joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59c650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov ebx, dword [esp + 0xa8]
test ebx, ebx
je 0x59c870
mov al, byte [esi + 2]
sub eax, 0x42
cmp al, 0x14
jbe 0x59c69c
mov esi, dword [ebx]
test esi, esi
jle 0x59c87c
xor ebx, ebx
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, al
jmp dword [eax*4 + 0x626f08]
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
mov dword [esp + 0x70], 0
mov ecx, dword [edi]
mov eax, dword [ecx]
lea ebp, [esp + 0x60]
mov dword [esp + 8], ebp
movsx edx, word [esi]
mov dword [esp + 4], edx
mov edx, dword [edi + 4]
mov dword [esp], edx
call dword [eax + 0x38]
sub esp, 0xc
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004e8bbc
mov eax, dword [esp + 0x70]
cmp byte [esp + 0x78], 0
je 0x59c68d
test eax, eax
je 0x59c68d
mov dword [esp], eax
call fcn.005cf79c
jmp 0x59c68d
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x30]
call fcn.005a54c8
fstp qword [esp + 4]
mov dword [esp], ebx
call fcn.004ddaa8
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x24]
call fcn.005a53b8
fstp qword [esp + 4]
mov dword [esp], ebx
call fcn.004ddaa8
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], esi
lea ecx, [esp + 0x48]
call fcn.005a519c
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004dde0c
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
lea ecx, [esp + 0x3c]
call fcn.005a52a4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.004de12c
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x18]
call fcn.005a5af0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004eaf98
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], esi
lea eax, [esp + 0x54]
mov dword [esp], eax
lea ecx, [esp + 0x14]
call fcn.005a5bf4
push edi
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004ddd78
mov ecx, dword [esp + 0x14]
call fcn.005a4410
mov eax, ebx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004dd0d0
mov ebx, eax
jmp 0x59c677
mov dword [esp], ebx
call fcn.004dd138
jmp 0x59c68b
Function at 0x5a835c
Capabilities:
Read file via mapping

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, ecx
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x5a838d
mov eax, dword [ecx + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_UnmapViewOfFile
push eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x5a845c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov esi, eax
cmp eax, 0x4000000
jle 0x5a8464
lea edi, [eax - 0x4000000]
and edi, 0xffff0000
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
push ebp
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov ebp, eax
test eax, eax
je 0x5a845c
mov eax, esi
sub eax, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], ebp
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
test eax, eax
je 0x5a8453
mov ecx, dword [ebx + 0x18]
lea edx, [eax + ecx]
sub edx, edi
mov dword [ebx + 0xc], edx
sub esi, ecx
mov dword [ebx + 0x14], esi
mov dword [esp], ebp
call sub.KERNEL32.dll_CloseHandle
push ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
jle 0x5a845c
xor edi, edi
jmp 0x5a83b8
Function at 0x5b4980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [esp + 0x28], ecx
mov esi, dword [esp + 0x90]
mov eax, dword [esp + 0x94]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x44], 0
mov byte [esp + 0x48], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x64], 0
mov byte [esp + 0x68], 0
mov dword [esp + 0x60], 0
mov ebp, dword [ecx + 0xc]
test ebp, ebp
jle 0x5b4b3f
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
nop
mov eax, dword [esi]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
mov ecx, esi
call dword [eax + 0x20]
push edi
mov edx, dword [esi]
lea ecx, [esp + 0x30]
mov dword [esp + 8], ecx
movsx eax, word [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov ecx, esi
call dword [edx + 0x38]
sub esp, 0xc
mov ebp, dword [esp + 0x44]
test ebp, ebp
jle 0x5b4ad0
mov edx, dword [esp + 0x40]
mov dword [esp + 0x20], edx
mov bl, byte [edx]
movzx eax, bl
shl eax, 7
cmp ebp, 0xc8
jle 0x5b4b2c
mov dword [esp + 0x24], 0x63
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
jmp 0x5b4a52
mov bl, byte [ecx]
lea edx, [eax + eax*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
shl edx, 5
add edx, eax
lea edx, [eax + edx*2]
movzx eax, bl
xor eax, edx
inc ecx
dec edi
jns 0x5b4a50
mov edx, dword [esp + 0x24]
test edx, edx
js 0x5b4b38
mov ecx, dword [esp + 0x20]
lea edx, [ecx + edx + 1]
cmp ebp, 0xc8
jle 0x5b4ac0
lea edx, [edx + ebp - 0xc8]
lea ebx, [edx + 0x64]
nop
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, eax
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
xor eax, ecx
inc edx
cmp edx, ebx
jne 0x5b4a9c
mov edx, dword [esp + 0x18]
xor dword [esp + 0x1c], edx
xor dword [esp + 0x1c], ebp
xor dword [esp + 0x1c], eax
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp dword [ecx + 0xc], eax
jg 0x5b49e4
mov eax, dword [esp + 0x60]
mov dl, byte [esp + 0x68]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x5b4b65
test dl, dl
je 0x5b4b05
test eax, eax
je 0x5b4b05
mov dword [esp], eax
call fcn.005cf79c
mov eax, dword [esp + 0x40]
cmp byte [esp + 0x48], 0
je 0x5b4b1c
test eax, eax
je 0x5b4b1c
mov dword [esp], eax
call fcn.005cf79c
mov eax, dword [esp + 0x1c]
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea ecx, [ebp - 1]
mov dword [esp + 0x24], ecx
jmp 0x5b4a44
xor edx, edx
jmp 0x5b4a81
mov dword [esp + 0x1c], 0xffffffff
jmp 0x5b4b05
mov dword [esp + 0x1c], 0xffffffff
jmp 0x5b4af5
Function at 0x5c2d6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x5c2d84
cmp dword [eax + 0x118], 0
jne 0x5c2d80
jmp fcn.005bc7a8
ret
mov dword [eax + 0x118], 1
ret

Function at 0x5c3374
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 0x2d
je 0x5c3390
cmp dword [eax + 0x118], 0
jne 0x5c338f
jmp fcn.005bc7a8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ecx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x5c3388
mov edx, dword [eax + 0x100]
xor ebx, ebx
jmp 0x5c33c7
mov esi, edx
inc edx
mov byte [eax + esi], cl
mov dword [eax + 0x100], edx
mov byte [eax + 0x104], cl
inc ebx
cmp edi, ebx
je 0x5c3388
mov cl, byte [ebp + ebx]
cmp edx, 0xff
jne 0x5c33b0
mov byte [eax + 0xff], 0
mov edx, dword [eax + 0x10c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov dword [esp], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
call dword [eax + 0x108]
mov eax, dword [esp + 0x18]
inc dword [eax + 0x120]
mov edx, 1
xor esi, esi
mov cl, byte [esp + 0x1c]
jmp 0x5c33b3
Function at 0x5c7ee0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x5c7f40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x5c8036
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x5c7fb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x5c7f85
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x5c7f95
cmp byte [esp + 0x1e], 0
je 0x5c7f95
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x5c7f95
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.005c7ee0
nop

Function at 0x5c82d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x67fb44
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x67fb5c]
sub esp, 4
test ebx, ebx
je 0x5c831b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x5c8314
test esi, esi
je 0x5c8314
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x5c82f0
mov dword [esp], 0x67fb44
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x5caf60
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x67fb78], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [0x67fb7c], eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x5cafc0
mov dword [0x67fb84], eax
mov dword [esp + 4], 0x5caf24
mov dword [esp], eax
call fcn.005ce480
test eax, eax
jne 0x5cafc7
add esp, 0x1c
ret
call sub.KERNEL32.dll_GetLastError
jmp 0x5cafb8
call sub.msvcrt.dll_abort
Function at 0x5d0ef0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.005c82b0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x5d0f26
jmp 0x5d0f65
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x5d0f23
cmp al, 0x20
je 0x5d0f23
cmp al, 0x22
jne 0x5d0f49
jmp 0x5d0fb4
cmp al, 0x20
lea esi, [esi]
je 0x5d0f50
test al, al
je 0x5d0f65
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x5d0f37
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x5d0fca
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x5d0f57
cmp al, 0x20
je 0x5d0f57
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x5d0f74
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00402b20
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x5d0fbe
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x5d0fb0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x5d0f50
cmp al, 9
je 0x5d0f57
jmp 0x5d0f65

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ad0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x18
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
xor ebx, ebx
push 0x1000
push ebx
push 0x48d078
mov dword [esp + 0x14], ebx
call fcn.00453a00
add esp, 0xc
xor eax, eax
push ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 0x1000
push 0x48d078
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401b52
push 0x1000
push 0x48d078
push esi
push edi
mov eax, 0x2d1400
call fcn.00401f50
test eax, eax
lea eax, [ebx + 1]
jne 0x401b54
mov eax, ebx
mov ecx, dword [esp + 0x18]
pop ebx
xor ecx, esp
call fcn.00451380
add esp, 0x18
ret
Function at 0x4026d0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10c
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x104], eax
xor eax, eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
push 0x18
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x70000
mov dword [esi], ebx
push edi
mov dword [esi + 4], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
call ebp
push ebx
test eax, eax
je 0x4027c3
mov eax, dword [esp + 0x30]
mul dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.0045d7f0
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
push eax
call fcn.0045d7f0
mov dword [esi], eax
jmp 0x40286c
lea edx, [esp + 0x10]
push edx
push 0x28
lea eax, [esp + 0xec]
push eax
push ebx
push ebx
push 0x700a0
push edi
call ebp
test eax, eax
je 0x4027f0
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
jmp 0x40286a
push ebx
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push 0x7405c
push edi
call ebp
test eax, eax
je 0x40281a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
jmp 0x40286f
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push 0x74004
push edi
call ebp
test eax, eax
je 0x402844
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x40286f
push ebx
lea edx, [esp + 0x10]
push edx
push 0x90
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x70048
push edi
call ebp
test eax, eax
je 0x40286f
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
mov eax, esi
call fcn.00451380
add esp, 0x10c
ret
Function at 0x4029c0
Capabilities:
Get disk information

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push edi
push 0
push 0
call ebp
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041206b
add esp, 4
mov ebx, eax
push ebx
push edi
mov dword [esp + 0x18], ebx
call ebp
cmp word [ebx], 0
mov edi, ebx
je 0x402ba2
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x402b7f
mov eax, edi
lea edx, [eax + 2]
jmp 0x402a20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402a20
sub eax, edx
sar eax, 1
add eax, eax
push eax
mov eax, dword [esi + 0x70f8]
lea ecx, [eax + eax*2]
lea edx, [esi + ecx*4 + 0x70fc]
push edi
push edx
call fcn.00453d50
add esp, 0xc
mov ebx, edi
call fcn.004030f0
mov ecx, dword [esi + 0x70f8]
mov dword [esi + ecx*4 + 0x7234], eax
mov ecx, edi
call fcn.00402fb0
mov edx, dword [esi + 0x70f8]
shl edx, 4
lea ecx, [edx + esi + 0x729c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, edi
call fcn.00402bc0
mov ecx, eax
lea ebx, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x402aa0
mov edx, dword [esi + 0x70f8]
sub ecx, ebx
sar ecx, 1
add ecx, ecx
push ecx
push eax
shl edx, 7
lea eax, [edx + esi + 0x743c]
push eax
call fcn.00453d50
add esp, 0xc
push 0x48
push 0
push 0x48e1b0
call fcn.00453a00
mov eax, dword [esi + 0x70f8]
lea ecx, [eax + eax*2]
movzx edx, word [esi + ecx*4 + 0x70fc]
add esp, 0xc
push edx
mov ebx, 0x48e1b0
call fcn.00402890
test eax, eax
je 0x402b75
mov edx, dword [0x48e1b0]
mov eax, edx
xor ebx, ebx
imul eax, eax, 0x680
lea ebp, [eax + esi + 0x8f8]
mov eax, ebp
lea ecx, [eax + 2]
mov dword [esp + 0xc], ecx
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b20
sub eax, dword [esp + 0xc]
sar eax, 1
je 0x402b3e
inc ebx
add ebp, 0x40
cmp ebx, 0x1a
jl 0x402b14
jmp 0x402b75
mov eax, 0x48e1b4
lea ebp, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b46
imul edx, edx, 0x1a
sub eax, ebp
sar eax, 1
add eax, eax
add edx, ebx
push eax
shl edx, 6
lea ecx, [edx + esi + 0x8f8]
push 0x48e1b4
push ecx
call fcn.00453d50
add esp, 0xc
inc dword [esi + 0x70f8]
mov ebx, dword [esp + 0x10]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b84
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x402a03
push ebx
call fcn.0045141a
add esp, 4
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4030f0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xb0
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebp
push esi
push edi
xor eax, eax
xor ebp, ebp
push 0x7e
lea ecx, [esp + 0x36]
push ebp
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], ax
call fcn.00453a00
add esp, 0xc
test byte [0x48f5e4], 1
jne 0x403164
or dword [0x48f5e4], 1
push str.ZwQueryVolumeInformationFile
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48f5e0], eax
movzx edx, word [ebx]
push edx
lea eax, [esp + 0x34]
push str.._c:
push eax
mov edx, 0x80
call fcn.00403300
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push 0xc0000000
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4031cb
push 1
push 0x18
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [0x48f5e0]
mov edi, eax
test edi, edi
jl 0x4031c0
mov ebp, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jge 0x4031eb
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4031ed
mov eax, ebp
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00451380
add esp, 0xb0
ret

Function at 0x403410
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
push esi
push 1
push str.SeDebugPrivilege
mov dword [esp + 0xc], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40349a
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40349a
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40349a
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push esi
push esi
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push esi
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40349a
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x4034a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x1c
ret
Function at 0x4037f0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push 1
mov esi, ecx
push ebx
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x403938
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x403938
push ebp
push edi
push 0x104
push eax
push 0x48e620
call fcn.00453a00
push 0x104
push 0
push 0x48e828
call fcn.00453a00
add esp, 0x18
push 0x48e620
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4038ea
xor edi, edi
cmp word [0x48e620], di
je 0x4038ea
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, 0x48e620
xor eax, eax
lea ecx, [ecx]
mov cx, word [ecx]
mov dx, word [eax + 0x48e622]
push 0x104
mov word [esp + 0x14], cx
push 0x48e828
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
mov word [esp + 0x1e], dx
mov word [esp + 0x20], ax
call ebp
test eax, eax
je 0x4038f2
push 0x48e828
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
push 0x48e828
push ebx
call fcn.00451f3e
add esp, 0xc
test eax, eax
je 0x403906
add edi, 4
lea eax, [edi + edi]
cmp word [eax + 0x48e620], 0
lea ecx, [eax + 0x48e620]
jne 0x403880
mov esi, dword [esp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00451380
add esp, 0x10
ret
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebx + esi*2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop ebp
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00451380
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00451380
add esp, 0x10
ret