joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ee41e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100ee445
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100ee448
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100ee3fa
pop esi
leave
ret 8

Function at 0x1010a9db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010a851

Function at 0x1010b017
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010af99

Function at 0x1011019b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010fe18

Function at 0x10118750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1011877d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1011877d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4028d0
Capabilities:
Terminate process

Disassembly:
call 0x4a6000
push 0x18
push 0x4029f8
call fcn.004032a6
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.MSVCR120_CLR0400.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4150e8
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x404373
xor esi, esi
inc esi
cmp dword [0x4150ec], esi
je 0x404385
cmp dword [0x4150ec], 0
jne 0x402a1e
mov dword [0x4150ec], esi
push 0x4029f4
push 0x4029e4
call sub.MSVCR120_CLR0400.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x404392
cmp dword [0x4150ec], esi
jne 0x402973
push 0x4029e0
push 0x4029cc
call sub.MSVCR120_CLR0400.dll__initterm
pop ecx
pop ecx
mov dword [0x4150ec], 2
test edi, edi
jne 0x402980
xor eax, eax
mov ecx, 0x4150e8
xchg dword [ecx], eax
cmp dword [0x4150f8], 0
jne 0x4043a3
mov eax, dword [sym.imp.MSVCR120_CLR0400.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
nop
nop
nop
nop
nop
nop
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x402a14
cmp cl, 0x22
je 0x4043d1
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll__ismbblead]
pop ecx
test eax, eax
jne 0x4043e2
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029a0
test cl, cl
je 0x402a29
test edi, edi
je 0x402a29
jmp 0x4029a7
mov dword [0x415244], esi
jmp 0x402950
mov al, byte [esi]
test al, al
je 0x402a39
cmp al, 0x20
ja 0x402a39
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402a29
push ebx
push esi
push 0
push 0x400000
call fcn.00403044
mov dword [0x415060], eax
cmp dword [0x415064], 0
jne 0x40441a
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll_exit]
test ecx, ecx
je 0x402a82
push ecx
call fcn.0040117d
jmp 0x402a82
mov eax, esi
pop esi
pop ebp
ret 4
cmp eax, edx
jne 0x402905
xor esi, esi
inc esi
mov edi, esi
jmp 0x402918
push 0x1f
call sub.MSVCR120_CLR0400.dll__amsg_exit
pop ecx
jmp 0x402950
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x404435
push 0x4150f8
call fcn.0040fdd0
pop ecx
test eax, eax
je 0x40298d
push 0
push 2
push 0
mov esi, dword [0x4150f8]
mov ecx, esi
call dword [0x416268]
call esi
jmp 0x40298d
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
jmp 0x4029b0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029c3
cmp dword [0x415244], 0
jne 0x40442e
call dword [sym.imp.MSVCR120_CLR0400.dll__cexit]
mov eax, dword [0x415060]
mov dword [ebp - 4], 0xfffffffe
call fcn.004032ee
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4013d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x457f6c
push eax
mov eax, 0x10208
mov dword fs:[0], esp
call fcn.00444850
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call fcn.00409410
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dx, word [0x4663f8]
mov cx, word [0x466402]
mov word [esp + eax*2 + 0x18], dx
mov dx, word [0x46640c]
inc eax
push 0x462230
mov word [esp + eax*2 + 0x1e], cx
mov word [esp + eax*2 + 0x1c], 0x2e
mov word [esp + eax*2 + 0x20], dx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4014d5
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x211]
mov byte [esp + 0x210], 0
rep stosd dword es:[edi], eax
push 1
lea edx, [esp + 0xf]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
push 0x4660f4
stosw word es:[edi], ax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push 0
lea eax, [esp + 0x228]
push 0
push eax
mov dword [esp + 0x10238], 0xffffffff
call fcn.004034f0
mov ecx, eax
call fcn.004044f0
push esi
push eax
lea ecx, [esp + 0x218]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov ecx, dword [esp + 0x10210]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x10214
ret
Function at 0x403a20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x10018
call fcn.00444850
mov ax, word [0x4623cc]
mov dword [esp], 0
push ebx
mov word [esp + 4], ax
mov ebx, dword [esp + 4]
mov dword [esp + 8], ecx
test ebx, ebx
jle 0x403b3a
cmp ebx, 0x9c4
jge 0x403b3a
mov cl, byte [0x4623ce]
mov dl, byte [str._ap_f_rT]
mov al, byte [0x4623d1]
add cl, dl
mov dl, byte [0x4623d0]
push ebp
add cl, dl
push esi
cmp cl, 0xff
push edi
mov esi, 0x4623ce
mov byte [esp + 0x10], al
jne 0x403af8
cmp al, 8
jbe 0x403af8
cmp al, 0x11
jae 0x403af8
mov ebp, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x19], edx
and ebp, 0xff
mov dword [esp + 0x1d], edx
mov ecx, ebp
mov dword [esp + 0x21], edx
mov eax, ecx
mov word [esp + 0x25], dx
mov esi, 0x4623d2
lea edi, [esp + 0x18]
mov byte [esp + 0x18], 0
shr ecx, 2
mov byte [esp + 0x27], dl
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xfffffffc
lea esi, [ebp + 0x4623d2]
sub ecx, ebp
add ebx, ecx
xor ecx, ecx
test ebx, ebx
jle 0x403af8
mov eax, ecx
cdq
idiv ebp
mov al, byte [ecx + esi]
mov dl, byte [esp + edx + 0x18]
xor al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, ebx
jl 0x403ae2
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
mov ecx, ebx
push ebx
stosw word es:[edi], ax
mov eax, ecx
lea edi, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00403560
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10018
ret
xor al, al
pop ebx
add esp, 0x10018
ret

Function at 0x403b50
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10200
call fcn.00444850
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call fcn.00409410
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dx, word [0x4663f8]
mov cx, word [0x466402]
mov word [esp + eax*2 + 0x14], dx
mov dx, word [0x46640c]
inc eax
push 0x462258
mov word [esp + eax*2 + 0x1a], cx
mov word [esp + eax*2 + 0x18], 0x2e
mov word [esp + eax*2 + 0x1c], dx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x403bdb
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10200
ret
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x20d]
mov byte [esp + 0x20c], 0
rep stosd dword es:[edi], eax
push esi
push 0xffff
lea ecx, [esp + 0x214]
push 1
push ecx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea edx, [esp + 0x20c]
mov ecx, ebp
push edi
push edx
call fcn.00403560
pop edi
pop esi
pop ebp
add esp, 0x10200
ret
Function at 0x409900
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x114]
push eax
call fcn.00409390
mov ebp, dword [esp + 0x220]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x118]
push ebp
stosw word es:[edi], ax
push ecx
lea edx, [esp + 0x1c]
push str._s_d
push edx
stosb byte es:[edi], al
call ebx
lea eax, [esp + 0x24]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x1c
test eax, eax
je 0x40998b
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov edi, dword [esp + 0x224]
mov ecx, 0x41
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x220]
mov ecx, 0x41
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x186a0
idiv ecx
mov eax, dword [0x466888]
mov edi, eax
inc eax
cmp eax, 0x989680
mov dword [0x466888], eax
mov esi, edx
jle 0x4099e8
mov dword [0x466888], 0
mov eax, dword [esp + 0x224]
push 0x31
push ebp
push edi
lea edx, [esp + 0x1c]
push esi
push edx
push str._s_d__d__d._c
push eax
call ebx
mov edx, dword [esp + 0x23c]
push 0x74
push ebp
push edi
lea ecx, [esp + 0x38]
push esi
push ecx
push str._s_d__d__d._c
push edx
call ebx
add esp, 0x38
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x409a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x380
test eax, eax
jne 0x409a47
xor al, al
add esp, 0x380
ret
push esi
push edi
push 0
push 2
call dword [0x4672d8]
mov esi, eax
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], esi
push eax
push esi
mov dword [esp + 0x50], 0x22c
call dword [0x467264]
test eax, eax
je 0x409c49
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov bl, 0x65
mov ecx, dword [esp + 0x394]
lea edx, [esp + 0x74]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x409c2b
mov eax, dword [esp + 0x58]
push eax
push 0
push 1
call dword [0x4672b8]
mov edi, eax
test edi, edi
je 0x409ad4
push 0xffffffffffffffff
push edi
call dword [0x4672e4]
push edi
jmp 0x409c25
lea ecx, [esp + 0x27c]
mov dword [esp + 0x27c], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x28c]
mov edi, 2
cmp eax, edi
jne 0x409c2b
lea edx, [esp + 0x10]
mov dword [esp + 0x2c], 0x10
push edx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x409b50
call dword [0x467340]
cmp eax, 0x3f0
jne 0x409c2b
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x409c2b
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x62
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], 0x76
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x48], edi
call ebp
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x40]
push eax
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push 0x10
push edx
push 0
push eax
call esi
test eax, eax
jne 0x409be0
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x409c25
call dword [0x467340]
cmp eax, 0x514
jne 0x409bf4
mov edx, dword [esp + 0x10]
push edx
jmp 0x409c25
mov eax, dword [esp + 0x58]
push eax
push 0
push 1
call dword [0x4672b8]
push 0xffffffffffffffff
push eax
call dword [0x4672e4]
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x48]
push 0x10
push ecx
push 0
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [0x467338]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [0x467268]
test eax, eax
jne 0x409a92
mov esi, dword [esp + 0x28]
pop ebp
pop ebx
push esi
call dword [0x467338]
pop edi
mov al, 1
pop esi
add esp, 0x380
ret
Function at 0x409c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x380
push esi
push edi
push 0
push 2
call dword [0x4672d8]
mov esi, eax
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x15c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x15c]
mov dword [esp + 0x24], esi
push eax
push esi
mov dword [esp + 0x164], 0x22c
call dword [0x467264]
test eax, eax
je 0x409e5c
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov bl, 0x65
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x394]
cmp eax, ecx
jne 0x409e3f
push eax
push 0
push 1
call dword [0x4672b8]
mov esi, eax
test esi, esi
je 0x409cf0
push 0xffffffffffffffff
push esi
call dword [0x4672e4]
push esi
jmp 0x409e39
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x60], 2
jne 0x409e3f
lea edx, [esp + 0x10]
mov dword [esp + 0x28], 0x10
push edx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x409d5d
call dword [0x467340]
cmp eax, 0x3f0
jne 0x409e3f
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x409e3f
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x62
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], 0x76
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x48], 2
call ebp
lea eax, [esp + 0x28]
lea ecx, [esp + 0x40]
push eax
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push 0x10
push edx
push 0
push eax
call edi
test eax, eax
jne 0x409df1
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x409e39
call dword [0x467340]
cmp eax, 0x514
jne 0x409e05
mov edx, dword [esp + 0x10]
push edx
jmp 0x409e39
mov eax, dword [esp + 0x16c]
push eax
push 0
push 1
call dword [0x4672b8]
push 0xffffffffffffffff
push eax
call dword [0x4672e4]
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x48]
push 0x10
push ecx
push 0
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call dword [0x467338]
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x164]
push ecx
push esi
call dword [0x467268]
test eax, eax
jne 0x409cba
pop ebp
pop ebx
push esi
call dword [0x467338]
pop edi
mov al, 1
pop esi
add esp, 0x380
ret
Function at 0x409fe0
Capabilities:
Get disk information via ioctl
Get storage device properties

Disassembly:
mov eax, 0x28a8
call fcn.00444850
movsx eax, byte [esp + 0x28ac]
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea ecx, [esp + 0x2c]
push str.__c:
push ecx
call esi
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x28]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call ebx
cmp eax, 0xffffffff
jne 0x40a03a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x28a8
ret
push edi
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28]
push 0xc
push edx
push 0
push 0
push 0x2d1080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40a1bd
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x41]
mov edx, dword [0x462384]
rep stosd dword es:[edi], eax
mov ecx, dword [0x462380]
push 1
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x46237c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x44], eax
mov eax, dword [0x462388]
mov dword [esp + 0x48], ecx
mov cl, byte [0x46238c]
lea edx, [esp + 0x44]
push 0x11
push edx
mov dword [esp + 0x58], eax
mov byte [esp + 0x5c], cl
call fcn.0040c5e0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x4c]
push eax
push ecx
lea edx, [esp + 0xb8]
push str.._s_d
push edx
call esi
add esp, 0x1c
lea eax, [esp + 0xa4]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40a1bd
xor ecx, ecx
xor eax, eax
mov dword [esp + 0xc], ecx
lea edi, [esp + 0x1a4]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov ecx, 0x9c4
rep stosd dword es:[edi], eax
push eax
push edx
lea eax, [esp + 0x1ac]
push 0x2710
push eax
lea ecx, [esp + 0x1c]
push 0x10
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40a1b6
mov eax, dword [esp + 0x1b0]
test eax, eax
jbe 0x40a16a
mov edx, dword [esp + 0x28bc]
push edx
push 0
push eax
lea eax, [esp + 0x1b0]
push eax
call fcn.00409e70
add esp, 0x10
mov eax, dword [esp + 0x1b4]
test eax, eax
jbe 0x40a190
mov ecx, dword [esp + 0x28c0]
lea edx, [esp + 0x1a4]
push ecx
push 0
push eax
push edx
call fcn.00409e70
add esp, 0x10
mov eax, dword [esp + 0x1bc]
test eax, eax
jbe 0x40a1b6
mov ecx, dword [esp + 0x28c4]
lea edx, [esp + 0x1a4]
push ecx
push 1
push eax
push edx
call fcn.00409e70
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28a8
ret
Function at 0x40c830
Capabilities:
Get disk information

Disassembly:
sub esp, 0x4b8
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
mov ebp, dword [esp + 0x4cc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xf9
xor eax, eax
lea edi, [esp + 0xe2]
mov word [esp + 0xe0], si
rep stosd dword es:[edi], eax
cmp ebp, esi
mov word [esp + 0x10], si
mov dword [esp + 0x12], esi
stosw word es:[edi], ax
je 0x40c94d
cmp dword [esp + 0x4d0], esi
je 0x40c94d
lea eax, [esp + 0xe0]
push eax
push 0x3e8
call dword [0x467304]
test eax, eax
je 0x40c93e
cmp word [esp + 0xe0], si
je 0x40c93e
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0xe0]
lea esi, [esp + 0xe0]
push 0x4623ac
push eax
call ebx
test eax, eax
je 0x40c933
push 0x4623a4
push esi
call ebx
test eax, eax
je 0x40c933
mov cx, word [esi]
mov dx, word [esi + 2]
mov word [esp + 0x10], cx
lea eax, [esp + 0x18]
push 0x64
lea ecx, [esp + 0x14]
push eax
push ecx
mov word [esp + 0x1e], dx
mov word [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40c94d
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [esp + 0x18]
push edi
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40c95a
add esi, 8
mov eax, esi
cmp word [esi], 0
jne 0x40c8cc
mov eax, dword [esp + 0x4d0]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4b8
ret
mov esi, dword [esp + 0x4d0]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp + edi*2]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4b8
ret

Function at 0x40c990
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x40c]
test ebx, ebx
push esi
jne 0x40c9ae
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
mov eax, dword [esp + 0x40c]
push eax
push 0
push 0x400
call dword [0x4672b8]
mov esi, eax
test esi, esi
jne 0x40c9d2
pop esi
pop ebx
add esp, 0x400
ret
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push esi
stosw word es:[edi], ax
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
pop edi
jne 0x40ca10
push esi
call dword [0x467338]
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
lea edx, [esp + 8]
push ebx
push edx
call fcn.0040c830
add esp, 8
test eax, eax
push esi
jne 0x40ca34
call dword [0x467338]
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
call dword [0x467338]
pop esi
mov eax, 1
pop ebx
add esp, 0x400
ret