joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4380b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538539
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
movups xmm0, xmmword [edi + 4]
movups xmmword [esi + 4], xmm0
movq xmm0, qword [edi + 0x14]
movq qword [esi + 0x14], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
movsd xmm0, qword [edi + 0x28]
movsd qword [esi + 0x28], xmm0
mov edx, dword [edi + 0x38]
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x30]
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], edx
mov byte [ebp - 4], 1
add esi, 0x3c
mov dword [ebp + 8], esi
push 0x88
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ef5e0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi], ecx
mov dword [edi + 0x3c], eax
mov ecx, dword [esi + 4]
mov eax, dword [edi + 0x40]
mov dword [esi + 4], eax
mov dword [edi + 0x40], ecx
mov byte [ebp - 4], 3
mov al, byte [edi + 0x44]
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x44], al
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
movups xmm0, xmmword [edi + 0x48]
movups xmmword [ecx + 0x48], xmm0
movq xmm0, qword [edi + 0x58]
movq qword [ecx + 0x58], xmm0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0xf
mov byte [edi + 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x439350
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x43935e
mov eax, dword [eax]
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x439376
cmp eax, 2
je 0x439376
xor al, al
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
Function at 0x439cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x439d15
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x10000006
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push 0
push dword [ecx]
mov dword [esp + 0x38], eax
call eax
mov edi, eax
test edi, edi
je 0x439d6f
mov ecx, dword [0x5a99a0]
cmp ecx, 0x5a99a0
je 0x439e20
test byte [ecx + 0x1c], 2
je 0x439e20
cmp dword [esi + 0x14], 8
jb 0x439d5d
mov esi, dword [esi]
push edi
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x15
jmp 0x439e13
mov ebx, dword [ebp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
mov ecx, eax
mov edx, dword [ebx]
sub ecx, edx
mov dword [esp + 0x14], eax
cmp edi, ecx
jae 0x439d8c
lea eax, [edx + edi]
jmp 0x439dbc
jbe 0x439dbf
mov eax, dword [ebx + 8]
sub eax, edx
cmp edi, eax
jbe 0x439da5
push ecx
push edi
mov ecx, ebx
lfence
call fcn.004147f0
jmp 0x439dbf
sub edi, ecx
push edi
push 0
push dword [esp + 0x1c]
call fcn.004f32c0
mov eax, dword [esp + 0x20]
add esp, 0xc
add eax, edi
mov dword [ebx + 4], eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x439dc9
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push dword [ebx]
push 0
push 0x10000006
push eax
mov eax, dword [esp + 0x2c]
push 0
push dword [eax]
call dword [esp + 0x38]
mov edi, eax
test edi, edi
je 0x439e27
mov ecx, dword [0x5a99a0]
cmp ecx, 0x5a99a0
je 0x439e20
test byte [ecx + 0x1c], 8
je 0x439e20
cmp dword [esi + 0x14], 8
jb 0x439e06
mov esi, dword [esi]
push edi
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x16
mov edx, 0x5764d8
call fcn.00417d40
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0xc], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x439e61
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x20
push eax
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test esi, esi
je 0x439eb0
mov ecx, dword [0x5a99a0]
cmp ecx, 0x5a99a0
je 0x439f1d
test byte [ecx + 0x1c], 2
je 0x439f1d
cmp dword [edi + 0x14], 8
jb 0x439ea1
mov edi, dword [edi]
push esi
push edi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x17
jmp 0x439f10
mov eax, dword [esp + 0xc]
mov esi, dword [ebp + 0xc]
mov ecx, esi
shr eax, 1
push eax
call fcn.00422e00
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x439ecb
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push dword [esi]
push 0
push 0x20
push eax
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test esi, esi
je 0x439f24
mov ecx, dword [0x5a99a0]
cmp ecx, 0x5a99a0
je 0x439f1d
test byte [ecx + 0x1c], 8
je 0x439f1d
cmp dword [edi + 0x14], 8
jb 0x439f03
mov edi, dword [edi]
push esi
push edi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x18
mov edx, 0x5764d8
call fcn.00417d40
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov dword [esp + 0xc], 4
cmp dword [esi + 0x14], 8
jb 0x439f50
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push dword [ebp + 0xc]
push 0
push 0x18
push eax
push 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test edi, edi
je 0x439fb4
mov ecx, dword [0x5a99a0]
cmp ecx, 0x5a99a0
je 0x439fa3
test byte [ecx + 0x1c], 2
je 0x439fa3
cmp dword [esi + 0x14], 8
jb 0x439f89
mov esi, dword [esi]
push edi
push esi
push dword [ecx + 0x14]
mov edx, 0x5764d8
push dword [ecx + 0x10]
mov ecx, 0x19
call fcn.00417d40
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43a4a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538c65
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x4c], eax
mov edi, dword [ebx + 8]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push ecx
push 0
push 0
push 0
push dword [eax]
mov dword [ebp - 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x43a53f
mov byte [ebp - 0x2d], 0
jmp 0x43a62c
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x44]
inc eax
push eax
call fcn.00422e00
xor esi, esi
cmp dword [ebp - 0x34], esi
jbe 0x43a628
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
sub eax, ecx
sar eax, 1
push eax
push 0
push ecx
mov dword [ebp - 0x48], eax
call fcn.004f32c0
add esp, 0xc
lea eax, [ebp - 0x48]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43a61e
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
mov eax, edx
mov dword [ebp - 0x18], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x50], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43a5b5
sub eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
sar eax, 1
push eax
push edx
call fcn.004104f0
mov byte [ebp - 4], 3
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x43a606
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
jmp 0x43a612
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, edi
call fcn.00424170
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00410460
inc esi
cmp esi, dword [ebp - 0x34]
jb 0x43a557
mov byte [ebp - 0x2d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00418670
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x43e840
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53941d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x5765d8
call fcn.004ef5e0
mov esi, eax
add esp, 4
test esi, esi
je 0x43e892
push 1
call fcn.004f0aee
add esp, 4
mov dword [esi + 4], eax
jmp 0x43e894
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp - 0x10]
not ecx
and ecx, 1
mov eax, ebx
shl ecx, 2
mov edx, ecx
or edx, 2
mov dword [esi], 0x57659c
and al, 2
mov dword [esi + 0x38], 0
mov eax, ebx
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [esi + 0x3c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x440490
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539795
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4404e5
push 0xf0000008
push 0x18
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x440503
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x440536
test byte [eax + 0x1c], 8
je 0x440536
push esi
push dword [eax + 0x14]
mov edx, 0x576694
mov ecx, 0xa
push dword [eax + 0x10]
call fcn.00417d10
add esp, 0xc
mov edx, esi
lea ecx, [ebp - 0x2c]
call fcn.00433020
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x44]
push str.CryptProvider_Failed_with_error
push eax
call fcn.00432680
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
push eax
call fcn.00415960
push 0x5a6448
lea eax, [ebp - 0x50]
push eax
call fcn.004f2c1b
int3
Function at 0x440eb0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5a9008]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
push 0x190
lea eax, [esp + 0xc]
mov esi, ecx
push 0
push eax
call fcn.004f32c0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004ef615
mov esp, ebp
pop ebp
ret

Function at 0x442fc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a2a6
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 2
push ecx
push 0
push 3
push 7
push 0x80000000
push edi
lea ecx, [ebp - 0x2c]
call fcn.00431c30
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
xorps xmm0, xmm0
movq qword [ebp - 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
ja 0x4430a1
jb 0x443070
cmp eax, 0xc800000
ja 0x4430a1
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00432140
test al, al
je 0x4430a1
mov eax, dword [ebp - 0x38]
mov ecx, esi
mov edx, dword [ebp - 0x3c]
sub eax, edx
push eax
call fcn.00442680
add esp, 4
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 4
jmp 0x443104
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x4430d4
test byte [eax + 0x1c], 8
je 0x4430d4
cmp dword [edi + 0x14], 8
jb 0x4430bb
mov edi, dword [edi]
push edi
push dword [eax + 0x14]
mov edx, 0x5767a4
mov ecx, 0xc
push dword [eax + 0x10]
call fcn.00412b50
add esp, 0xc
push 0
mov dword [esi], 0
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0x574360
mov byte [esi], 0
call fcn.004122a0
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x443113
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00410460
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.004121e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004121e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
Function at 0x449300
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b38d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x14]
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x400
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], 1
mov word [ecx + 0x2c], 0x100
mov dword [ecx + 0x30], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x450bf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cbec
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [0x5ad744]
mov ecx, dword [0x5ad740]
mov eax, edx
sub eax, ecx
sar eax, 3
test eax, eax
je 0x450c48
push ecx
call fcn.00450940
add esp, 4
mov eax, dword [0x5ad740]
mov dword [0x5ad744], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
xor ebx, ebx
mov dword [ebp - 0x48], ebx
cmp ebx, 0x19
jae 0x450e50
mov eax, 1
mov ecx, ebx
shl eax, cl
test dword [ebp - 0x4c], eax
je 0x450dfd
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
push 3
push 0x577478
lea ecx, [ebp - 0x2c]
call fcn.004122a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
push 6
push str..A:
lea ecx, [ebp - 0x44]
call fcn.004122a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
cmovae eax, dword [ebp - 0x44]
lea ecx, [ebx + 0x41]
mov byte [eax + 4], cl
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
mov byte [eax], cl
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x450de2
mov byte [ebp - 4], 2
push 0x4c
call fcn.004ef5e0
add esp, 4
mov esi, eax
mov dword [ebp - 0x58], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x450d53
call fcn.0044eff0
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
call fcn.00451110
jmp 0x450d55
xor eax, eax
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x54]
call fcn.00450e70
mov byte [ebp - 4], 4
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x5ad740
call fcn.00450550
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.004173f0
mov dword [ebp - 4], 1
jmp 0x450de2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00410d30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00410d30
inc ebx
jmp 0x450c53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
Function at 0x451960
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ce9e
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x74]
push 0x64
push 0
mov dword [ebp - 0x7c], edi
push eax
mov dword [ebp - 0x78], 0
call fcn.004f32c0
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4519b1
mov esi, dword [esi]
push 0x64
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x4519e0
push 0x26
mov dword [edi], eax
mov ecx, edi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
push str.00000000_0000_0000_0000_000000000000
mov byte [edi], al
call fcn.004122a0
jmp 0x451a30
push 0x64
lea eax, [ebp - 0x74]
push 0x7b
push eax
call fcn.004f2c90
test eax, eax
lea esi, [ebp - 0x10]
push 0x64
cmovne esi, eax
lea eax, [ebp - 0x74]
push 0x7d
push eax
call fcn.004f2c90
add esp, 0x18
mov dword [edi], 0
test eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [edi + 0x14], 0xf
cmovne ecx, eax
mov byte [edi], 0
inc ecx
sub ecx, esi
push ecx
push esi
mov ecx, edi
call fcn.004122a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x78], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret 4
Function at 0x451d10
Capabilities:
Get volume information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cf73
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xa4], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], esi
mov dword [esi], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa0]
push 0x60
push 0
push eax
call fcn.004f32c0
add esp, 0xc
mov dword [ebp - 0xa4], 0
lea eax, [ebp - 0xa4]
push 0
push eax
push 0x60
lea eax, [ebp - 0xa0]
push eax
push 0
push 0
push 0x90064
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x451e03
mov ecx, dword [ebp - 0x74]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x70]
mov dword [esi + 0x10], ecx
mov ecx, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
call fcn.00452030
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x5a99a0]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5a99a0
je 0x451e3c
test byte [eax + 0x1c], 8
je 0x451e3c
call esi
mov ecx, dword [0x5a99a0]
mov edx, 0x577594
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xa
call fcn.00417d10
add esp, 0xc
call esi
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00433020
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push str.Failed_to_get_NTFS_volume_data__lastError:
push eax
call fcn.00432680
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
push eax
call fcn.00415960
push 0x5a6448
lea eax, [ebp - 0xb4]
push eax
call fcn.004f2c1b
int3
Function at 0x46b880
Capabilities:
Parse pe header

Disassembly:
push ecx
cmp dword [ecx + 0xc], 0
ja 0x46b88d
cmp dword [ecx + 8], 0x40
jb 0x46b8c7
mov eax, dword [ecx]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46b8c7
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jns 0x46b8cb
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x46b8c7
test byte [eax + 0x1c], 8
je 0x46b8c7
push 0x577f70
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040fa00
add esp, 0x10
xor al, al
pop ecx
ret
cmp dword [ecx + eax], 0x4550
je 0x46b8ff
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x46b8c7
test byte [eax + 0x1c], 8
je 0x46b8c7
push 0x577f70
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040fa00
add esp, 0x10
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret
Function at 0x46fb20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543868
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea edi, [esi + 0x30]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 3
mov dword [esi + 0x2c], 2
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esi], ecx
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea eax, [ebp + 0x20]
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x1c], ecx
cmp edi, eax
je 0x46fbd5
cmp dword [ebp + 0x34], 0x10
mov edx, eax
push dword [ebp + 0x30]
cmovae edx, dword [ebp + 0x20]
mov ecx, edi
push edx
call fcn.004122a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00410d30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x30