joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452bc1
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push 0x3c
mov eax, 0x4b3d45
call fcn.004991ba
xor edi, edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
call fcn.00452a57
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.00452a57
mov ecx, dword [ebp - 0x28]
add esp, 0x10
cmp dword [ebp - 0x14], 0x10
jae 0x452bfa
lea ecx, [ebp - 0x28]
cmp dword [eax + 0x18], 0x10
jb 0x452c05
mov eax, dword [eax + 4]
jmp 0x452c08
add eax, 4
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00403db0
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x452c28
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x452c4b
mov ecx, dword [ebp - 0x28]
or eax, 6
cmp dword [ebp - 0x14], 0x10
jae 0x452c43
lea ecx, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403db0
call fcn.0049923d
ret

Function at 0x452e1b
Capabilities:
Get disk information

Disassembly:
push 0x228
mov eax, 0x4b5556
call fcn.004991ba
xor ebx, ebx
cmp edi, ebx
je 0x452f2b
lea eax, [ebp - 0x231]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x231], bl
call fcn.004528ad
pop ecx
pop ecx
test al, al
je 0x452f2b
cmp byte [ebp - 0x231], bl
je 0x452f2b
movsx ax, byte [ebp + 8]
movzx eax, ax
push eax
push str._c:_
lea ecx, [ebp - 0x230]
call fcn.0042f9b3
xor eax, eax
mov esi, 0xfe
mov dword [ebp - 4], ebx
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.00499dd0
add esp, 0x14
xor eax, eax
push esi
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
call fcn.00499dd0
mov ecx, dword [ebp - 0x22c]
add esp, 0xc
cmp dword [ebp - 0x218], 8
jae 0x452ec9
lea ecx, [ebp - 0x22c]
mov eax, 0x80
push eax
lea edx, [ebp - 0x114]
push edx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x214]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp word [ebp - 0x114], bx
je 0x452f1d
push dword [ebp + 8]
call fcn.00452968
cmp eax, ebx
je 0x452f11
push ebx
push 1
lea esi, [ebp - 0x230]
mov dword [edi], eax
call fcn.00403ead
mov al, 1
jmp 0x452f2d
push dword [ebp + 8]
call fcn.00452ce2
cmp eax, ebx
jne 0x452efd
push ebx
push 1
lea esi, [ebp - 0x230]
call fcn.00403ead
xor al, al
call fcn.0049923d
ret
Function at 0x452fab
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push 0x43c
mov eax, 0x4b634d
call fcn.004991ba
call fcn.0042e166
mov dword [ebp - 0x444], eax
call fcn.0042db48
mov dword [ebp - 0x448], eax
call fcn.00452f33
mov dword [ebp - 0x440], eax
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00499dd0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x440]
xor ecx, ecx
call fcn.0042d976
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x45307d
cmp word [0x4ee830], ax
je 0x453056
push esi
push 0x4ee830
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x440]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x45307d
lea eax, [ebp - 0x420]
push eax
push str.file_not_found:__s
call fcn.004580a3
pop ecx
pop ecx
xor eax, eax
jmp 0x4531ff
xor eax, eax
push edi
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00499dd0
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, str.driverspoflt64.sys
cmp dword [ebp - 0x448], edi
jne 0x4530b9
mov eax, str.driverspoflt32.sys
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
je 0x4531d3
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
call fcn.0042d679
test eax, eax
jne 0x4531ce
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call esi
mov ebx, eax
cmp ebx, edi
je 0x45311f
push str.upgrade_poflt_driver_succeeded
call fcn.00444193
pop ecx
jmp 0x4531ea
lea eax, [ebp - 0x218]
push eax
push str.overwrite__s_failed__rename_it
call fcn.00444300
pop ecx
pop ecx
call fcn.0042dd90
push eax
lea eax, [ebp - 0x218]
push eax
push str._s._08x.dirty
lea ecx, [ebp - 0x43c]
call fcn.0042f9b3
add esp, 0xc
mov dword [ebp - 4], edi
cmp dword [ebp - 0x424], 8
mov eax, dword [ebp - 0x438]
jae 0x45316a
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea eax, [ebp - 0x218]
je 0x4531ad
push edi
push eax
lea eax, [ebp - 0x420]
push eax
call esi
mov ebx, eax
cmp ebx, edi
je 0x45319f
push str.upgrade_poflt_driver_succeeded
call fcn.00444193
jmp 0x4531b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.copy_poflt_driver_failed:__d
jmp 0x4531b3
push eax
push str.rename__s_failed
call fcn.00444300
pop ecx
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push 1
lea esi, [ebp - 0x43c]
call fcn.00403ead
jmp 0x4531ea
xor ebx, ebx
inc ebx
jmp 0x4531ea
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
cmp dword [ebp - 0x444], edi
je 0x4531fd
push dword [ebp - 0x444]
call fcn.0042e1a6
mov eax, ebx
call fcn.0049923d
ret
Function at 0x453205
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0042db48
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00499dd0
add esp, 0xc
call fcn.00452f33
mov ebx, eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
xor ecx, ecx
call fcn.0042d976
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x4532aa
cmp word [0x4ee830], ax
je 0x45329d
push esi
push 0x4ee830
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x4532e4
call fcn.0042e166
xor eax, eax
mov ecx, str.poflt64.sys
cmp dword [ebp - 0x214], eax
jne 0x4532f3
mov ecx, str.poflt32.sys
mov edx, str.poflt32
push eax
push 0x40b3c
push str.poflt_minifilter_driver
lea eax, [ebp - 0x210]
push eax
call fcn.0045c89f
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret
mov edx, str.poflt64
jmp 0x4532c8
Function at 0x456012
Capabilities:
Check if file exists

Disassembly:
push 0xa8
mov eax, 0x4b2881
call fcn.004991ba
mov eax, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x456082
push edi
lea ecx, [ebp - 0x98]
call fcn.00403461
lea eax, [ebp - 0x98]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x78], ebx
call fcn.00401215
cmp dword [eax + 0x18], 8
pop ecx
mov dword [ebp - 0x78], 3
jb 0x456071
mov eax, dword [eax + 4]
jmp 0x456074
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x71], bl
test eax, eax
je 0x456086
mov byte [ebp - 0x71], 0
test byte [ebp - 0x78], 2
je 0x45609d
and dword [ebp - 0x78], 0xfffffffd
push esi
push ebx
lea esi, [ebp - 0xb4]
call fcn.00403ead
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x78], bl
je 0x4560b4
push 0
push ebx
lea ecx, [ebp - 0x98]
call fcn.00403db0
cmp byte [ebp - 0x71], 0
je 0x4560be
xor al, al
jmp 0x45610a
lea esi, [ebp - 0x6c]
call fcn.0040344e
lea esi, [ebp - 0x50]
call fcn.0040344e
lea esi, [ebp - 0x34]
call fcn.0040344e
push str.attachment
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.00403d3c
push edi
mov ecx, esi
mov byte [ebp - 0x70], bl
call fcn.00403d3c
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x7c]
add eax, 0x3c
call fcn.00456ad0
lea esi, [ebp - 0x70]
call fcn.004561ff
mov al, bl
call fcn.0049923d
ret 4
Function at 0x4571e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x4cbc64
push edi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x45726b
mov ebx, 0x4eeb40
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x45722c
push ebx
call esi
test eax, eax
jne 0x45726b
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00499dd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
xor ecx, ecx
call fcn.0042d976
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x45727a
push dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x45727c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret

Function at 0x45827a
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x4b17cb
call fcn.004991ba
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, ebx
mov dword [ebp - 0x30], esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x458299
sub eax, edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.0040492f
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
jbe 0x45839f
jmp 0x4582c8
mov ebx, dword [ebp + 0xc]
movsx eax, byte [esi + ebx]
mov al, byte [eax + 0x4c94d8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x4582dc
cmp al, 0xff
je 0x4582c8
cmp al, 0xff
je 0x45839f
movsx ecx, byte [esi + ebx]
mov cl, byte [ecx + 0x4c94d8]
inc esi
mov byte [ebp - 0x31], cl
cmp esi, dword [ebp - 0x30]
jae 0x4582fc
cmp cl, 0xff
je 0x4582e4
cmp cl, 0xff
je 0x45839f
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00430fbc
jmp 0x458323
mov ebx, dword [ebp + 0xc]
mov bl, byte [esi + ebx]
inc esi
cmp bl, 0x3d
je 0x45839f
movsx eax, bl
mov bl, byte [eax + 0x4c94d8]
cmp esi, dword [ebp - 0x30]
jae 0x45833f
cmp bl, 0xff
je 0x458320
cmp bl, 0xff
je 0x45839f
mov al, byte [ebp - 0x31]
mov cl, bl
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00430fbc
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x45839f
movsx eax, al
mov al, byte [eax + 0x4c94d8]
cmp esi, dword [ebp - 0x30]
jae 0x45837f
cmp al, 0xff
je 0x458362
cmp al, 0xff
je 0x45839f
shl bl, 6
or bl, al
movzx eax, bl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00430fbc
cmp esi, dword [ebp - 0x30]
jb 0x4582c5
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00403483
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403db0
mov eax, dword [ebp - 0x38]
call fcn.0049923d
ret
Function at 0x458b85
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
push ebx
push esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
push edi
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ecx + 0x4c93e0]
xor eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x18]
xor eax, dword [ebp + ecx - 0x1c]
mov edx, eax
shr edx, 0x18
mov ebx, eax
movzx edx, dl
mov dl, byte [edx + 0x4c92d0]
shr ebx, 0x10
mov byte [ebp + 0x70], dl
mov byte [ebp + 0x6d], bl
movzx edx, byte [ebp + 0x6d]
mov dl, byte [edx + 0x4c92d0]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x4c92d0]
mov byte [ebp + 0x73], al
movzx eax, byte [ebp + 0x70]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x4c92d0]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [ebp + 0x73]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [ebp + ecx - 0x24]
xor edx, eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + ecx - 0x14], edx
mov dword [ecx + eax], edx
add ecx, 4
cmp ecx, 0x80
jb 0x458c34
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x45938b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x4593a5
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x4593a1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4594ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.00459694
mov bl, al
mov al, dl
call fcn.00459694
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.00459694
mov bl, al
mov al, byte [esi - 4]
call fcn.00459694
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.00459694
mov bl, al
mov al, byte [esi]
call fcn.00459694
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.00459694
mov bl, al
mov al, byte [esi - 0xc]
call fcn.00459694
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x4594f6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret 4

Function at 0x459583
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.00459710
push ebx
mov dl, al
call fcn.004596e9
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.004596a4
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.004596c2
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.004596a4
push ebx
mov byte [ebp - 0x15], al
call fcn.004596c2
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.004596e9
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.00459710
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.004596e9
mov bl, al
mov al, byte [edi + 4]
call fcn.00459710
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.004596c2
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.004596a4
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.004596c2
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.004596a4
xor bl, al
mov al, dl
call fcn.00459710
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.004596e9
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x4595af
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret 4
Function at 0x45a2cb
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x45b4d7
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x45be23
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x68
mov eax, 0x4bb190
call fcn.00499151
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x40], ebx
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x58], ebx
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call fcn.0045bc46
pop ecx
pop ecx
test eax, eax
jne 0x45be7c
mov dword [ebp - 0x14], 4
jmp 0x45bf94
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
push dword [ebp + 0xc]
mov dword [ebp - 0x24], ebx
call fcn.0045bcf2
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x1c], eax
call edi
push 0x45bde5
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x45bedf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x45bedf
mov dword [ebp - 0x14], 6
jmp 0x45bf94
push esi
push 0x7d0
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, ebx
je 0x45befb
cmp eax, 0xc0
je 0x45bedf
jmp 0x45befe
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
je 0x45bed3
push 0x100000
call fcn.004a40c3
pop ecx
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x20], eax
call edi
mov edi, dword [ebp - 0x20]
push 0x45be05
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x58]
push eax
push 0x100000
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x45bf4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x45bf4f
mov dword [ebp - 0x14], 7
jmp 0x45bf94
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, ebx
je 0x45bf6c
cmp eax, 0xc0
je 0x45bf4f
jmp 0x45bed3
mov eax, dword [ebp - 0x44]
push edi
lea ecx, [ebp - 0x74]
mov byte [eax + edi], bl
call fcn.00403461
mov ecx, dword [ebp + 0x18]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00403caa
push ebx
push esi
lea ecx, [ebp - 0x74]
call fcn.00403db0
cmp dword [ebp - 0x18], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x45bfa5
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0x30], ebx
je 0x45bfaf
push dword [ebp - 0x30]
call esi
cmp dword [ebp - 0x48], ebx
je 0x45bfb9
push dword [ebp - 0x48]
call esi
cmp dword [ebp - 0x1c], ebx
je 0x45bfc7
push dword [ebp - 0x1c]
call fcn.004a4fea
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x45bfd5
push dword [ebp - 0x20]
call fcn.004a4fea
pop ecx
mov eax, dword [ebp - 0x14]
call fcn.00499229
ret
Function at 0x45c056
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
mov ebx, str..gxdte_cd
push ebx
call edi
cmp eax, 0xffffffff
jne 0x45c16e
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.00499dd0
add esp, 0xc
call fcn.0045bfde
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
xor ecx, ecx
mov dword [ebp - 0x214], eax
call fcn.0042d976
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c10d
cmp word [0x4eef70], si
je 0x45c10d
push 0x4eef70
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0042db48
mov dword [ebp - 0x214], str.gxdte64.sys
test eax, eax
jne 0x45c12a
mov dword [ebp - 0x214], str.gxdte32.sys
mov esi, str.gxdte
push esi
call fcn.00430232
mov ecx, dword [ebp - 0x214]
push 1
push 0x22343
test eax, eax
push str.gxdte_driver
lea eax, [ebp - 0x210]
mov edx, esi
push eax
call fcn.0045c89f
push esi
call fcn.004301cb
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret

Function at 0x45c358
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0042cfce
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.0043a0e2
test al, al
jne 0x45c3b7
call fcn.00431223
cmp dword [eax + 0x18], 8
jb 0x45c3a3
mov eax, dword [eax + 4]
jmp 0x45c3a6
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.00405bbf
jmp 0x45c378
lea eax, [ebp - 0x30]
push eax
call fcn.0041027a
pop edi
pop esi
leave
ret