joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407730
Capabilities:
Encode data using xor

Disassembly:
shr eax, 4
sub esp, 0x2c
test eax, eax
jbe 0x4077da
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, edi
xor ebp, ebp
sub eax, ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
lea esi, [ecx + 8]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, edi
call fcn.004077f0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor edx, dword [esp + 0x3c]
xor eax, ebx
mov ebx, dword [esp + 0x40]
xor dword [esp + 0x30], ebx
mov ebx, dword [edi]
mov dword [esi - 8], eax
xor ecx, ebp
mov ebp, dword [edi + 4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov dword [esi - 4], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + esi]
mov eax, dword [esp + 0x30]
mov dword [esi], edx
mov dword [esp + 0x2c], edx
mov edx, dword [edi + 0xc]
mov dword [esi + 4], eax
add esp, 8
add edi, 0x10
add esi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
jne 0x407763
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
shl eax, 4
add esp, 0x2c
ret 4

Function at 0x409190
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
shr eax, 4
mov ebx, edx
mov edx, dword [ebx + 8]
push esi
mov esi, eax
mov eax, dword [ebx]
push edi
mov edi, ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], eax
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x20], edx
call fcn.00409240
lea ebp, [esi - 1]
add esp, 4
test ebp, ebp
jbe 0x409229
mov dword [esp + 0x10], esi
lea esi, [edi + 8]
add ebx, 0x18
lea ecx, [ecx]
mov edx, dword [ebx - 8]
xor edx, dword [esi - 8]
mov eax, dword [ebx - 4]
xor eax, dword [esi - 4]
mov ecx, dword [ebx]
xor ecx, dword [esi]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + 4]
xor edx, dword [esi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
add esi, 0x10
push eax
lea edi, [esi - 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
add ebx, 0x10
call fcn.00409240
add esp, 4
sub ebp, 1
jne 0x4091e0
mov esi, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
shl eax, 4
pop ebx
add esp, 0x14
ret 4
Function at 0x413290
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20c
lea eax, [esp + 0x108]
push eax
push 0x103
mov dword [esp + 8], 0xdead
call dword [0x49c110]
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
call fcn.0041dfe0
lea eax, [esp + 0xc]
push 0x4a5d54
push eax
call fcn.0041dff0
lea ecx, [esp + 0x14]
push 0x4a1330
push ecx
call fcn.0041e4f2
add esp, 0x18
test eax, eax
je 0x43b387
push esi
mov esi, eax
push esi
push 1
lea edx, [esp + 0xc]
push 2
push edx
call fcn.0041e66b
push esi
call fcn.0041e764
add esp, 0x14
push 0x4bdb38
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [0x49c398]
cmp eax, 0x20
jbe 0x41336f
mov esi, 1
lea edx, [esp + 8]
push edx
call fcn.0041e3fe
push 0x4bdb38
call fcn.0041e399
add esp, 8
test esi, esi
pop esi
je 0x43b387
push 0x4a5d64
push 0x4bdb38
call fcn.0041bc10
add esp, 8
test eax, eax
je 0x43b339
mov eax, 1
add esp, 0x20c
ret
xor esi, esi
jmp 0x413329
push 0x4a5d70
push 0x4bdb38
call fcn.0041bc10
add esp, 8
test eax, eax
jne 0x413363
push 0x4a5d7c
push 0x4bdb38
call fcn.0041bc10
add esp, 8
test eax, eax
jne 0x413363
push 0x4a5d84
push 0x4bdb38
call fcn.0041bc10
add esp, 8
test eax, eax
jne 0x413363
mov byte [0x4bdb38], 0
xor eax, eax
jmp 0x413368

Function at 0x415160
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xb0
push ebx
push ebp
push esi
push edi
mov edi, eax
push edi
call dword [0x49c34c]
lea esi, [eax + eax + 0x10]
lea eax, [esi + esi + 0x20]
push eax
push 0x42
call dword [0x49c344]
push eax
call dword [0x49c348]
test eax, eax
je 0x43f65d
push esi
mov ebx, eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [0x49c2bc]
test eax, eax
jle 0x43f664
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
lea eax, [eax + eax - 2]
push ebx
lea ecx, [esp + 0x14]
mov ebp, 1
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004152c0
mov ecx, 0x16
lea esi, [esp + 0x14]
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0xc8]
add esp, 4
lea esi, [esp + 0x68]
call fcn.00415240
mov esi, dword [0x49c32c]
push ebx
call esi
push eax
call dword [0x49c33c]
push ebx
call esi
push eax
call dword [0x49c334]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
xor eax, eax
jmp 0x415227
xor ebp, ebp
jmp 0x41520b
Function at 0x415de0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x200
push ebx
push ebp
push esi
xor edx, edx
mov cl, 1
push edi
mov edi, edi
movzx eax, cl
mov byte [esp + eax + 0x10], dl
mov al, cl
and al, 0x80
movzx eax, al
mov byte [esp + edx + 0x110], cl
inc edx
neg eax
sbb eax, eax
mov bl, cl
and eax, 0x1b
add bl, bl
xor bl, al
xor cl, bl
cmp edx, 0x100
jl 0x415df0
mov al, 1
mov ecx, 0x4baae8
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
add ecx, 4
test al, al
js 0x415fa7
xor edx, edx
add al, al
xor al, dl
cmp ecx, 0x4bab10
jl 0x415e24
mov dword [0x4b9ee8], 0x63
mov dword [0x4bd09c], 0
mov edx, 1
mov edi, edi
movzx eax, byte [esp + edx + 0x10]
lea ecx, [esp + 0x20f]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x4b9ee8], eax
mov dword [eax*4 + 0x4bcf10], edx
inc edx
cmp edx, 0x100
jl 0x415e60
xor ecx, ecx
mov bl, byte [ecx + 0x4b9ee8]
mov dl, bl
and dl, 0x80
movzx eax, dl
neg eax
sbb eax, eax
and eax, 0x1b
mov dl, bl
add dl, dl
xor dl, al
movzx esi, dl
movzx edx, bl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x4bcb10], eax
ror eax, 8
mov dword [ecx + 0x4bc710], eax
ror eax, 8
mov dword [ecx + 0x4bc310], eax
ror eax, 8
mov dword [ecx + 0x4bbf10], eax
mov al, byte [ecx + 0x4bcf10]
test al, al
je 0x415fb1
movzx eax, al
movzx esi, byte [esp + eax + 0x10]
movzx eax, byte [esp + 0x1b]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x110]
cdq
idiv edi
movzx eax, byte [esp + 0x19]
add eax, esi
movzx ebp, byte [esp + edx + 0x110]
cdq
idiv edi
movzx eax, byte [esp + 0x1e]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x110]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x110]
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebp
shl eax, 8
xor eax, ebx
mov dword [ecx + 0x4bbb10], eax
ror eax, 8
mov dword [ecx + 0x4bb710], eax
ror eax, 8
mov dword [ecx + 0x4ba6e8], eax
ror eax, 8
mov dword [ecx + 0x4ba2e8], eax
add ecx, 4
cmp ecx, 0x400
jl 0x415ea0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
mov edx, 0x1b
jmp 0x415e39
xor ebx, ebx
xor ebp, ebp
xor edi, edi
xor eax, eax
jmp 0x415f5d
Function at 0x416120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4b543c]
test eax, eax
je 0x43abe0
push ebx
xor edx, edx
mov dword [0x4b543c], 0
xor eax, eax
push edi
lea ecx, [ecx]
movzx edi, byte [eax + 0x4a12c0]
mov ecx, 0x1f
sub ecx, edi
mov edi, 1
shl edi, cl
inc eax
or edx, edi
cmp eax, 0xe
jb 0x416140
xor ecx, ecx
nop
mov eax, ecx
shr eax, 1
test cl, 1
je 0x41616b
xor eax, edx
test al, 1
je 0x4162ee
shr eax, 1
xor eax, edx
test al, 1
je 0x4162f5
shr eax, 1
xor eax, edx
test al, 1
je 0x4162fc
shr eax, 1
xor eax, edx
test al, 1
je 0x416303
shr eax, 1
xor eax, edx
test al, 1
je 0x41630a
shr eax, 1
xor eax, edx
test al, 1
je 0x416311
shr eax, 1
xor eax, edx
test al, 1
je 0x416318
shr eax, 1
xor eax, edx
mov dword [ecx*4 + 0x4b7648], eax
inc ecx
cmp ecx, 0x100
jl 0x416160
mov ecx, 0x4b8a48
jmp 0x4161e0
mov eax, dword [ecx - 0x1400]
mov edi, eax
and edi, 0xff00
mov ebx, eax
shl ebx, 0x10
add edi, ebx
shl edi, 8
mov edx, eax
shr edx, 8
mov ebx, edx
and ebx, 0xff00
add edi, ebx
mov ebx, eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx - 0x400], edi
and eax, 0xff
mov eax, dword [eax*4 + 0x4b7648]
xor eax, edx
mov edi, eax
and edi, 0xff00
mov ebx, eax
shl ebx, 0x10
add edi, ebx
mov edx, eax
shr edx, 8
shl edi, 8
mov ebx, edx
and ebx, 0xff00
add edi, ebx
mov ebx, eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx], edi
mov dword [ecx - 0x1000], eax
and eax, 0xff
mov eax, dword [eax*4 + 0x4b7648]
xor eax, edx
mov edi, eax
and edi, 0xff00
mov ebx, eax
mov edx, eax
shr edx, 8
shl ebx, 0x10
add edi, ebx
mov ebx, edx
shl edi, 8
and ebx, 0xff00
add edi, ebx
mov ebx, eax
mov dword [ecx - 0xc00], eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx + 0x400], edi
and eax, 0xff
mov eax, dword [eax*4 + 0x4b7648]
xor eax, edx
mov edx, eax
and edx, 0xff00
mov edi, eax
shl edi, 0x10
add edx, edi
mov edi, eax
shr edi, 8
shl edx, 8
and edi, 0xff00
mov dword [ecx - 0x800], eax
add edx, edi
shr eax, 0x18
add edx, eax
mov dword [ecx + 0x800], edx
add ecx, 4
cmp ecx, 0x4b8e48
jl 0x4161e0
pop edi
mov dword [0x4b5438], 0
pop ebx
ret
shr eax, 1
jmp 0x416177
shr eax, 1
jmp 0x416183
shr eax, 1
jmp 0x41618f
shr eax, 1
jmp 0x41619b
shr eax, 1
jmp 0x4161a7
shr eax, 1
jmp 0x4161b3
shr eax, 1
jmp 0x4161bf
mov eax, dword [0x4b5438]
test eax, eax
jne 0x43abe0
ret
Function at 0x418230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437e25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
push 0x4a4430
lea ecx, [edi + 8]
mov dword [edi], 0x4a825c
call fcn.00417a60
xor ebx, ebx
mov dword [esp + 0x1c], ebx
push ecx
mov dword [esp + 0x14], esp
lea esi, [edi + 0x7c]
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov byte [edi + 0x68], bl
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov byte [edi + 0x78], bl
mov byte [edi + 0x79], bl
mov byte [edi + 0x7a], bl
mov byte [edi + 0x7b], bl
mov dword [esp + 0x14], esp
call fcn.00418330
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4
Function at 0x419eff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x419f24
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x419f3c
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x419f6b
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x419faa
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x41a07e
sub edx, 0x10000
js 0x41a07e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x419f90
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x419f90
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x41a001
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x419ffe
add edx, 8
jne 0x419fe5
jmp 0x41a06f
add edx, 4
test eax, 0xffff
jne 0x41a00e
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x41a06f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x41a042
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x419f90
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x41a07e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x419f90
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x41a08f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4477f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea eax, [ebp - 0x1c]
push eax
call dword [0x49c2f4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0x49c2fc]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
shl esi, 0x10
or esi, eax
call dword [0x49c2f8]
xor esi, eax
push esi
call fcn.0041d6df
pop ecx
xor esi, esi
call fcn.0041d6f1
movzx eax, ax
mov ecx, eax
shr ecx, 8
xor cl, al
mov eax, dword [ebp + 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0x10
jl 0x44782f
pop esi
leave
ret
Function at 0x44a823
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov ecx, 0x4a5264
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 9]
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], 1
call dword [0x49c320]
mov edi, dword [ebp + 0xc]
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
lea eax, [ebp - 0x10]
add bl, 0x61
push eax
mov byte [ebp - 0xc], bl
mov dword [edi], esi
call dword [0x49c31c]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x44a893
call dword [0x49c314]
mov dword [edi], eax
xor eax, eax
jmp 0x44a92b
mov ebx, dword [0x49c104]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push esi
push esi
push 0x90018
push eax
call ebx
test eax, eax
jne 0x44a8b1
mov dword [ebp - 8], esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x8000e004
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x44a8db
call dword [0x49c314]
push dword [ebp + 8]
mov dword [edi], eax
call dword [0x49c30c]
jmp 0x44a88c
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x90020
push dword [ebp + 8]
call ebx
test eax, eax
je 0x44a8c8
cmp dword [ebp - 8], esi
je 0x44a90a
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x9001c
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [0x49c30c]
push esi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [0x49c138]
test eax, eax
je 0x44a884
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44e4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
push eax
xor edi, edi
call dword [0x49c2f4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [0x49c2fc]
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
shr eax, 0x10
shl esi, 0x10
or esi, eax
call dword [0x49c2f8]
xor esi, eax
push esi
call fcn.0041d6df
pop ecx
push 4
pop esi
call fcn.0041d6f1
movzx eax, ax
mov ecx, eax
shr ecx, 8
movzx ecx, cl
movzx eax, al
xor ecx, eax
shl edi, 8
add edi, ecx
dec esi
jne 0x44e502
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x456fb2
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2728
call fcn.0042d030
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [0x49c0e0]
test eax, eax
jns 0x456fd9
xor eax, eax
jmp 0x4571e8
push edi
push 0xc
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0041b870
mov edi, 0x2710
push edi
lea eax, [ebp - 0x2728]
push ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0041b870
add esp, 0x18
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x2728]
push eax
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
push dword [ebp + 8]
call dword [0x49c104]
test eax, eax
je 0x4571e4
mov dword [ebp - 8], 1
cmp dword [ebp + 0x10], ebx
je 0x4571d4
mov eax, dword [ebp - 0x271c]
push esi
mov esi, dword [0x49c34c]
cmp eax, ebx
jbe 0x45705c
cmp eax, edi
jae 0x45705c
lea eax, [ebp + eax - 0x2728]
push eax
call esi
mov ebx, eax
mov eax, dword [ebp - 0x2718]
test eax, eax
jbe 0x457076
cmp eax, edi
jae 0x457076
lea eax, [ebp + eax - 0x2728]
push eax
call esi
add ebx, eax
mov eax, dword [ebp - 0x2714]
test eax, eax
jbe 0x457090
cmp eax, edi
jae 0x457090
lea eax, [ebp + eax - 0x2728]
push eax
call esi
add ebx, eax
cmp dword [ebp + 0x18], 0
je 0x4570b0
mov eax, dword [ebp - 0x2710]
test eax, eax
jbe 0x4570b0
cmp eax, edi
jae 0x4570b0
lea eax, [ebp + eax - 0x2728]
push eax
call esi
add ebx, eax
add ebx, 0x10
cmp ebx, dword [ebp + 0x14]
jae 0x4571d3
mov eax, dword [ebp - 0x271c]
and dword [ebp - 4], 0
test eax, eax
jbe 0x4570f1
cmp eax, edi
jae 0x4570f1
lea eax, [ebp + eax - 0x2728]
push eax
push dword [ebp + 0x10]
call dword [0x49c320]
push dword [ebp + 0x10]
call fcn.0044bc0b
pop ecx
mov dword [ebp - 4], 1
jmp 0x4570ff
push 0x49ec12
push dword [ebp + 0x10]
call dword [0x49c320]
cmp dword [ebp - 0x2718], 0
mov esi, dword [0x49c340]
mov ebx, 0x49f4d8
jbe 0x45714a
cmp dword [ebp - 0x2718], edi
jae 0x45714a
cmp dword [ebp - 4], 0
je 0x457127
push ebx
push dword [ebp + 0x10]
call esi
mov eax, dword [ebp - 0x2718]
lea eax, [ebp + eax - 0x2728]
push eax
push dword [ebp + 0x10]
call esi
push dword [ebp + 0x10]
call fcn.0044bc0b
pop ecx
mov dword [ebp - 4], 1
cmp dword [ebp - 0x2714], 0
jbe 0x45718a
cmp dword [ebp - 0x2714], edi
jae 0x45718a
cmp dword [ebp - 4], 0
je 0x457167
push ebx
push dword [ebp + 0x10]
call esi
mov eax, dword [ebp - 0x2714]
lea eax, [ebp + eax - 0x2728]
push eax
push dword [ebp + 0x10]
call esi
push dword [ebp + 0x10]
call fcn.0044bc0b
pop ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x18], 0
je 0x4571d3
cmp dword [ebp - 0x2710], 0
jbe 0x4571d3
cmp dword [ebp - 0x2710], edi
jae 0x4571d3
cmp dword [ebp - 4], 0
je 0x4571ad
push ebx
push dword [ebp + 0x10]
call esi
mov ecx, dword [ebp - 0x2710]
lea ecx, [ebp + ecx - 0x2728]
mov eax, ecx
jmp 0x4571bf
inc eax
cmp byte [eax], 0x20
je 0x4571be
push ecx
push dword [ebp + 0x10]
call esi
push dword [ebp + 0x10]
call fcn.0044bc0b
pop ecx
pop esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4571e4
movzx ecx, byte [ebp - 0x271e]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret
Function at 0x45c9b7
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4375a9
call fcn.00435bf8
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4a8490
call fcn.0042f19b
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.0041ba3a
pop ecx
cmp eax, edi
je 0x45c9ee
mov ecx, eax
call fcn.004519bd
jmp 0x45c9f0
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x45cde3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4375a9
call fcn.00435bf8
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4a8180
call fcn.0042f19b
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.0041ba3a
pop ecx
cmp eax, edi
je 0x45ce1a
mov ecx, eax
call fcn.004519bd
jmp 0x45ce1c
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45e11a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, 0x200
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0044784d
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x65
mov eax, dword [ebp - 8]
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 0x63
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0x69
mov byte [ebp - 1], 0x78
mov eax, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x204], eax
mov byte [ebp - 4], bl
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x200], eax
mov byte [ebp - 4], bl
mov byte [ebp - 3], 1
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1fc], eax
mov al, 0xff
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 6], al
mov byte [ebp - 5], al
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], al
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1f4], eax
call fcn.00447771
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
shr ecx, 0x18
mov byte [ebp - 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 3], cl
mov ecx, eax
mov byte [ebp - 1], al
shr ecx, 8
mov byte [ebp - 2], cl
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0x77
mov byte [ebp - 3], 0x69
mov byte [ebp - 2], 0x6d
mov byte [ebp - 1], 0x61
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], bl
mov byte [ebp - 3], 1
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 4], 0x57
mov byte [ebp - 3], 0x69
mov byte [ebp - 2], 0x32
mov byte [ebp - 1], 0x6b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x208]
push eax
call fcn.004475f4
mov eax, dword [ebp + 0x14]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp + 0x14], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp + 0x15], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp + 0x17], al
mov byte [ebp + 0x16], cl
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x1c4]
add esp, 0x14
push eax
call fcn.004477f1
pop ecx
push 0x40
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00451c8f
add esp, 0xc
cmp dword [ebp + 8], ebx
je 0x45e2a7
push esi
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0041b050
add esp, 0xc
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret