joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11775220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
mov eax, dword [esp + 0xa8]
xor ecx, ecx
xor edx, edx
push ebx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov esi, ecx
xor ecx, ecx
push edi
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xa]
mov edi, ecx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xb]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xe]
mov ebp, ecx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xf]
shl ecx, 8
or ecx, edx
mov edx, dword [0x1179dad4]
mov eax, ecx
mov ecx, dword [0x1179dad0]
xor ecx, esi
mov esi, dword [esp + 0xb4]
xor edx, edi
mov dword [esp + 0x20], ecx
mov ecx, dword [0x1179dad8]
mov dword [esp + 0x24], edx
mov edx, dword [0x1179dadc]
xor ecx, ebp
xor edx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov eax, dword [ecx + 0x1179dae0]
mov edx, dword [esp + ecx + 0x24]
mov ebp, dword [esp + ecx + 0x2c]
mov ebx, dword [esp + ecx + 0x28]
xor eax, edx
add ecx, 4
xor eax, ebp
xor eax, ebx
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov edx, eax
shr edx, 8
mov byte [esp + 0x12], dl
and eax, 0xff
mov edi, dword [esp + 0x11]
mov edx, dword [esp + 0x10]
mov al, byte [eax + 0x1179d9d0]
and edi, 0xff
and edx, 0xff
mov byte [esp + 0x1b], al
mov bl, byte [edi + 0x1179d9d0]
mov edi, dword [esp + 0x12]
mov dl, byte [edx + 0x1179d9d0]
and edi, 0xff
mov byte [esp + 0x19], bl
xor eax, eax
mov bl, byte [edi + 0x1179d9d0]
mov ah, dl
mov byte [esp + 0x1a], bl
mov edx, dword [esp + 0x19]
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1a]
shl eax, 8
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1b]
shl eax, 8
and edx, 0xff
or edx, eax
mov eax, edx
mov edi, edx
shr eax, 0x13
shl edi, 0xd
or eax, edi
mov edi, edx
mov ebx, edx
shl edi, 0x17
shr ebx, 9
or edi, ebx
mov ebx, dword [esp + ecx + 0x1c]
xor eax, edi
xor eax, ebx
xor eax, edx
cmp ecx, 0x80
mov dword [esp + ecx + 0x2c], eax
mov dword [ecx + esi - 4], eax
jb 0x117752e1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x11775690
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
jne 0x11775729
test eax, eax
jle 0x117757b8
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
shr eax, 4
mov dword [esp + 0x2c], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x117756d3
mov eax, dword [esp + 0x24]
push esi
add eax, 4
push esi
push eax
call fcn.11775450
mov ecx, dword [esp + 0x3c]
mov edx, esi
mov eax, ecx
add esp, 0xc
mov ebx, dword [edx]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov ebx, dword [edx + 4]
mov dword [eax + 4], ebx
mov ebx, dword [edx + 8]
mov dword [eax + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x117756c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jle 0x117757b8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
add ecx, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov edx, edi
push esi
push edi
mov ebx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 8]
push eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
call fcn.11775450
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x11775783
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x1177574e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x117757c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [eax], edi
jae 0x117757d3
xor eax, eax
pop edi
ret
test edi, edi
jbe 0x11775805
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub ebx, ebp
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea esi, [ecx + ebp]
mov dl, byte [edx + eax]
mov al, byte [ebx + esi]
xor dl, al
inc ecx
cmp ecx, edi
mov byte [esi], dl
jb 0x117757e4
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
ret
Function at 0x11775830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1179db60
push 0x116e1ef4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x117758c2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x117758bb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x117758bb
cmp word [eax + 0x14], dx
je 0x117758bb
cmp dword [ebp + 0xc], edx
je 0x11775895
cmp word [eax + 4], 0x14c
jne 0x117758bb
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x117759b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x117759fd
mov edi, dword [esp + 0x18]
test edi, edi
je 0x117759fd
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x117759fd
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x117759f5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x11775a04
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x117759e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x117762d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1179db70
push 0x116e1ef4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.11775a50
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x11776383
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x1177637c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11776fc0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x117930f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1179db8c
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x11777001
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.116ac0c0
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.116ac0c0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.116a6790
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.116a6790
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.116a6790
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.116a6790
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.116a6790
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.116a6790
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.116a6790
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x117794d0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x1179324b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.116ac0b0
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x11779517
push eax
lea ecx, [esp + 0x18]
call fcn.116ac300
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x1177952c
push eax
lea ecx, [esp + 0x18]
call fcn.116ac300
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x11779597
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.116b2f30
add esp, 0x10
test eax, eax
jne 0x11779590
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.116ac0c0
xor eax, eax
jmp 0x11779665
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x1177964e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x1177964e
test esi, esi
je 0x1177964e
call fcn.116bbae0
mov eax, dword [0x117e0918]
test eax, eax
je 0x1177964e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.116b0570
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x117e0918]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.116ac0c0
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x11779ea0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x11779ebd
cmp edi, 4
jbe 0x11779ebd
mov dword [0x117e3e64], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x11779edc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.116b64a0
cmp edi, 0xffffffff
je 0x11779ef0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.116b64a0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11779f08
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.116b64a0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11779f1e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.116b6650
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11779f35
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.116b6650
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11779f5d
push edi
call fcn.116e0997
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11779f74
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.116b6650
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11779f8b
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.116b6ab0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11779fa1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.116b6ab0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x1177af40
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11793490
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1177af73
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x1177af8b
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.116b5210
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push SysStringLen
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.116b5380
test eax, eax
je 0x1177b037
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.116b7850
test eax, eax
jne 0x1177afec
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116b5300
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1177b01f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.116b59b0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.116a6920
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.116a6790
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1177b0fe
mov dword [eax], 0x10
jmp 0x1177b0fe
mov edx, dword [0x11794eec]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x117b01ec
push ecx
mov byte [esp + 0x24], 2
call fcn.116a9710
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push SysStringLen
call fcn.116b5380
test eax, eax
jne 0x1177b0ab
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.116a6790
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116b5300
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1177b0e2
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.116b59b0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.116a6920
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.116a6790
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1177b0f0
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.116a6790
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116b5300
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1177b130
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117934b8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1177b241
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1177b241
cmp word [edi], bx
je 0x1177b241
cmp word [esi], bx
je 0x1177b241
lea ecx, [esp + 0xc]
call fcn.116b5210
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1177b1df
cmp eax, 1
je 0x1177b1df
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116b5380
test eax, eax
jne 0x1177b1cd
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116b53f0
test eax, eax
je 0x1177b230
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.116b6650
mov esi, eax
jmp 0x1177b2c6
mov edx, dword [0x11794eec]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x117b01ec
push ecx
mov byte [esp + 0x2c], 1
call fcn.116a9710
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push SysStringLen
call fcn.116b5380
test eax, eax
jne 0x1177b255
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.116a6790
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116b5300
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11794eec]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.116e0ec5
add esp, 8
cmp eax, ebx
je 0x1177b27f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.116a6a10
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1177b298
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.116a6790
jmp 0x1177b223
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.116b6650
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.116a6790
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.116a6790
lea ecx, [esp + 0xc]
call fcn.116b53d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116b5300
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1177c120
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11793610
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.116ac120
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.116ac120
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x117e3f50]
test eax, eax
je 0x1177c1d8
cmp ebp, eax
jne 0x1177c1d8
mov eax, dword [0x117e3f54]
test eax, eax
je 0x1177c1d8
cmp ebx, eax
jb 0x1177c1d8
add eax, 0x493e0
cmp eax, ebx
jb 0x1177c1d8
mov ebp, dword [0x117e3f58]
push 1
inc ebp
push 0x117e3e70
lea ecx, [esp + 0x18]
mov dword [0x117e3f58], ebp
call fcn.116b4600
push 0x117e3ea0
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.116ac300
push 0x117e3e90
mov ecx, edi
call fcn.116ac300
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1177c24e
push edi
push esi
mov dword [0x117e3f58], 0
call fcn.1177c550
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x117e3e70
call fcn.116b4600
push 0xffffffffffffffff
push 0
mov ecx, 0x117e3ea0
mov dword [esp + 0x38], 1
mov dword [0x117e3f50], ebp
mov dword [0x117e3f54], ebx
call fcn.116ac120
push esi
mov ecx, 0x117e3ea0
call fcn.116ac300
push 0xffffffffffffffff
push 0
mov ecx, 0x117e3e90
call fcn.116ac120
push edi
mov ecx, 0x117e3e90
call fcn.116ac300
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.116b4660
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1177c550
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11793676
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.116ac120
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.116ac120
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1177c689
mov edx, dword [0x117b2468]
mov cx, word [0x117b246c]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.116a5ff0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.116ac6c0
mov edx, dword [0x11794eec]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.116a6a10
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.116ac6c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.116a6790
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.116a6790
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1177c5ab
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x11786f20
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x11787006
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x11786f93
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x11786fea
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x11786fa6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x11786fd6
mov ebx, 0x3d
jmp 0x11786fe4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x11786f3a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret