e7d76
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x3c]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4e7e01
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x3c]
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4e7e01
mov edi, dword [esp + 0x3c]
xor ecx, ecx
cmp al, bl
setne cl
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
dec ecx
and ecx, edi
mov dword [esp + 0x10], ecx
xor ecx, ecx
cmp al, bl
setne cl
dec ecx
and ecx, edx
mov dword [esp + 0x14], ecx
cmp al, bl
jne 0x4e7dcc
mov edi, 4
lea edx, [esp + 0x44]
mov ecx, dword [esi + 0x18]
push ebp
lea ebp, [esp + 0x20]
push ebp
movzx eax, al
lea ebp, [esp + 0x40]
push ebp
push edi
push edx
neg eax
sbb eax, eax
push 0x10
lea edx, [esp + 0x24]
and eax, 0xffffbffe
push edx
add eax, 0x22803c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [esp + 0x44]
pop ebp
cmp eax, ebx
jne 0x4e7e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4e7d11
mov esi, dword [esi + 0x18]
push 1
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
mov dword [esp + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
je 0x4e7e4a
cmp edi, ebx
je 0x4e7e48
mov ecx, dword [esp + 0x44]
cmp byte [esp + 0x34], bl
jne 0x4e7e46
mov ecx, dword [esp + 0x3c]
mov dword [edi], ecx
cmp eax, ebx
pop edi
pop esi
setne al
pop ebx
add esp, 0x24
ret 0x14

Function at 0x4e8509
Capabilities:
Check if file exists

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x4e8514
mov eax, dword [eax + 4]
jmp 0x4e8517
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
ret
Function at 0x4e8d10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x61e69c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
cmp dword [eax + 0x10], 0
push ebx
je 0x4e8d34
mov eax, esi
call fcn.004e8e19
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebx
test eax, eax
jne 0x4e8d48
xor al, al
jmp 0x4e8e0c
mov eax, dword [esi + 4]
push edi
call fcn.004e9389
test eax, eax
je 0x4e8d41
push edi
lea eax, [ebp - 0x210]
push 0x5ff588
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
je 0x4e8d83
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
call fcn.004e900d
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
je 0x4e8df9
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e900d
test eax, eax
je 0x4e8df9
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x22c]
jne 0x4e8df9
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x230]
jne 0x4e8df9
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x21c]
jne 0x4e8df9
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x220]
jne 0x4e8df9
lea eax, [ebp - 0x210]
push eax
push dword [esi + 8]
call fcn.004e9712
test al, al
jne 0x4e8e0c
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push ecx
mov edx, eax
mov ecx, esi
call fcn.004e8e30
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004f673f
leave
ret

Function at 0x4e9389
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, eax
call fcn.004e940d
push 0x5dee8c
push dword [esp + 0x10]
call fcn.004f9299
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4e9408
push edi
push 2
push 0
push ebx
call fcn.004f9855
push ebx
call fcn.004f975d
push 0
push 0
push ebx
mov edi, eax
call fcn.004f9855
add esp, 0x1c
test edi, edi
jle 0x4e93f8
call fcn.004e940d
push edi
call fcn.004f6dde
and dword [esi + 8], 0
pop ecx
xor ecx, ecx
inc ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edi
mov dword [esi + 4], ecx
test eax, eax
je 0x4e93f8
push ebx
push ecx
push edi
push eax
call fcn.004f95a3
add esp, 0x10
push ebx
call fcn.004f9951
xor eax, eax
cmp dword [esi + 0x10], eax
pop ecx
setne al
pop edi
pop esi
pop ebx
ret 4
Function at 0x4e9712
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.004e9b76
cmp dword [ebp + 0xc], 0
jne 0x4e9732
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
push 0x5dee8c
push dword [ebp + 0xc]
call fcn.004f9299
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4e9729
push dword [ebx + 0x10]
call fcn.004fe4fe
pop ecx
push ebx
push 1
mov esi, eax
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.004f95a3
add esp, 0x10
cmp dword [ebp - 0xc], 0x78646972
mov byte [ebp + 0xf], 0
jne 0x4e97f2
cmp dword [ebp - 8], 0x8000
jb 0x4e978c
mov byte [ebp + 0xf], 0
push ebx
call fcn.004f9951
mov al, byte [ebp + 0xf]
pop ecx
jmp 0x4e972b
add esi, 0xfffffff8
push esi
call fcn.004f6dde
mov edi, eax
pop ecx
test edi, edi
je 0x4e97f2
push ebx
push 1
push esi
push edi
call fcn.004f95a3
lea ebx, [edi + esi]
xor esi, esi
add esp, 0x10
cmp dword [ebp - 8], esi
mov eax, edi
jle 0x4e97e1
mov ecx, dword [eax + 0xc]
add ecx, 0x12
add ecx, eax
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
ja 0x4e97e1
push dword [eax + 8]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
add eax, 0x10
push eax
call fcn.004e9530
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, dword [ebp - 8]
jl 0x4e97b5
push edi
call fcn.004f6d01
cmp esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
pop ecx
sete byte [ebp + 0xf]
mov al, byte [ebp + 0xf]
mov byte [ebp + 0xf], al
jmp 0x4e9780

Function at 0x4ecbd0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004f09f0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.004f0a90
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004f673f
add esp, 0x68
ret
Function at 0x4ecd60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x5ffbb0
push reloc.WS2_32.dll_bind
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ecef1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ecdf3
cmp dword [esp + 0x14], 1
jne 0x4eced8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x4eced8
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4ece38
cmp dword [esp + 0x14], 1
jne 0x4eced8
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4eced8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4ece6f
cmp dword [esp + 0x14], 1
jne 0x4eced8
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4eced8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4eced8
cmp dword [esp + 0x14], 3
jne 0x4eced8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x4eced8
lea eax, [esi + 0xc]
call fcn.004ecc40
test eax, eax
je 0x4eced8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4ed310
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.004ef530
add esp, 8
test eax, eax
jne 0x4ed37b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004f673f
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x4ed390
push esi
lea ecx, [esp + 0x14]
call fcn.004f09f0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.004f0a90
test edi, edi
je 0x4ed3ae
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004f673f
add esp, 0x6c
ret

Function at 0x4ed410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004ef730
add esp, 4
test eax, eax
jne 0x4ed46e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004f673f
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.004f0a90
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004f673f
add esp, 0x64
ret

Function at 0x4ed490
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.004ef820
add esp, 8
test eax, eax
jne 0x4ed50f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004f673f
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.004f05e0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004f673f
add esp, 0x74
ret

Function at 0x4ede80
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4edeb2
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.004f18d0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x4eded7
push 0x5ffd44
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.004f1a00
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x4ef3a0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x4ef3ed
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.004f18d0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x4ef484
jg 0x4ef413
cmp ebx, ecx
jb 0x4ef484
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4ef449
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.004f18d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.004ede80
test eax, eax
je 0x4ef43f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4ef46a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4ef491
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4ef491
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4efd40
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x4efe80
cmp dword [esp + 0x28], ebp
je 0x4efe80
push edi
push 0x2800
call fcn.004f6dde
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x4efda3
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004f673f
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x4efdb0
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.004edd50
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4efe56
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004fe380
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4efe49
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x4efe49
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.004efaf0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x4efe60
inc ebx
cmp ebx, 0x10
jl 0x4efdb0
push edi
call fcn.004f6d01
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004f673f
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.004f673f
add esp, 0x1c
ret
Function at 0x4eff30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x4eff6a
cmp dword [esp + 0x34], esi
je 0x4eff6a
push 0x200
call fcn.004f6dde
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x4eff75
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f00d4
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x4f006a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4effcd
mov eax, reloc.WS2_32.dll_bind
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f0043
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f0038
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.004efea0
cmp edx, ebx
jb 0x4f0038
ja 0x4f0032
cmp eax, dword [esp + 0x24]
jbe 0x4f0038
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x4effc0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x4f0080
cmp dword [esp + 0x24], 0
jbe 0x4f00d4
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.004edd50
add esp, 0x10
test eax, eax
jne 0x4f00b9
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f6d01
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push edi
push edx
push str.MAC:
call fcn.004efaf0
add esp, 0xc
mov dword [esp + 0x18], eax
push edi
call fcn.004f6d01
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret