joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3e7588c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x104]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
call fcn.03e75834
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
movzx esi, word [eax + 6]
dec esi
test esi, esi
jl 0x3e7598c
inc esi
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x10], 0
jne 0x3e75927
mov edi, dword [ebp - 0xcc]
test edi, edi
jle 0x3e75919
push 0x40
push 0x1000
push edi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.03e75748
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ebx
mov edx, edi
mov eax, ebx
xor ecx, ecx
call fcn.03cb5b68
push 0
push 0x28
lea eax, [ebp - 0xc]
call fcn.03e75718
jmp 0x3e75985
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.03e75748
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.03e75748
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov ecx, ebx
xchg edx, ecx
call fcn.03cb5330
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ebx
push 0
push 0x28
lea eax, [ebp - 0xc]
call fcn.03e75718
dec esi
jne 0x3e758d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3e75df0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x3e75e05
or edx, 0x200
test eax, 0x20000000
je 0x3e75e38
test eax, 0x40000000
je 0x3e75e24
test eax, 0x80000000
je 0x3e75e1f
or edx, 0x40
jmp 0x3e75e5f
or edx, 0x20
jmp 0x3e75e5f
test eax, 0x80000000
je 0x3e75e33
or edx, 0x80
jmp 0x3e75e5f
or edx, 0x10
jmp 0x3e75e5f
test eax, 0x40000000
je 0x3e75e50
test eax, 0x80000000
je 0x3e75e4b
or edx, 4
jmp 0x3e75e5f
or edx, 2
jmp 0x3e75e5f
test eax, 0x80000000
je 0x3e75e5c
or edx, 8
jmp 0x3e75e5f
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x3e7707c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e771d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.03cb7e50
lea eax, [ebp - 0x224]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e771f0
call fcn.03cb936c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov eax, dword [ebp - 0x224]
call fcn.03e76900
mov edi, eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x3e77100
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
push 8
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e77200
call fcn.03cb936c
mov edx, eax
inc edx
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov eax, dword [ebp - 0x228]
call fcn.03cb8d98
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
xor esi, esi
mov dword [ebp - 0xc], 0x20a
jmp 0x3e77182
push dword [ebx]
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x21e]
mov ecx, 0x105
call fcn.03cb8e3c
push dword [ebp - 0x22c]
push 0x3e77210
mov eax, ebx
mov edx, 3
call fcn.03cb9074
inc esi
mov dword [ebp - 0xc], 0x20a
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21e]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x3e7714b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e771db
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp - 4]
call fcn.03cb7e50
ret

Function at 0x3e7736c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov eax, ebx
call fcn.03cb836c
inc eax
add eax, eax
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x3e778e0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e77a3e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e77a5c
call fcn.03cb936c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e77a6c
call fcn.03cb936c
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.03cb91a4
mov edx, 0x3e77a7c
mov eax, dword [ebp - 4]
call fcn.03cd3680
test eax, eax
jle 0x3e77996
mov esi, dword [ebp - 4]
test esi, esi
je 0x3e7797d
sub esi, 4
mov esi, dword [esi]
mov edx, 0x3e77a8c
mov eax, dword [ebp - 4]
call fcn.03cd3680
mov ecx, eax
lea eax, [ebp - 4]
mov edx, esi
call fcn.03cb91a4
lea eax, [ebp - 0x10]
push eax
push 2
push 0
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
call fcn.03e76900
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x3e77a13
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.03cb89c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.03e773c8
lea eax, [ebp - 0x14]
mov edx, 0x3e77a94
call fcn.03cb8ad0
mov ecx, dword [ebp - 0x14]
mov edx, 0x3e77ab8
mov eax, 0x80000001
call fcn.03e7884c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e77a45
lea eax, [ebp - 0x18]
call fcn.03cb7e74
lea eax, [ebp - 0x14]
call fcn.03cb7e98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret
Function at 0x3e78248
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e78378
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x3e78355
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e78394
call fcn.03cb936c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e783a4
call fcn.03cb936c
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.03cb91a4
mov eax, dword [ebp - 4]
test eax, eax
je 0x3e782da
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x3e782f2
lea eax, [ebp - 4]
mov edx, 0x3e783b4
call fcn.03cb8f94
lea eax, [ebp - 0x10]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
call fcn.03e76900
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x3e78355
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3e783c4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x14]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
call fcn.03e76900
push eax
call sub.shlwapi.dll_SHDeleteKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e7837f
lea eax, [ebp - 0x14]
call fcn.03cb7e50
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret
Function at 0x3e783c8
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x3e78550
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x200
call fcn.03cb8f14
mov eax, 0x2000
call fcn.03e6d370
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x3e78533
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov ebx, eax
test ebx, ebx
jne 0x3e7847a
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
push esi
call sub.advapi32.dll_RegDeleteValueW
test ebx, ebx
je 0x3e78413
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyExW
mov ebx, eax
test ebx, ebx
jne 0x3e78515
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCreateKeyW
mov ebx, eax
test ebx, ebx
jne 0x3e78515
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
push esi
call sub.advapi32.dll_RegCreateKeyW
mov ebx, eax
test ebx, ebx
jne 0x3e7850c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.03e783c8
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyW
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x3e78480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e7853a
mov eax, dword [ebp - 0x18]
call fcn.03cb5068
ret
Function at 0x3e78560
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
mov eax, dword [ebp - 0xc]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e786ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x3e786c6
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e78708
call fcn.03cb936c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3e78718
call fcn.03cb936c
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.03cb91a4
mov eax, dword [ebp - 4]
test eax, eax
je 0x3e78603
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x3e7861b
lea eax, [ebp - 4]
mov edx, 0x3e78728
call fcn.03cb8f94
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.03cb8fec
mov eax, dword [ebp - 0x1c]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x10]
call fcn.03e76900
push eax
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x3e786c6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.03cb8fec
mov eax, dword [ebp - 0x20]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x10]
call fcn.03e76900
push eax
call sub.advapi32.dll_RegCreateKeyW
test eax, eax
jne 0x3e786c6
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.03e783c8
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3e78738
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x24]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x10]
call fcn.03e76900
push eax
call sub.shlwapi.dll_SHDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e786f5
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.03cb7eb0
ret
Function at 0x3e7873c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
lea eax, [ebp + 8]
call fcn.03cb7f54
xor eax, eax
push ebp
push 0x3e78838
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.03cb8e8c
mov eax, dword [ebp - 8]
call fcn.03cb8abc
mov dword [0x3f36f08], eax
mov eax, dword [ebp + 8]
call fcn.03cb8abc
mov dword [0x3f36f0c], eax
mov eax, dword [0x3f36f0c]
mov dword [0x3f36f18], eax
mov edx, dword [ebp + 8]
mov eax, edx
test eax, eax
je 0x3e787ae
sub eax, 4
mov eax, dword [eax]
shr eax, 1
add eax, eax
mov word [0x3f36f14], ax
mov eax, edx
test eax, eax
je 0x3e787c3
sub eax, 4
mov eax, dword [eax]
shr eax, 1
add eax, eax
add ax, 2
mov word [0x3f36f16], ax
push 0x3f36f10
push 2
push 0
mov eax, dword [0x3f36f08]
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x3e78812
mov eax, edi
call fcn.03cb836c
add eax, eax
push eax
push edi
push 1
push 0
push 0x3f36f14
mov eax, dword [0x3f36f10]
push eax
call sub.ntdll.dll_NtSetValueKey
mov eax, dword [0x3f36f10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e7883f
lea eax, [ebp - 8]
call fcn.03cb7e98
lea eax, [ebp - 4]
call fcn.03cb7e50
lea eax, [ebp + 8]
call fcn.03cb7e98
ret

Function at 0x3e7884c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
lea eax, [ebp - 8]
call fcn.03cb7f54
xor eax, eax
push ebp
push 0x3e78936
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.03cb8e8c
mov eax, dword [ebp - 0xc]
call fcn.03cb8abc
mov dword [0x3f36f08], eax
mov eax, dword [ebp - 8]
call fcn.03cb8abc
mov dword [0x3f36f0c], eax
mov eax, dword [0x3f36f0c]
mov dword [0x3f36f18], eax
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x3e788be
sub eax, 4
mov eax, dword [eax]
shr eax, 1
add eax, eax
mov word [0x3f36f14], ax
mov eax, edx
test eax, eax
je 0x3e788d3
sub eax, 4
mov eax, dword [eax]
shr eax, 1
add eax, eax
add ax, 2
mov word [0x3f36f16], ax
push 0x3f36f10
push 2
push 0
mov eax, dword [0x3f36f08]
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x3e78913
push 0x3f36f14
mov eax, dword [0x3f36f10]
push eax
call sub.ntdll.dll_NtDeleteValueKey
mov eax, dword [0x3f36f10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e7893d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.03cb7f10
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3e83380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e8347c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.03e86d30
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.03e7e2f0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.03e84ab8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.03e7e27c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.03e84b34
lea eax, [ebx + 0x50]
call fcn.03cb7e74
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e83483
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret
Function at 0x3e8348c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e83598
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.03e86d30
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x3e8355b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.03e7e2f0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.03e84ab8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.03e7e27c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.03e84b34
jmp 0x3e8356d
xor edx, edx
mov eax, ebx
call fcn.03e84ab8
xor edx, edx
mov eax, ebx
call fcn.03e84b34
lea eax, [ebx + 0x50]
call fcn.03cb7e74
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e8359f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret

Function at 0x3e8722c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e87285
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.03cb8d98
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
je 0x3e8726d
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 5
jne 0x3e8726f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e8728c
lea eax, [ebp - 4]
call fcn.03cb7e50
ret

Function at 0x3e87294
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3e872f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov edx, ebx
lea eax, [ebp - 0x28]
call fcn.03cd3f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e872ff
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3e8d12c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x3e8d29f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x3e8d27a
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.03cb8dc0
lea eax, [ebp - 0x21c]
mov edx, 0x3e8d2b8
call fcn.03cb8f94
mov eax, dword [ebp - 0x21c]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x3e8d1eb
lea eax, [ebp - 0x216]
call fcn.03cb836c
lea edx, [ebp - 0x216]
mov ecx, ebx
xchg ecx, eax
call fcn.03cb7fd8
jmp 0x3e8d1f2
mov eax, ebx
call fcn.03cb7e50
cmp si, 0x61
jae 0x3e8d214
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call fcn.03cda1f8
mov edx, dword [ebp - 0x220]
mov eax, ebx
call fcn.03cb8230
jmp 0x3e8d22e
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call fcn.03cda1e4
mov edx, dword [ebp - 0x224]
mov eax, ebx
call fcn.03cb8230
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x3e8d2cc
call fcn.03cd41a8
mov edx, dword [ebp - 0x228]
mov eax, ebx
call fcn.03cb8230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e8d281
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret