joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11754110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
mov eax, dword [esp + 0xa8]
xor ecx, ecx
xor edx, edx
push ebx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov esi, ecx
xor ecx, ecx
push edi
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xa]
mov edi, ecx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xb]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xe]
mov ebp, ecx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xf]
shl ecx, 8
or ecx, edx
mov edx, dword [0x1177c9e4]
mov eax, ecx
mov ecx, dword [0x1177c9e0]
xor ecx, esi
mov esi, dword [esp + 0xb4]
xor edx, edi
mov dword [esp + 0x20], ecx
mov ecx, dword [0x1177c9e8]
mov dword [esp + 0x24], edx
mov edx, dword [0x1177c9ec]
xor ecx, ebp
xor edx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov eax, dword [ecx + 0x1177c9f0]
mov edx, dword [esp + ecx + 0x24]
mov ebp, dword [esp + ecx + 0x2c]
mov ebx, dword [esp + ecx + 0x28]
xor eax, edx
add ecx, 4
xor eax, ebp
xor eax, ebx
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov edx, eax
shr edx, 8
mov byte [esp + 0x12], dl
and eax, 0xff
mov edi, dword [esp + 0x11]
mov edx, dword [esp + 0x10]
mov al, byte [eax + 0x1177c8e0]
and edi, 0xff
and edx, 0xff
mov byte [esp + 0x1b], al
mov bl, byte [edi + 0x1177c8e0]
mov edi, dword [esp + 0x12]
mov dl, byte [edx + 0x1177c8e0]
and edi, 0xff
mov byte [esp + 0x19], bl
xor eax, eax
mov bl, byte [edi + 0x1177c8e0]
mov ah, dl
mov byte [esp + 0x1a], bl
mov edx, dword [esp + 0x19]
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1a]
shl eax, 8
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1b]
shl eax, 8
and edx, 0xff
or edx, eax
mov eax, edx
mov edi, edx
shr eax, 0x13
shl edi, 0xd
or eax, edi
mov edi, edx
mov ebx, edx
shl edi, 0x17
shr ebx, 9
or edi, ebx
mov ebx, dword [esp + ecx + 0x1c]
xor eax, edi
xor eax, ebx
xor eax, edx
cmp ecx, 0x80
mov dword [esp + ecx + 0x2c], eax
mov dword [ecx + esi - 4], eax
jb 0x117541d1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x11754580
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
jne 0x11754619
test eax, eax
jle 0x117546a8
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
shr eax, 4
mov dword [esp + 0x2c], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x117545c3
mov eax, dword [esp + 0x24]
push esi
add eax, 4
push esi
push eax
call fcn.11754340
mov ecx, dword [esp + 0x3c]
mov edx, esi
mov eax, ecx
add esp, 0xc
mov ebx, dword [edx]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov ebx, dword [edx + 4]
mov dword [eax + 4], ebx
mov ebx, dword [edx + 8]
mov dword [eax + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x117545b6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jle 0x117546a8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
add ecx, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov edx, edi
push esi
push edi
mov ebx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 8]
push eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
call fcn.11754340
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x11754673
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x1175463e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x117546b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [eax], edi
jae 0x117546c3
xor eax, eax
pop edi
ret
test edi, edi
jbe 0x117546f5
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub ebx, ebp
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea esi, [ecx + ebp]
mov dl, byte [edx + eax]
mov al, byte [ebx + esi]
xor dl, al
inc ecx
cmp ecx, edi
mov byte [esi], dl
jb 0x117546d4
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
ret
Function at 0x11754720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1177ca70
push 0x116c0e14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x117547b2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x117547ab
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x117547ab
cmp word [eax + 0x14], dx
je 0x117547ab
cmp dword [ebp + 0xc], edx
je 0x11754785
cmp word [eax + 4], 0x14c
jne 0x117547ab
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x117548a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x117548ed
mov edi, dword [esp + 0x18]
test edi, edi
je 0x117548ed
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x117548ed
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x117548e5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x117548f4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x117548d6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x117551c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1177ca80
push 0x116c0e14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.11754940
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x11755273
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x1175526c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11755eb0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x11771ed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1177ca9c
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x11755ef1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.1168afb0
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.1168afb0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.11685680
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.11685680
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.11685680
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.11685680
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.11685680
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.11685680
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.11685680
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x117583c0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x1177202b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.1168afa0
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x11758407
push eax
lea ecx, [esp + 0x18]
call fcn.1168b1f0
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x1175841c
push eax
lea ecx, [esp + 0x18]
call fcn.1168b1f0
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x11758487
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.11691e20
add esp, 0x10
test eax, eax
jne 0x11758480
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.1168afb0
xor eax, eax
jmp 0x11758555
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x1175853e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x1175853e
test esi, esi
je 0x1175853e
call fcn.1169a9d0
mov eax, dword [0x117be688]
test eax, eax
je 0x1175853e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.1168f460
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x117be688]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.1168afb0
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x11758d90
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x11758dad
cmp edi, 4
jbe 0x11758dad
mov dword [0x117c1bd4], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x11758dcc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.11695390
cmp edi, 0xffffffff
je 0x11758de0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.11695390
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11758df8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.11695390
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11758e0e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.11695540
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11758e25
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.11695540
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11758e4d
push edi
call fcn.116bf887
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11758e64
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.11695540
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11758e7b
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.116959a0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11758e91
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.116959a0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x11759e30
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11772270
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x11759e63
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x11759e7b
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.11694100
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push SysStringLen
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.11694270
test eax, eax
je 0x11759f27
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.11696740
test eax, eax
jne 0x11759edc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116941f0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11759f0f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.116948a0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.11685810
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.11685680
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x11759fee
mov dword [eax], 0x10
jmp 0x11759fee
mov edx, dword [0x11773dfc]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x1178f20c
push ecx
mov byte [esp + 0x24], 2
call fcn.11688600
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push SysStringLen
call fcn.11694270
test eax, eax
jne 0x11759f9b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.11685680
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116941f0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x11759fd2
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.116948a0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.11685810
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.11685680
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11759fe0
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.11685680
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116941f0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175a020
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11772298
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1175a131
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1175a131
cmp word [edi], bx
je 0x1175a131
cmp word [esi], bx
je 0x1175a131
lea ecx, [esp + 0xc]
call fcn.11694100
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1175a0cf
cmp eax, 1
je 0x1175a0cf
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.11694270
test eax, eax
jne 0x1175a0bd
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116942e0
test eax, eax
je 0x1175a120
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.11695540
mov esi, eax
jmp 0x1175a1b6
mov edx, dword [0x11773dfc]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x1178f20c
push ecx
mov byte [esp + 0x2c], 1
call fcn.11688600
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push SysStringLen
call fcn.11694270
test eax, eax
jne 0x1175a145
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685680
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116941f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11773dfc]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.116bfdb5
add esp, 8
cmp eax, ebx
je 0x1175a16f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.11685900
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1175a188
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.11685680
jmp 0x1175a113
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.11695540
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.11685680
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685680
lea ecx, [esp + 0xc]
call fcn.116942c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116941f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175b010
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117723f0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.1168b010
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1168b010
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x117c1cc0]
test eax, eax
je 0x1175b0c8
cmp ebp, eax
jne 0x1175b0c8
mov eax, dword [0x117c1cc4]
test eax, eax
je 0x1175b0c8
cmp ebx, eax
jb 0x1175b0c8
add eax, 0x493e0
cmp eax, ebx
jb 0x1175b0c8
mov ebp, dword [0x117c1cc8]
push 1
inc ebp
push 0x117c1be0
lea ecx, [esp + 0x18]
mov dword [0x117c1cc8], ebp
call fcn.116934f0
push 0x117c1c10
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1168b1f0
push 0x117c1c00
mov ecx, edi
call fcn.1168b1f0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1175b13e
push edi
push esi
mov dword [0x117c1cc8], 0
call fcn.1175b440
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x117c1be0
call fcn.116934f0
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1c10
mov dword [esp + 0x38], 1
mov dword [0x117c1cc0], ebp
mov dword [0x117c1cc4], ebx
call fcn.1168b010
push esi
mov ecx, 0x117c1c10
call fcn.1168b1f0
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1c00
call fcn.1168b010
push edi
mov ecx, 0x117c1c00
call fcn.1168b1f0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.11693550
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1175b440
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11772456
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.1168b010
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.1168b010
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1175b579
mov edx, dword [0x1179128c]
mov cx, word [0x11791290]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11684ee0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.1168b5b0
mov edx, dword [0x11773dfc]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.11685900
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.1168b5b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11685680
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11685680
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1175b49b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x11765e10
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x11765ef6
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x11765e83
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x11765eda
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x11765e96
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x11765ec6
mov ebx, 0x3d
jmp 0x11765ed4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x11765e2a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret