joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485556
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b40a6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
add ebx, 0x34
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov byte [esp + 0x17], 0
sar eax, 2
test eax, eax
jbe 0x48565b
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.0041e10a
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov dword [esp + 0x50], 1
lea edi, [esp + 0x18]
mov esi, eax
call fcn.00484948
test eax, eax
jl 0x485635
cmp dword [esp + 0x18], 0
je 0x485635
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6743b4
push 7
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x485625
mov byte [esp + 0x17], 1
mov byte [esp + 0x50], 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or dword [esp + 0x50], 0xffffffff
lea eax, [esp + 0x18]
push eax
call fcn.00427092
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x4855b3
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4857cd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x4201a8
push 0x4447c1
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00584250
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
push 3
pop ecx
mov word [esp + 0x34], cx
xor ecx, ecx
cmp byte [ebp + 0xc], al
mov dword [esp + 0x30], eax
sete cl
add ebx, 0x34
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x485906
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.0041e10a
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.00484948
test eax, eax
jl 0x4858e0
cmp dword [esp + 0x18], 0
je 0x4858e0
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6743b4
push 6
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x4858d0
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.00427092
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x485861
or dword [esp + 0x60], 0xffffffff
push 0x4201a8
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.00582aab
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x485fe1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x4201a8
push 0x4447c1
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00584250
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x486112
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.0041e10a
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.00484948
test eax, eax
jl 0x4860ec
cmp dword [esp + 0x18], 0
je 0x4860ec
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6743b4
push 0x10
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x4860dc
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.00427092
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x48606d
or dword [esp + 0x60], 0xffffffff
push 0x4201a8
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.00582aab
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4864e8
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x290
lea ebp, [esp - 4]
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp + 0x290], eax
push 0x3c
mov eax, 0x5bba65
call fcn.0058ec5e
mov eax, dword [0x6ddde8]
push 0x104
lea ecx, [ebp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4866f8
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp + 0x38]
push eax
lea esi, [ebp]
call fcn.0040820f
mov byte [ebp - 4], 1
push 1
mov eax, esi
call fcn.00486bc8
cmp eax, 0xffffffff
je 0x4866e9
mov ecx, dword [ebp + 0x14]
dec ecx
push ecx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
push eax
call fcn.00408405
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00409acd
mov byte [ebp - 4], 1
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409da6
lea eax, [ebp + 0x240]
push eax
push 0x682060
call fcn.004223ce
pop ecx
pop ecx
mov ebx, str.AppID_
push ebx
lea esi, [ebp - 0x2c]
call fcn.0040820f
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x240]
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0045ca67
add esp, 0xc
mov byte [ebp - 4], 5
push edi
push 1
call fcn.00409da6
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], edi
je 0x48660b
cmp dword [ebp + 0x34], 8
jae 0x4865d9
lea eax, [ebp + 0x20]
push eax
mov esi, str.ThreatTankService
mov ecx, esi
mov edi, 0x6810b8
call fcn.00486b44
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x4865f8
lea eax, [ebp + 0x20]
push esi
push str.LocalService
push eax
call fcn.00486bae
add esp, 0xc
xor edi, edi
jmp 0x486620
cmp dword [ebp + 0x34], 8
jae 0x486614
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ebx
lea esi, [ebp - 0x48]
call fcn.0040820f
mov byte [ebp - 4], 6
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040dbd7
add esp, 0xc
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 0x1c]
call fcn.00409acd
mov byte [ebp - 4], 6
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409da6
mov byte [ebp - 4], 5
push edi
push 1
lea esi, [ebp - 0x48]
call fcn.00409da6
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], edi
je 0x4866b2
cmp dword [ebp + 0x34], 8
jae 0x48667f
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x6810b8
mov edi, ecx
call fcn.00486b44
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x486699
lea eax, [ebp + 0x20]
lea ecx, [ebp + 0x240]
push ecx
push str.AppID
push eax
call fcn.00486bae
add esp, 0xc
xor edi, edi
jmp 0x4866c7
cmp dword [ebp + 0x34], 8
jae 0x4866bb
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [ebp - 4], 1
push edi
push 1
lea esi, [ebp + 0x1c]
call fcn.00409da6
mov byte [ebp - 4], 0
push edi
push 1
lea esi, [ebp]
call fcn.00409da6
xor eax, eax
jmp 0x4866fd
mov byte [ebp - 4], 0
push edi
push 1
lea esi, [ebp]
call fcn.00409da6
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
call fcn.00581268
add ebp, 0x294
leave
ret
Function at 0x486a19
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x3c
mov eax, 0x5bb9c8
call fcn.0058ec5e
mov eax, dword [ebp + 0x7c]
lea ecx, [ebp + 0x20]
push ecx
push eax
call fcn.004223ce
pop ecx
pop ecx
mov dword [ebp], 0x80004005
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.CLSID_
lea esi, [ebp - 0x2c]
call fcn.0040820f
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp + 4]
push eax
call fcn.0045ca67
add esp, 0xc
mov byte [ebp - 4], 3
push ebx
push 1
call fcn.00409da6
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x486a8c
lea eax, [ebp + 8]
push eax
push closesocket
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call edi
cmp eax, ebx
jne 0x486b08
push str.AppID_
lea esi, [ebp - 0x48]
call fcn.0040820f
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0045ca67
add esp, 0xc
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 4]
call fcn.00409acd
mov byte [ebp - 4], 4
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409da6
mov byte [ebp - 4], 3
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409da6
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x486af9
lea eax, [ebp + 8]
push eax
push closesocket
call edi
cmp eax, ebx
jne 0x486b08
mov dword [ebp], ebx
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp + 4]
call fcn.00409da6
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.00581268
add ebp, 0x74
leave
ret

Function at 0x486c40
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5bb960
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [0x6dc778]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dc778
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x486caa
test esi, 0xffff0000
jne 0x486cae
movzx esi, si
push esi
call fcn.00402e28
add esp, 4
test eax, eax
je 0x486ccb
push esi
push eax
push edi
call fcn.0040cd66
jmp 0x486ccb
xor eax, eax
jmp 0x486cc2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486cb3
sub eax, edx
sar eax, 1
push eax
push esi
mov eax, edi
call fcn.0040b4fa
mov dword [esp + 0x14], 1
mov eax, dword [edi]
push eax
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x486e30
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b57b4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.005812e3
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x486e8c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x486e8e
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x486f34
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x486ef5
mov eax, dword [edi]
push esi
push eax
call fcn.00582da6
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x486ef2
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.00586790
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x486f1b
cmp dword [esp + 0x40], esi
je 0x486f34
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x486f34
mov eax, dword [esi]
push ebx
push eax
call fcn.00582da6
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x486f50
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x486fc6
ja 0x486f69
cmp esi, dword [esp + 0x20]
jae 0x486fca
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x486f85
jb 0x486f81
cmp ecx, 0x10000
jae 0x486f85
mov edi, ecx
jmp 0x486f8a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x486fc6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x486fc6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x486f69
ja 0x486fc6
cmp esi, dword [esp + 0x20]
jb 0x486f69
cmp esi, dword [esp + 0x20]
jne 0x486fe7
cmp ebp, ebx
jne 0x486fe7
or esi, ebp
je 0x486fdf
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x486ff0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5b5768
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x487095
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
call fcn.00486f50
add esp, 0x10
test al, al
je 0x48707d
mov dword [esp + 0x18], 0xffffffff
push esi
call ebx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esp + 0x2c], 0
je 0x487095
push esi
call ebx
or esi, 0xffffffff
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x18], 0xffffffff
cmp esi, 0xffffffff
je 0x4870a5
push esi
call ebx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x487130
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x487156
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x487690
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5b6d2c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x34], ebx
push 0xc
mov dword [esp + 0x1c], ebx
call fcn.005812e3
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, 1
mov dword [esp + 0x34], edi
cmp eax, ebx
je 0x4876ec
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
jmp 0x4876ee
xor eax, eax
mov byte [esp + 0x34], bl
mov dword [ebp], eax
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x48778d
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and edx, dword [esp + 0x20]
cmp edx, 0xffffffff
je 0x48778d
push ebx
push ebx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00486e30
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 2
mov esi, dword [ebp]
add dword [esi + 8], 0xffffffff
jne 0x487755
xor edi, edi
call fcn.0041ad11
mov edi, 1
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
add dword [eax + 8], edi
mov dword [ebp], eax
mov byte [esp + 0x34], bl
mov eax, dword [esp + 0x14]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x48778d
xor edi, edi
call fcn.0041ad11
mov edx, dword [esp + 0x14]
push edx
call fcn.0058125d
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4878b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b9909
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x6dc778]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dc778
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], 1
call fcn.004877b0
add esp, 8
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x18]
cmp dword [eax], ebx
je 0x487972
cmp dword [eax + 4], ebx
je 0x487972
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x487952
mov eax, esi
mov ecx, ebp
call fcn.0040d740
cmp esi, ebx
mov eax, dword [ebp]
jl 0x4879b4
cmp esi, dword [eax - 8]
jg 0x4879b4
push esi
mov dword [eax - 0xc], esi
mov edx, dword [ebp]
push edi
push eax
mov byte [esi + edx], bl
call fcn.00586840
add esp, 0xc
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x18]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x48799e
xor edi, edi
call fcn.0041ad11
mov eax, dword [esp + 0x18]
push eax
call fcn.0058125d
add esp, 4
mov dword [esp + 0x18], ebx
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00402d13
int3
Function at 0x487f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5bf8dc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x50], ebp
mov edi, ecx
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
call fcn.00488130
mov dword [esp + 0x50], ebp
push ebp
push ebp
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
cmp ebx, ebp
je 0x48810c
lea esi, [ebx + 1]
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], cx
cmp esi, 0xffffffff
jne 0x487f99
call fcn.0058070b
jmp 0x487fa1
cmp esi, 0x7ffffffe
jbe 0x487faa
call fcn.0058070b
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x487fdf
mov edx, dword [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x30]
push eax
call fcn.0040cbd6
mov eax, dword [esp + 0x40]
cmp esi, ebp
jbe 0x48803c
cmp esi, 1
jne 0x487ffb
cmp eax, 8
mov eax, dword [esp + 0x2c]
jae 0x487fd8
lea eax, [esp + 0x2c]
xor edx, edx
mov word [eax], dx
jmp 0x488023
cmp esi, ebp
jne 0x487fc4
cmp eax, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebp
jae 0x487ff4
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax], cx
jmp 0x48803c
mov edi, dword [esp + 0x2c]
cmp eax, 8
jae 0x488008
lea edi, [esp + 0x2c]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x488036
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x488057
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4880e0
cmp dword [esp + 0x40], esi
mov esi, dword [esp + 0x2c]
jae 0x488071
lea esi, [esp + 0x2c]
cmp word [esi], bp
je 0x4880e0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00486c40
mov byte [esp + 0x50], 2
mov ebx, eax
call fcn.004881a0
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4880b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x4880c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4880c0
mov edi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x488076
xor ebp, ebp
mov byte [esp + 0x50], 0
cmp dword [esp + 0x40], 8
jb 0x4880f9
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0058125d
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], dx
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00581268
add esp, 0x40
ret