joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4180b5
Capabilities:
Query service status
Start service

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4180bc
call fcn.0045e790
push 0xf000f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x4181df
push 0xf01ff
push dword [esp + 0x38]
push dword [esp + 0x24]
call sub.advapi32.dll_OpenServiceW
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x4181d6
lea eax, [esp]
push eax
push 4
push dword [esp + 0x28]
call sub.advapi32.dll_ControlService
lea ebp, [esp]
mov ebx, dword [ebp + 4]
cmp ebx, 4
jne 0x418133
xor eax, eax
jmp 0x418138
mov eax, 1
and eax, eax
je 0x4181c5
push 0
push 0
push dword [esp + 0x28]
call sub.advapi32.dll_StartServiceW
lea eax, [esp]
push eax
push dword [esp + 0x24]
call sub.advapi32.dll_QueryServiceStatus
mov ebx, eax
and ebx, ebx
jne 0x418168
jmp 0x4181c3
lea ebp, [esp]
push dword [ebp + 4]
mov ebx, 4
cmp ebx, dword [esp]
jne 0x418187
mov dword [esp + 0x28], 1
add esp, 4
jmp 0x4181c3
mov ebx, 2
cmp ebx, dword [esp]
je 0x4181af
mov ebx, 5
cmp ebx, dword [esp]
je 0x4181af
mov ebx, 6
cmp ebx, dword [esp]
je 0x4181af
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4181bb
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x4181c0
add esp, 4
jmp 0x4181c3
pop eax
jmp 0x418153
jmp 0x4181cd
mov dword [esp + 0x24], 1
push dword [esp + 0x20]
call sub.advapi32.dll_CloseServiceHandle
push dword [esp + 0x1c]
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [esp + 0x24]
jmp 0x4181e7
add esp, 0x28
pop ebx
pop ebp
ret 4
Function at 0x4181ef
Capabilities:
Read .ini file

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x4008
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4181f7
call fcn.0045e790
mov edx, dword [esp + 0x10030]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x10034]
lea ecx, [esp + 4]
call fcn.0044e000
mov eax, dword [esp + 0x10038]
mov dword [esp + 8], eax
mov eax, dword [esp]
push eax
push 0x7fff
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_GetPrivateProfileSectionW
mov dword [esp + 0x1000c], eax
mov edx, dword [esp + 8]
lea edx, [edx]
push edx
push 0x46e070
push 8
push 0x65
push 4
call fcn.0045e24d
lea eax, [esp + 0xc]
push eax
pop eax
mov dword [esp + 0x10010], eax
lea eax, [esp + 0x10010]
push eax
pop eax
mov dword [esp + 0x10018], eax
mov ebp, dword [esp + 0x10018]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
lea eax, [esp + 0x10018]
push eax
call fcn.0045e660
push dword [esp + 0x10014]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x4182cd
jmp 0x418364
mov ebx, dword [esp + 0x10010]
push dword [esp + 0x10014]
call fcn.0044f9d0
mov edi, eax
add edi, edi
add ebx, edi
add ebx, 2
mov dword [esp + 0x10010], ebx
mov edx, dword [esp + 0x10014]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov ebx, dword [esp + 0x10020]
mov edx, dword [esp + 0xc]
mov ebp, dword [edx]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.0045e660
mov ebx, dword [esp + 0x1001c]
inc ebx
mov dword [esp + 0x1001c], ebx
mov ebx, dword [esp + 0x1001c]
mov eax, ebx
mov ecx, 0x64
cdq
idiv ecx
mov ebx, edx
and ebx, ebx
jne 0x41835f
mov ebx, dword [esp + 0x1001c]
add ebx, 0x64
mov eax, ebx
inc eax
mov edx, dword [esp + 8]
lea edx, [edx]
push edx
push eax
call fcn.0045e444
jmp 0x41827f
mov ebx, dword [esp + 0x1001c]
and ebx, ebx
jle 0x41837e
mov ebx, dword [esp + 0x1001c]
dec ebx
mov dword [esp + 0x1001c], ebx
mov eax, dword [esp + 0x1001c]
inc eax
mov edx, dword [esp + 8]
lea edx, [edx]
push edx
push eax
call fcn.0045e444
xor eax, eax
push dword [esp + 0x10014]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x10020
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x418478
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x10]
call fcn.0044e2f0
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x10000
call fcn.0044f2b0
lea eax, [esp + 8]
push eax
call fcn.0045e660
push 0x10000
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
and eax, eax
je 0x4184f0
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x4184fa
call fcn.0045e820
mov word [eax], 0
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 8
ret 4
Function at 0x41a2ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
call sub.kernel32.dll_GetFileAttributesW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
jne 0x41a2dc
xor eax, eax
jmp 0x41a2e1
mov eax, 1
and eax, eax
je 0x41a2f7
mov ebx, dword [esp + 4]
and ebx, 0x10
and ebx, ebx
je 0x41a2f7
mov eax, 1
jmp 0x41a2f9
xor eax, eax
and eax, eax
je 0x41a304
mov eax, 1
jmp 0x41a306
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 8
pop ebx
ret 4

Function at 0x41a675
Capabilities:
Open registry key via offline registry library

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.0044e000
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41a697
xor eax, eax
jmp 0x41a6c2
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push dword [esp + 0x18]
call sub.Toolsx86offreg.dll_OROpenKey
mov ebx, eax
and ebx, ebx
jne 0x41a6c0
push dword [esp + 4]
call sub.Toolsx86offreg.dll_ORCloseKey
mov eax, 1
jmp 0x41a6c2
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 8
pop ebx
ret 8

Function at 0x41aff0
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41aff8
call fcn.0045e790
push dword [esp + 0x40]
call fcn.0044e2f0
mov edx, str..C:
lea ecx, [esp + 0xc]
call fcn.0044e008
mov eax, dword [esp + 0xc]
mov ebx, eax
add ebx, 8
mov dword [esp + 0x14], ebx
call sub.kernel32.dll_GetLogicalDrives
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
pop eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0
jmp 0x41b04b
mov eax, 0x19
cmp eax, dword [esp + 0x18]
jl 0x41b13e
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
mov ecx, edi
mov eax, 1
shl eax, cl
mov edi, eax
and ebx, edi
and ebx, ebx
je 0x41b134
mov ebx, dword [esp + 0x18]
add ebx, 0x41
push ebx
mov ebp, dword [esp + 0x18]
pop eax
mov word [ebp], ax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0
push dword [esp + 0x24]
call sub.kernel32.dll_CreateFileW
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
je 0x41b134
push 0
lea eax, [esp + 0x24]
push eax
push 0xc
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x2d1080
push dword [esp + 0x38]
call sub.kernel32.dll_DeviceIoControl
push dword [esp + 0x1c]
call sub.kernel32.dll_CloseHandle
lea ebp, [esp]
mov ebx, dword [ebp + 8]
cmp ebx, dword [esp + 0x3c]
jne 0x41b10d
mov ebx, dword [ebp + 4]
cmp ebx, dword [esp + 0x38]
jne 0x41b10d
mov eax, 1
jmp 0x41b10f
xor eax, eax
and eax, eax
je 0x41b134
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x41b148
inc dword [esp + 0x18]
jno 0x41b04b
call fcn.0045e820
mov word [eax], 0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41c8eb
Capabilities:
Query registry key via offline registry library

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c91b
xor eax, eax
jmp 0x41c952
push 0
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x28]
call sub.Toolsx86offreg.dll_ORGetValue
mov ebx, eax
and ebx, ebx
jne 0x41c949
mov eax, dword [esp + 8]
jmp 0x41c952
mov eax, 0xffffffff
jmp 0x41c952
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0xc
pop ebx
ret 0xc
Function at 0x420e8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push ebx
push edi
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x420e95
call fcn.0045e790
push dword [esp + 0x2c]
call fcn.0044e2f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x4629b4
push edx
call fcn.0045e6f0
lea eax, [esp + 0x1c]
push eax
call fcn.0045e660
push dword [esp + 0x18]
call fcn.0045b1e5
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x420ef9
jl 0x420ef5
cmp ebx, 0
ja 0x420ef9
xor eax, eax
jmp 0x420efe
mov eax, 1
or eax, eax
je 0x420f22
push 2
push 0
push dword [esp + 0x20]
call sub.kernel32.dll_LoadLibraryExW
mov dword [esp], eax
mov dword [esp + 0x10], 1
jmp 0x420f7f
mov ebp, dword [0x473554]
push dword [ebp + 0x38]
call fcn.0045b1e5
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x420f44
jl 0x420f40
cmp ebx, 0
ja 0x420f44
xor eax, eax
jmp 0x420f49
mov eax, 1
or eax, eax
je 0x420f72
push 2
push 0
mov ebp, dword [0x473554]
push dword [ebp + 0x38]
call sub.kernel32.dll_LoadLibraryExW
mov dword [esp], eax
mov dword [esp + 0x10], 1
jmp 0x420f7f
mov ebp, dword [0x473568]
push dword [ebp]
pop eax
mov dword [esp], eax
cmp dword [esp], 0
je 0x4210c0
push 0xa
mov eax, str.Help
push eax
push dword [esp + 8]
call sub.kernel32.dll_FindResourceW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4210af
push dword [esp + 4]
push dword [esp + 4]
call sub.kernel32.dll_SizeofResource
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4210af
push dword [esp + 4]
push dword [esp + 4]
call sub.kernel32.dll_LoadResource
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4210af
push 2
mov ebp, 0x4702d3
push ebp
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x42102f
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.0045ac80
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
jmp 0x4210a6
push 3
mov ebp, 0x4702d5
push ebp
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcmp
add esp, 0xc
mov ebx, eax
and ebx, ebx
jne 0x42107a
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.0045ac80
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
jmp 0x4210a6
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.0045ac80
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0xc]
call sub.kernel32.dll_FreeResource
mov ebx, dword [esp + 0x10]
cmp ebx, 1
jne 0x4210c0
push dword [esp]
call sub.kernel32.dll_FreeLibrary
mov edx, dword [esp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x4210e8
push dword [esp + 0x18]
call fcn.0045e7f0
push dword [esp + 0x14]
call fcn.0045e7f0
add esp, 0x1c
pop edi
pop ebx
pop ebp
ret
Function at 0x421f76
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x9a
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x421f7e
call fcn.0045e790
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.winsxs_
push edx
call fcn.0045e6f0
lea eax, [esp + 0x264]
push eax
call fcn.0045e660
mov edx, dword [esp + 0x260]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.x86_microsoft_windows_i..sedsetup_media_base_
push edx
call fcn.0045e6f0
lea eax, [esp + 0x260]
push eax
call fcn.0045e660
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x260]
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [esp], eax
mov ebx, dword [esp]
cmp ebx, 0xffffffff
je 0x42212b
lea ebp, [esp + 4]
push ebp
pop ebp
lea eax, [ebp + 0x2c]
mov dword [esp + 0x258], eax
lea eax, [esp + 0x258]
push eax
pop eax
mov dword [esp + 0x254], eax
lea ebp, [esp + 4]
mov ebx, dword [ebp]
and ebx, 0x10
and ebx, ebx
je 0x42203f
xor eax, eax
jmp 0x422044
mov eax, 1
and eax, eax
je 0x42204d
jmp 0x42210b
mov ebp, dword [esp + 0x254]
push dword [ebp]
mov edx, 0x461aa8
pop ecx
call fcn.0044e300
jne 0x42207d
mov ebp, dword [esp + 0x254]
push dword [ebp]
mov edx, 0x46c5cc
pop ecx
call fcn.0044e300
jne 0x42207d
jmp 0x422084
mov eax, 1
jmp 0x422086
xor eax, eax
and eax, eax
je 0x42208c
jmp 0x42210b
mov edx, dword [esp + 0x260]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov ebp, dword [esp + 0x258]
mov edx, dword [ebp]
push edx
call fcn.0045e6f0
mov edx, str._segoeui.ttf
push edx
call fcn.0045e6f0
lea eax, [esp + 0x268]
push eax
call fcn.0045e660
push dword [esp + 0x264]
call fcn.0045b1e5
push edx
push eax
pop ebx
pop edi
cmp ebx, 0
jne 0x4220e7
cmp edi, 0
jne 0x4220e7
xor eax, eax
jmp 0x4220ec
mov eax, 1
or eax, eax
je 0x42210b
push dword [esp + 0x264]
call fcn.004280d3
mov eax, dword [esp + 0x264]
push eax
call sub.gdi32.dll_AddFontResourceW
jmp 0x422123
lea eax, [esp + 4]
push eax
push dword [esp + 4]
call sub.kernel32.dll_FindNextFileW
mov ebx, eax
and ebx, ebx
jne 0x42202d
push dword [esp]
call sub.kernel32.dll_FindClose
xor eax, eax
push dword [esp + 0x264]
call fcn.0045e7f0
push dword [esp + 0x260]
call fcn.0045e7f0
push dword [esp + 0x25c]
call fcn.0045e7f0
add esp, 0x268
pop edi
pop ebx
pop ebp
ret
Function at 0x422b43
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x10]
call fcn.0044e2f0
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
call fcn.0045e850
lea eax, [esp + 8]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push dword [esp + 0xc]
call fcn.0044f540
mov edx, 0x4622e0
push edx
call fcn.0045e6f0
lea eax, [esp + 4]
push eax
call fcn.0045e660
push 0x104
mov eax, dword [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_GetVolumeInformationW
and eax, eax
je 0x422c0e
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x422c37
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x422c37
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 8
ret 4

Function at 0x422c4e
Capabilities:
Create registry key via offline registry library

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.0044e000
mov eax, 0x4622e0
push eax
push dword [esp + 4]
call fcn.0044f710
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x422c87
jmp 0x422d36
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebx, dword [esp + 0x10]
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0044f540
lea eax, [esp + 0x10]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 8]
call fcn.0044f9d0
mov ebx, eax
sub ebx, dword [esp + 0x10]
push ebx
push dword [esp + 0xc]
call fcn.0044f810
lea eax, [esp + 4]
push eax
call fcn.0045e660
push dword [esp + 0x1c]
pop eax
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x422cf8
xor eax, eax
jmp 0x422d77
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x34]
call sub.Toolsx86offreg.dll_ORCreateKey
push dword [esp + 4]
pop eax
mov dword [esp + 0x1c], eax
push dword [esp + 0x10]
call sub.Toolsx86offreg.dll_ORCloseKey
jmp 0x422c67
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x422d42
xor eax, eax
jmp 0x422d77
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x34]
call sub.Toolsx86offreg.dll_ORCreateKey
mov ebx, eax
and ebx, ebx
jne 0x422d75
mov eax, dword [esp + 4]
jmp 0x422d77
xor eax, eax
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x14
pop ebx
ret 8
Function at 0x422f56
Capabilities:
Get file attributes

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov eax, dword [esp + 0x24]
mov dword [esp], eax
lea eax, [esp + 4]
push eax
push 0
push 1
push 8
call sub.ntdll.dll_RtlAdjustPrivilege
lea eax, [esp + 8]
push eax
push 0
push 1
push 0x12
call sub.ntdll.dll_RtlAdjustPrivilege
push dword [esp]
call fcn.004510d7
push dword [esp]
call fcn.004510ec
or eax, eax
je 0x4230c1
mov eax, dword [esp]
mov ebp, dword [eax + 8]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0x14]
call sub.kernel32.dll_GetFileAttributesW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
cmp ebx, 0x10
je 0x4230bc
push 0
push 0x2000000
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [esp + 0x18]
mov ebp, dword [eax + 8]
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileW
mov dword [esp + 0xc], eax
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.exclude_compression:
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 3
push dword [esp + 0x24]
call fcn.00450130
pop eax
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
mov ebx, dword [esp + 0xc]
cmp ebx, 0xffffffff
je 0x423080
push dword [esp + 0xc]
call sub.kernel32.dll_CloseHandle
push 0
push dword [esp + 0x18]
call fcn.00401901
jmp 0x4230bc
push edx
call fcn.0045e620
pop edx
push eax
push 0
push edx
call fcn.0045e620
pop edx
push eax
mov edx, 0x46173c
push edx
call fcn.0045e6f0
mov edx, dword [esp + 0x20]
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00401901
call fcn.0044e2f0
jmp 0x422fa6
lea eax, [esp + 4]
push eax
push 0
push 0
push 8
call sub.ntdll.dll_RtlAdjustPrivilege
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x12
call sub.ntdll.dll_RtlAdjustPrivilege
xor eax, eax
push dword [esp + 0x14]
call fcn.0045e7f0
add esp, 0x18
pop ebx
pop ebp
ret 4
Function at 0x423b89
Capabilities:
Hash data with crc32
Read file via mapping

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x24]
call fcn.0044e2f0
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.0044e000
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
jne 0x423c03
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x423d4d
push 0
push 0
push 0
push 2
push 0
push dword [esp + 0x18]
call sub.kernel32.dll_CreateFileMappingW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x423c34
xor eax, eax
jmp 0x423c39
mov eax, 1
and eax, eax
je 0x423c68
push dword [esp + 4]
call sub.kernel32.dll_CloseHandle
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x423d4d
push dword [esp + 4]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 0
push 4
push dword [esp + 0x18]
call sub.kernel32.dll_MapViewOfFile
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x423c9d
xor eax, eax
jmp 0x423ca2
mov eax, 1
and eax, eax
je 0x423cce
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x423d4d
push dword [esp]
call fcn.0045b1e5
mov dword [esp + 0x10], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 5
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0
call sub.ntdll.dll_RtlComputeCrc32
cdq
push edx
push eax
call fcn.0044f460
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0xc]
call sub.kernel32.dll_UnmapViewOfFile
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
mov edx, dword [esp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x423d4d
push dword [esp + 0x14]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x18
pop ebx
ret 4
Function at 0x4243ff
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
mov edx, 0x110
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x424406
call fcn.0045e790
mov edx, dword [esp + 0x44c]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push 0
push 0
push 3
push 0
push 0
push 0
push edx
call fcn.0045e620
pop edx
push eax
mov edx, 0x469c1e
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push dword [esp + 0x2c]
call fcn.0044f540
pop eax
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_CreateFileW
call fcn.0044e2f0
mov dword [esp + 0x438], eax
mov ebx, dword [esp + 0x438]
cmp ebx, 0xffffffff
jne 0x4244ab
xor eax, eax
jmp 0x4245bf
push 0
lea eax, [esp + 0x438]
push eax
push 0x424
lea eax, [esp + 0x1c]
push eax
push 0xc
lea eax, [esp + 0x18]
push eax
push 0x2d1400
push dword [esp + 0x454]
call sub.kernel32.dll_DeviceIoControl
push dword [esp + 0x438]
call sub.kernel32.dll_CloseHandle
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x46105e
push eax
mov eax, 0x461704
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0x30]
mov ebx, eax
lea ebp, [esp + 0x30]
add ebx, dword [ebp + 0xc]
push ebx
call fcn.0045ac80
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0x34]
mov ebx, eax
add ebx, dword [ebp + 0x10]
push ebx
call fcn.0045ac80
pop eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0x34]
mov ebx, eax
add ebx, dword [ebp + 0x14]
push ebx
call fcn.0045ac80
pop eax
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044fd60
lea eax, [esp + 0x440]
push eax
call fcn.0045e660
mov eax, str.MsftVirtualDisk
push eax
push dword [esp + 0x440]
call fcn.0044f710
and eax, eax
je 0x4245bd
mov eax, 1
jmp 0x4245bf
xor eax, eax
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0x43c]
call fcn.0045e7f0
add esp, 0x440
pop ebx
pop ebp
ret 4