joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d6b9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a610c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41b8c9
push 0x46c1f3
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00575f76
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46d7ed
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.004138a1
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c1c2
test eax, eax
jl 0x46d7c7
cmp dword [esp + 0x18], 0
je 0x46d7c7
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x66430c
push 0xf
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46d7b7
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.004201c8
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46d748
or dword [esp + 0x60], 0xffffffff
push 0x41b8c9
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.00574651
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d81e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a610c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41b8c9
push 0x46c1f3
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00575f76
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46d94f
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.004138a1
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c1c2
test eax, eax
jl 0x46d929
cmp dword [esp + 0x18], 0
je 0x46d929
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x66430c
push 0x10
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46d919
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.004201c8
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46d8aa
or dword [esp + 0x60], 0xffffffff
push 0x41b8c9
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.00574651
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46dced
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x290
lea ebp, [esp - 4]
mov eax, dword [0x6bd6f8]
xor eax, ebp
mov dword [ebp + 0x290], eax
push 0x3c
mov eax, 0x5b0095
call fcn.00580b7e
mov eax, dword [0x6d6758]
push 0x104
lea ecx, [ebp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x46defe
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 0x38]
push eax
lea esi, [ebp]
call fcn.00408187
mov byte [ebp - 4], 1
xor edi, edi
inc edi
push edi
mov eax, esi
call fcn.0046e3cc
cmp eax, 0xffffffff
je 0x46def1
mov ecx, dword [ebp + 0x14]
dec ecx
push ecx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
push eax
call fcn.0040837d
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.004098e6
mov byte [ebp - 4], 1
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.00409bbf
lea eax, [ebp + 0x240]
push eax
push 0x671c70
call fcn.0041d322
pop ecx
pop ecx
push 0x671c84
lea esi, [ebp - 0x2c]
call fcn.00408187
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x240]
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004499a9
add esp, 0xc
mov byte [ebp - 4], 5
push ebx
push edi
call fcn.00409bbf
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], ebx
je 0x46de0f
cmp dword [ebp + 0x34], 8
jae 0x46dddd
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x671c94
mov edi, 0x671cb8
call fcn.0046e348
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x46ddfa
lea eax, [ebp + 0x20]
push 0x671cbc
push 0x671ce0
push eax
call fcn.0046e3b2
add esp, 0xc
jmp 0x46de24
cmp dword [ebp + 0x34], 8
jae 0x46de18
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x671cfc
lea esi, [ebp - 0x48]
call fcn.00408187
mov byte [ebp - 4], 6
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040dd70
add esp, 0xc
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004098e6
mov byte [ebp - 4], 6
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bbf
mov byte [ebp - 4], 5
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409bbf
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], ebx
je 0x46debb
cmp dword [ebp + 0x34], 8
jae 0x46de87
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x671d0c
mov edi, 0x671d10
call fcn.0046e348
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x46dea4
lea eax, [ebp + 0x20]
lea ecx, [ebp + 0x240]
push ecx
push 0x671d14
push eax
call fcn.0046e3b2
add esp, 0xc
jmp 0x46ded0
cmp dword [ebp + 0x34], 8
jae 0x46dec4
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [ebp - 4], 1
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.00409bbf
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp]
call fcn.00409bbf
xor eax, eax
jmp 0x46df03
mov byte [ebp - 4], bl
push ebx
push edi
lea esi, [ebp]
call fcn.00409bbf
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
call fcn.0057340c
add ebp, 0x294
leave
ret
Function at 0x46e21d
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x6bd6f8]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x3c
mov eax, 0x5afff8
call fcn.00580b7e
mov eax, dword [ebp + 0x7c]
lea ecx, [ebp + 0x20]
push ecx
push eax
call fcn.0041d322
pop ecx
pop ecx
mov dword [ebp], 0x80004005
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.CLSID_
lea esi, [ebp - 0x2c]
call fcn.00408187
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp + 4]
push eax
call fcn.004499a9
add esp, 0xc
mov byte [ebp - 4], 3
push ebx
push 1
call fcn.00409bbf
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x46e290
lea eax, [ebp + 8]
push eax
push closesocket
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call edi
cmp eax, ebx
jne 0x46e30c
push str.AppID_
lea esi, [ebp - 0x48]
call fcn.00408187
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004499a9
add esp, 0xc
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 4]
call fcn.004098e6
mov byte [ebp - 4], 4
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bbf
mov byte [ebp - 4], 3
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409bbf
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x46e2fd
lea eax, [ebp + 8]
push eax
push closesocket
call edi
cmp eax, ebx
jne 0x46e30c
mov dword [ebp], ebx
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp + 4]
call fcn.00409bbf
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0057340c
add ebp, 0x74
leave
ret

Function at 0x46e450
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5aff90
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [0x6d50f8]
mov edx, dword [eax + 0xc]
mov ecx, 0x6d50f8
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x46e4ba
test esi, 0xffff0000
jne 0x46e4be
movzx esi, si
push esi
call fcn.00402e88
add esp, 4
test eax, eax
je 0x46e4db
push esi
push eax
push edi
call fcn.0040cd79
jmp 0x46e4db
xor eax, eax
jmp 0x46e4d2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e4c3
sub eax, edx
sar eax, 1
push eax
push esi
mov eax, edi
call fcn.0040b13c
mov dword [esp + 0x14], 1
mov eax, dword [edi]
push eax
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x46e640
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a60c4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.00573487
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x46e69c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x46e69e
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46e744
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x46e705
mov eax, dword [edi]
push esi
push eax
call fcn.00576288
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x46e702
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.005780d0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46e72b
cmp dword [esp + 0x40], esi
je 0x46e744
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x46e744
mov eax, dword [esi]
push ebx
push eax
call fcn.00576288
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x46e760
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x46e7d6
ja 0x46e779
cmp esi, dword [esp + 0x20]
jae 0x46e7da
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x46e795
jb 0x46e791
cmp ecx, 0x10000
jae 0x46e795
mov edi, ecx
jmp 0x46e79a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46e7d6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x46e7d6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x46e779
ja 0x46e7d6
cmp esi, dword [esp + 0x20]
jb 0x46e779
cmp esi, dword [esp + 0x20]
jne 0x46e7f7
cmp ebp, ebx
jne 0x46e7f7
or esi, ebp
je 0x46e7ef
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x46e800
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5a7968
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x46e8a5
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
call fcn.0046e760
add esp, 0x10
test al, al
je 0x46e88d
mov dword [esp + 0x18], 0xffffffff
push esi
call ebx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esp + 0x2c], 0
je 0x46e8a5
push esi
call ebx
or esi, 0xffffffff
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x18], 0xffffffff
cmp esi, 0xffffffff
je 0x46e8b5
push esi
call ebx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x46e940
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x46e966
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x46ee20
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5a793c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x34], ebx
push 0xc
mov dword [esp + 0x1c], ebx
call fcn.00573487
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, 1
mov dword [esp + 0x34], edi
cmp eax, ebx
je 0x46ee7c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
jmp 0x46ee7e
xor eax, eax
mov byte [esp + 0x34], bl
mov dword [ebp], eax
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x46ef1d
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and edx, dword [esp + 0x20]
cmp edx, 0xffffffff
je 0x46ef1d
push ebx
push ebx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.0046e640
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 2
mov esi, dword [ebp]
add dword [esi + 8], 0xffffffff
jne 0x46eee5
xor edi, edi
call fcn.00428aec
mov edi, 1
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
add dword [eax + 8], edi
mov dword [ebp], eax
mov byte [esp + 0x34], bl
mov eax, dword [esp + 0x14]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x46ef1d
xor edi, edi
call fcn.00428aec
mov edx, dword [esp + 0x14]
push edx
call fcn.00573401
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x46f040
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad389
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x6d50f8]
mov edx, dword [eax + 0xc]
mov ecx, 0x6d50f8
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], 1
call fcn.0046ef40
add esp, 8
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x18]
cmp dword [eax], ebx
je 0x46f102
cmp dword [eax + 4], ebx
je 0x46f102
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x46f0e2
mov eax, esi
mov ecx, ebp
call fcn.0040d8d9
cmp esi, ebx
mov eax, dword [ebp]
jl 0x46f144
cmp esi, dword [eax - 8]
jg 0x46f144
push esi
mov dword [eax - 0xc], esi
mov edx, dword [ebp]
push edi
push eax
mov byte [esi + edx], bl
call fcn.00578180
add esp, 0xc
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x18]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x46f12e
xor edi, edi
call fcn.00428aec
mov eax, dword [esp + 0x18]
push eax
call fcn.00573401
add esp, 4
mov dword [esp + 0x18], ebx
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00402d73
int3
Function at 0x46f610
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5b34ac
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6bd6f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x50], ebp
mov edi, ecx
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
call fcn.0046f830
mov dword [esp + 0x50], ebp
push ebp
push ebp
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
cmp ebx, ebp
je 0x46f80c
lea esi, [ebx + 1]
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], cx
cmp esi, 0xffffffff
jne 0x46f699
call fcn.00572321
jmp 0x46f6a1
cmp esi, 0x7ffffffe
jbe 0x46f6aa
call fcn.00572321
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x46f6df
mov edx, dword [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x30]
push eax
call fcn.0040cbe9
mov eax, dword [esp + 0x40]
cmp esi, ebp
jbe 0x46f73c
cmp esi, 1
jne 0x46f6fb
cmp eax, 8
mov eax, dword [esp + 0x2c]
jae 0x46f6d8
lea eax, [esp + 0x2c]
xor edx, edx
mov word [eax], dx
jmp 0x46f723
cmp esi, ebp
jne 0x46f6c4
cmp eax, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebp
jae 0x46f6f4
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax], cx
jmp 0x46f73c
mov edi, dword [esp + 0x2c]
cmp eax, 8
jae 0x46f708
lea edi, [esp + 0x2c]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x46f736
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x46f757
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x46f7e0
cmp dword [esp + 0x40], esi
mov esi, dword [esp + 0x2c]
jae 0x46f771
lea esi, [esp + 0x2c]
cmp word [esi], bp
je 0x46f7e0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.0046e450
mov byte [esp + 0x50], 2
mov ebx, eax
call fcn.0046f8a0
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46f7b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x46f7c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46f7c0
mov edi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x46f776
xor ebp, ebp
mov byte [esp + 0x50], 0
cmp dword [esp + 0x40], 8
jb 0x46f7f9
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00573401
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], dx
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0057340c
add esp, 0x40
ret
Function at 0x470110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad2b9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6d50f8]
mov edx, dword [eax + 0xc]
mov ecx, 0x6d50f8
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
mov dword [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x470230
mov edi, eax
lea ebx, [esp + 0x14]
call fcn.00471840
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ebx, ebx
push ebx
push ebx
push eax
push ecx
push 0xffffffffffffffff
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x4701f8
mov ecx, dword [esi]
mov byte [ecx + eax - 1], bl
mov edx, dword [esi]
cmp edx, ebx
jne 0x4701d8
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov eax, ebp
call fcn.0040b032
jmp 0x4701fc
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4701e0
mov ebp, dword [esp + 0x2c]
sub eax, edi
push eax
push edx
mov eax, ebp
call fcn.0040b032
jmp 0x4701fc
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x47021a
xor edi, edi
call fcn.00471980
push esi
call fcn.00573401
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret