joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11764fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
mov eax, dword [esp + 0xa8]
xor ecx, ecx
xor edx, edx
push ebx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov esi, ecx
xor ecx, ecx
push edi
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xa]
mov edi, ecx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xb]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xe]
mov ebp, ecx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xf]
shl ecx, 8
or ecx, edx
mov edx, dword [0x1178da5c]
mov eax, ecx
mov ecx, dword [0x1178da58]
xor ecx, esi
mov esi, dword [esp + 0xb4]
xor edx, edi
mov dword [esp + 0x20], ecx
mov ecx, dword [0x1178da60]
mov dword [esp + 0x24], edx
mov edx, dword [0x1178da64]
xor ecx, ebp
xor edx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov eax, dword [ecx + 0x1178da68]
mov edx, dword [esp + ecx + 0x24]
mov ebp, dword [esp + ecx + 0x2c]
mov ebx, dword [esp + ecx + 0x28]
xor eax, edx
add ecx, 4
xor eax, ebp
xor eax, ebx
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov edx, eax
shr edx, 8
mov byte [esp + 0x12], dl
and eax, 0xff
mov edi, dword [esp + 0x11]
mov edx, dword [esp + 0x10]
mov al, byte [eax + 0x1178d958]
and edi, 0xff
and edx, 0xff
mov byte [esp + 0x1b], al
mov bl, byte [edi + 0x1178d958]
mov edi, dword [esp + 0x12]
mov dl, byte [edx + 0x1178d958]
and edi, 0xff
mov byte [esp + 0x19], bl
xor eax, eax
mov bl, byte [edi + 0x1178d958]
mov ah, dl
mov byte [esp + 0x1a], bl
mov edx, dword [esp + 0x19]
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1a]
shl eax, 8
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1b]
shl eax, 8
and edx, 0xff
or edx, eax
mov eax, edx
mov edi, edx
shr eax, 0x13
shl edi, 0xd
or eax, edi
mov edi, edx
mov ebx, edx
shl edi, 0x17
shr ebx, 9
or edi, ebx
mov ebx, dword [esp + ecx + 0x1c]
xor eax, edi
xor eax, ebx
xor eax, edx
cmp ecx, 0x80
mov dword [esp + ecx + 0x2c], eax
mov dword [ecx + esi - 4], eax
jb 0x11765091
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x11765440
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
jne 0x117654d9
test eax, eax
jle 0x11765568
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
shr eax, 4
mov dword [esp + 0x2c], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x11765483
mov eax, dword [esp + 0x24]
push esi
add eax, 4
push esi
push eax
call fcn.11765200
mov ecx, dword [esp + 0x3c]
mov edx, esi
mov eax, ecx
add esp, 0xc
mov ebx, dword [edx]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov ebx, dword [edx + 4]
mov dword [eax + 4], ebx
mov ebx, dword [edx + 8]
mov dword [eax + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x11765476
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jle 0x11765568
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
add ecx, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov edx, edi
push esi
push edi
mov ebx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 8]
push eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
call fcn.11765200
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x11765533
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x117654fe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x11765570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [eax], edi
jae 0x11765583
xor eax, eax
pop edi
ret
test edi, edi
jbe 0x117655b5
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub ebx, ebp
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea esi, [ecx + ebp]
mov dl, byte [edx + eax]
mov al, byte [ebx + esi]
xor dl, al
inc ecx
cmp ecx, edi
mov byte [esi], dl
jb 0x11765594
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
ret
Function at 0x117655e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1178dae8
push 0x116d1ca4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x11765672
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x1176566b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x1176566b
cmp word [eax + 0x14], dx
je 0x1176566b
cmp dword [ebp + 0xc], edx
je 0x11765645
cmp word [eax + 4], 0x14c
jne 0x1176566b
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11765760
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x117657ad
mov edi, dword [esp + 0x18]
test edi, edi
je 0x117657ad
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x117657ad
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x117657a5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x117657b4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x11765796
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x11766080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1178daf8
push 0x116d1ca4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.11765800
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x11766133
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x1176612c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11766d70
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x11782e68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1178db14
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x11766db1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.1169be70
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.1169be70
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.11696540
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.11696540
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.11696540
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.11696540
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.11696540
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.11696540
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.11696540
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x11769280
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x11782fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.1169be60
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x117692c7
push eax
lea ecx, [esp + 0x18]
call fcn.1169c0b0
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x117692dc
push eax
lea ecx, [esp + 0x18]
call fcn.1169c0b0
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x11769347
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.116a2ce0
add esp, 0x10
test eax, eax
jne 0x11769340
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.1169be70
xor eax, eax
jmp 0x11769415
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x117693fe
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x117693fe
test esi, esi
je 0x117693fe
call fcn.116ab890
mov eax, dword [0x117d0808]
test eax, eax
je 0x117693fe
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.116a0320
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x117d0808]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.1169be70
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x11769c50
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x11769c6d
cmp edi, 4
jbe 0x11769c6d
mov dword [0x117d3d54], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x11769c8c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.116a6250
cmp edi, 0xffffffff
je 0x11769ca0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.116a6250
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11769cb8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.116a6250
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11769cce
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.116a6400
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11769ce5
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.116a6400
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11769d0d
push edi
call fcn.116d0747
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11769d24
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.116a6400
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11769d3b
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.116a6860
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11769d51
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.116a6860
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x1176acf0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11783200
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1176ad23
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x1176ad3b
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.116a4fc0
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push SysStringLen
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.116a5130
test eax, eax
je 0x1176ade7
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.116a7600
test eax, eax
jne 0x1176ad9c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116a50b0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1176adcf
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.116a5760
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.116966d0
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.11696540
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1176aeae
mov dword [eax], 0x10
jmp 0x1176aeae
mov edx, dword [0x11784e74]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x117a01ec
push ecx
mov byte [esp + 0x24], 2
call fcn.116994c0
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push SysStringLen
call fcn.116a5130
test eax, eax
jne 0x1176ae5b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.11696540
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116a50b0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1176ae92
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.116a5760
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.116966d0
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.11696540
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1176aea0
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.11696540
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116a50b0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1176aee0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11783228
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1176aff1
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1176aff1
cmp word [edi], bx
je 0x1176aff1
cmp word [esi], bx
je 0x1176aff1
lea ecx, [esp + 0xc]
call fcn.116a4fc0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1176af8f
cmp eax, 1
je 0x1176af8f
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116a5130
test eax, eax
jne 0x1176af7d
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116a51a0
test eax, eax
je 0x1176afe0
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.116a6400
mov esi, eax
jmp 0x1176b076
mov edx, dword [0x11784e74]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x117a01ec
push ecx
mov byte [esp + 0x2c], 1
call fcn.116994c0
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push SysStringLen
call fcn.116a5130
test eax, eax
jne 0x1176b005
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11696540
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116a50b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11784e74]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.116d0c75
add esp, 8
cmp eax, ebx
je 0x1176b02f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.116967c0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1176b048
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.11696540
jmp 0x1176afd3
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.116a6400
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.11696540
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11696540
lea ecx, [esp + 0xc]
call fcn.116a5180
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116a50b0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1176bed0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11783380
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.1169bed0
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1169bed0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x117d3e40]
test eax, eax
je 0x1176bf88
cmp ebp, eax
jne 0x1176bf88
mov eax, dword [0x117d3e44]
test eax, eax
je 0x1176bf88
cmp ebx, eax
jb 0x1176bf88
add eax, 0x493e0
cmp eax, ebx
jb 0x1176bf88
mov ebp, dword [0x117d3e48]
push 1
inc ebp
push 0x117d3d60
lea ecx, [esp + 0x18]
mov dword [0x117d3e48], ebp
call fcn.116a43b0
push 0x117d3d90
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1169c0b0
push 0x117d3d80
mov ecx, edi
call fcn.1169c0b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1176bffe
push edi
push esi
mov dword [0x117d3e48], 0
call fcn.1176c300
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x117d3d60
call fcn.116a43b0
push 0xffffffffffffffff
push 0
mov ecx, 0x117d3d90
mov dword [esp + 0x38], 1
mov dword [0x117d3e40], ebp
mov dword [0x117d3e44], ebx
call fcn.1169bed0
push esi
mov ecx, 0x117d3d90
call fcn.1169c0b0
push 0xffffffffffffffff
push 0
mov ecx, 0x117d3d80
call fcn.1169bed0
push edi
mov ecx, 0x117d3d80
call fcn.1169c0b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.116a4410
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1176c300
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x117833e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.1169bed0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.1169bed0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1176c439
mov edx, dword [0x117a2468]
mov cx, word [0x117a246c]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11695da0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.1169c470
mov edx, dword [0x11784e74]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.116967c0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.1169c470
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11696540
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11696540
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1176c35b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x11776cd0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x11776db6
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x11776d43
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x11776d9a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x11776d56
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x11776d86
mov ebx, 0x3d
jmp 0x11776d94
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x11776cea
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret