joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0100
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
test esi, esi
je 0x416973
cmp edi, 0xfde9
je 0x416965
cmp edi, 0xfde8
je 0x416965
cmp esi, 0xffffffff
jne 0x416891
push 0x19
call fcn.005a59ed
add esp, 4
mov esi, eax
test esi, esi
je 0x416981
mov ecx, str.application_octet_stream
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x416867
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x120]
push eax
push 0x100
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
test eax, eax
je 0x41698b
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
cmp eax, 0xffffffff
je 0x41699d
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
push dword [ebp - 0x120]
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call dword [sym.imp.urlmon.dll_FindMimeFromData]
test eax, eax
je 0x416931
push 0x19
call fcn.005a59ed
add esp, 4
mov esi, eax
test esi, esi
je 0x4169af
mov ecx, str.application_octet_stream
mov edx, esi
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x416920
jmp 0x416873
mov dword [ebp - 4], 0
mov edx, edi
mov ecx, dword [ebp - 0x11c]
call fcn.00415fd0
mov esi, eax
mov dword [ebp - 0x124], esi
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x11c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x416873
push 0
xor edx, edx
mov ecx, str.CHttpToolW::GetMimeType:_CP_UTF8_and_CP_UTF7_can_not_be_used_for_the_CodePage_parameter.
call fcn.00415e00
push 0
xor edx, edx
mov ecx, str.CHttpToolW::GetMimeType:_hFile_can_not_be_NULL.
call fcn.00415e00
mov ecx, 0x66
call fcn.00415c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x25a
call fcn.00415d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x25c
call fcn.00415d30
mov ecx, 0x66
call fcn.00415c40
push dword [ebp - 0x11c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0
call fcn.0058895a
int3
Function at 0x41a390
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
je 0x41a44a
cmp dword [ebp + 8], 0
je 0x41a42d
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41a42d
cmp dword [ebp + 0x10], 0
lea ebx, [edi + 0x8c]
push esi
mov ecx, ebx
je 0x41a3ce
call fcn.00418af0
jmp 0x41a3d3
call fcn.004188a0
mov ecx, dword [edi + 0xe4]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x41a454
xor edi, edi
test esi, esi
je 0x41a40e
lea eax, [esp + 0x10]
push eax
mov eax, esi
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x41a436
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edi, esi
jb 0x41a3e7
cmp dword [ebp + 0x10], 0
mov ecx, ebx
push esi
je 0x41a425
call fcn.00418af0
add dword [ebx + 0x14], esi
mov ecx, ebx
add dword [ebx + 0x34], esi
push esi
call fcn.004188a0
add dword [ebx + 0xc], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x198
call fcn.00415d30
mov ecx, str.CHttpClientT::_WritePost:_m_hRequest_can_not_be_NULL.
call fcn.00415d00
push 0
xor edx, edx
mov ecx, str.CHttpToolW::InternetWriteFile:_hRequest_can_not_be_NULL.
call fcn.00415e00
int3
Function at 0x435d80
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4076
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
lea eax, [ebp + 8]
push eax
call fcn.00420d90
mov byte [ebp - 4], 3
lea eax, [ebp + 0x20]
push eax
lea ecx, [esi + 0x18]
call fcn.00420d90
mov byte [ebp - 4], 4
lea eax, [ebp + 0x38]
push eax
lea ecx, [esi + 0x30]
call fcn.00420d90
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x435e16
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x435e0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435ecb
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp + 0x34]
cmp edx, 0x10
jb 0x435e5c
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x435e52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435ed0
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x4c]
cmp edx, 0x10
jb 0x435ea5
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x435e9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435ed5
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp + 0x48], 0
mov eax, esi
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x48
call fcn.005a5046
call fcn.005a5046
call fcn.005a5046
int3
Function at 0x435ee0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e40ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
push eax
call fcn.00420d90
mov byte [ebp - 4], 2
lea eax, [ebp + 0x20]
push eax
lea ecx, [esi + 0x18]
call fcn.00420d90
mov byte [ebp - 4], 3
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x435f78
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x435f6e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435fe7
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x34]
cmp edx, 0x10
jb 0x435fc1
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x435fb7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435fec
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp + 0x30], 0
mov eax, esi
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x30
call fcn.005a5046
call fcn.005a5046
int3
Function at 0x467970
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eef2d
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1020], edx
mov esi, ecx
mov dword [ebp - 0x101c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1018], 0
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x467b8e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0x639ee0
mov dword [ebp - 0x1024], 1
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
mov dword [ebp - 0x101c], edi
test edi, edi
je 0x467ab1
cmp dword [ebp - 0x1018], 0
je 0x467a3f
push 4
lea eax, [ebp - 0x1018]
push eax
push 2
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push dword [ebp - 0x1020]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
je 0x467aa9
push 0x1001
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1028], 0
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x1028]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x467aa6
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.0040c670
push edi
call ebx
push dword [ebp - 0x101c]
call ebx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x467b70
push 0
push 0
push 0
push 1
push 0x639ee0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x467b70
cmp dword [ebp - 0x1018], 0
je 0x467af5
push 4
lea eax, [ebp - 0x1018]
push eax
push 2
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push dword [ebp - 0x1020]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
je 0x467b67
push 0x1001
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x101c], 0
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x101c]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x467b5c
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.0040c670
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
call ebx
jmp 0x467b6d
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040b250
int3
Function at 0x46d2b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x141c
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, esp
mov dword [esp + 0x1418], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x46d49e
push 0x208
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.00588800
movzx eax, word [esi]
add esp, 0xc
mov ecx, eax
mov edi, 0x20
mov dword [esp + 0x10], ecx
cmp eax, 0x7b
je 0x46d30a
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, str._Volume_s
cmp ax, 0x7b
mov dword [esp + 0x14], 6
mov edx, str.._c:
movzx eax, ax
cmove edx, ecx
mov ecx, 0x30
cmovne ecx, dword [esp + 0x14]
cmp word [esp + 0x10], 0x7b
mov word [ebx + 8], di
cmovne esi, eax
lea eax, [esp + 0x218]
push esi
push edx
push ecx
push eax
call fcn.0046d0c0
add esp, 0x10
lea eax, [esp + 0x218]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov edi, 1
mov dword [ebx + 0x10], esi
cmp esi, 0xffffffff
je 0x46d469
push 0x1000
lea eax, [esp + 0x424]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push eax
push 0x1000
lea eax, [esp + 0x42c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46d469
push 8
lea eax, [esp + 0x1f]
mov ecx, 0x80
lea esi, [esp + 0x424]
lea edi, [esp + 0x1c]
push str.EXFAT
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005a86e0
add esp, 0xc
mov edi, 1
test eax, eax
jne 0x46d469
mov eax, 0xaa55
cmp ax, word [esp + 0x216]
jne 0x46d469
cmp byte [esp + 0x86], 1
jne 0x46d469
movzx ecx, byte [esp + 0x84]
mov ax, di
shl ax, cl
mov esi, edi
movzx ecx, byte [esp + 0x85]
movzx edx, ax
mov word [ebx + 0x14], ax
mov eax, dword [esp + 0x74]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x6c]
shl esi, cl
mov dword [ebx + 0x24], eax
mov eax, edx
imul eax, dword [esp + 0x68]
imul esi, edx
imul edx, dword [esp + 0x70]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x30], edx
test esi, esi
je 0x46d469
mov dword [ebx + 0xc], edi
cmp dword [ebx + 0xc], 0
je 0x46d488
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1418]
xor ecx, esp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
je 0x46d49e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x10], 0
mov ecx, dword [esp + 0x1424]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
Function at 0x46d4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
mov esi, ecx
cmp eax, 2
jb 0x46d53f
cmp dword [ebp + 0xc], 0
je 0x46d53f
cmp dword [ebp + 0x10], 0
jbe 0x46d53f
cmp dword [esi + 0x10], 0xffffffff
je 0x46d53f
add eax, 0xfffffffe
mul dword [esi + 0x18]
add eax, dword [esi + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [esi]
adc edx, dword [esi + 0x34]
mov dword [ebp - 4], edx
mov eax, dword [eax + 4]
call eax
mov ecx, dword [ebp - 8]
add ecx, eax
lea eax, [ebp - 4]
push 0
adc dword [ebp - 4], edx
push eax
push ecx
push dword [esi + 0x10]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46d53f
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46d550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0xffffffff
je 0x46d614
mov ebx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [edi + 0x1040]
and ebx, 0x3ff
shr eax, 0xa
mov dword [ebp - 4], eax
cmp ecx, 0xffffffff
je 0x46d584
cmp eax, ecx
je 0x46d5fe
mov ecx, eax
xor eax, eax
shl ecx, 0xc
add ecx, dword [edi + 0x28]
mov dword [ebp - 0xc], ecx
mov ecx, edi
adc eax, dword [edi + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
mov ecx, dword [ebp - 0xc]
add ecx, eax
lea eax, [ebp - 8]
push 0
adc dword [ebp - 8], edx
push eax
push ecx
push dword [edi + 0x10]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46d614
push esi
push 0x1000
lea esi, [edi + 0x40]
mov dword [ebp + 8], 0
push 0
push esi
call fcn.00588800
add esp, 0xc
lea eax, [ebp + 8]
push 0
push eax
push 0x1000
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
je 0x46d614
mov eax, dword [ebp - 4]
mov dword [edi + 0x1040], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + ebx*4 + 0x40]
pop edi
pop ebx
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46dd70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efb28
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], vtable.CExFATVolume.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x1000
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x1040], 0xffffffff
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
mov dword [esi], vtable.CLostExFATVolume.0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046def0
test eax, eax
je 0x46de03
push 0x1000
lea eax, [esi + 0x40]
push 0
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46def0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efbd1
mov eax, dword fs:[0]
push eax
mov eax, 0x1214
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebx + 0x1048], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x1050], edi
mov dword [ebx + 0x1054], eax
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x46e12f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1214], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1214]
push dword [ebx + 0x1048]
push str..PhysicalDrive_d
push eax
call fcn.0040d300
mov esi, dword [ebp - 0x1214]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebx + 0x10], ecx
cmp ecx, 0xffffffff
je 0x46e0ee
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x1218], eax
lea eax, [ebp - 0x1218]
push eax
push edi
push ecx
mov dword [ebp - 0x121c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46e0cb
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x1220]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46e0cb
push 8
lea eax, [ebp - 0x120d]
mov ecx, 0x80
lea esi, [ebp - 0x1010]
lea edi, [ebp - 0x1210]
push str.EXFAT
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005a86e0
add esp, 0xc
test eax, eax
jne 0x46e0c5
mov eax, 0xaa55
cmp ax, word [ebp - 0x1012]
jne 0x46e0c5
cmp byte [ebp - 0x11a2], 1
jne 0x46e0c5
movzx ecx, byte [ebp - 0x11a4]
mov esi, 1
mov ax, si
mov dword [ebx + 0x2c], 0
shl ax, cl
movzx ecx, byte [ebp - 0x11a3]
movzx edx, ax
mov word [ebx + 0x14], ax
mov eax, dword [ebp - 0x11b0]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x11bc]
shl esi, cl
imul esi, edx
mov dword [ebx + 0x24], eax
mov eax, edx
imul eax, dword [ebp - 0x11c0]
imul edx, dword [ebp - 0x11b8]
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x18], esi
test esi, esi
mov esi, dword [ebp - 0x1214]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x30], edx
je 0x46e0cb
mov dword [ebx + 0xc], 1
jmp 0x46e0cb
mov esi, dword [ebp - 0x1214]
cmp dword [ebx + 0xc], 0
je 0x46e0d8
mov edi, 1
jmp 0x46e0f0
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
je 0x46e0ee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x10], 0
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46e10f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0040b250
int3
Function at 0x46e140
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efc1e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], vtable.CExFATVolume.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x1000
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x1040], 0xffffffff
mov dword [ebp - 4], eax
lea edi, [esi + 0x1048]
mov dword [esi], vtable.CRAWExFATVolume.0
mov dword [ebp - 0x14], edi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x46e24a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
xor eax, eax
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x1000
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x1040], 0xffffffff
call fcn.0046e390
test eax, eax
je 0x46e22e
push 0x1000
lea eax, [esi + 0x40]
push 0
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040b250
int3
Function at 0x46ec80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x141c
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, esp
mov dword [esp + 0x1418], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0xc], ebx
push edi
test esi, esi
je 0x46ee84
push 0x208
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.00588800
movzx eax, word [esi]
add esp, 0xc
mov edx, eax
mov edi, 0x20
cmp eax, 0x7b
je 0x46ecda
mov edi, eax
cmp edx, 0x7b
mov dword [esp + 0x14], 6
mov ecx, str.._c:
cmovne esi, eax
mov eax, str._Volume_s
cmove ecx, eax
mov eax, 0x30
cmovne eax, dword [esp + 0x14]
push esi
push ecx
push eax
lea eax, [esp + 0x224]
mov word [ebx + 8], di
push eax
call fcn.0046d0c0
add esp, 0x10
lea eax, [esp + 0x218]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebx + 0x10], esi
cmp esi, 0xffffffff
je 0x46ee4c
push 0x1000
lea eax, [esp + 0x424]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push eax
push 0x1000
lea eax, [esp + 0x42c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ee4c
push 5
lea eax, [esp + 0x52]
mov ecx, 0x80
lea esi, [esp + 0x424]
lea edi, [esp + 0x1c]
push 0x64ee20
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005a86e0
add esp, 0xc
test eax, eax
jne 0x46ee4c
mov eax, 0xaa55
cmp word [esp + 0x216], ax
jne 0x46ee4c
mov ax, word [esp + 0x23]
mov edx, dword [esp + 0x10]
mov cx, word [esp + 0x26]
movzx esi, word [esp + 0x2e]
mov di, word [esp + 0x29]
mov word [ebx + 0x14], ax
movzx ebx, ax
movzx eax, byte [esp + 0x25]
imul eax, ebx
mov word [edx + 0x16], cx
mov word [edx + 0x18], di
mov dword [edx + 0x24], esi
mov dword [esp + 0x14], eax
mov dword [edx + 0x1c], eax
mov al, byte [esp + 0x28]
mov byte [edx + 0x28], al
movzx eax, cx
mov ecx, dword [esp + 0x10]
imul eax, ebx
imul ebx, esi
cdq
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov ecx, ebx
add ecx, eax
mov eax, 0
adc eax, edx
mov edx, dword [esp + 0x10]
mov dword [edx + 0x3c], eax
mov dword [edx + 0x38], ecx
add ecx, ebx
mov ebx, edx
movzx eax, di
shl eax, 5
add eax, ecx
cmp dword [esp + 0x14], 0
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 0
jbe 0x46ee4c
mov dword [ebx + 0xc], 1
cmp dword [ebx + 0xc], 0
je 0x46ee6e
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1418]
xor ecx, esp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
je 0x46ee84
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x10], 0
mov ecx, dword [esp + 0x1424]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4