joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fd50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac61c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41b6bb
push 0x46ef52
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.0057c246
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
push 3
pop ecx
mov word [esp + 0x34], cx
xor ecx, ecx
cmp byte [ebp + 0xc], al
mov dword [esp + 0x30], eax
sete cl
add ebx, 0x34
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46fe89
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413f62
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046ef21
test eax, eax
jl 0x46fe63
cmp dword [esp + 0x18], 0
je 0x46fe63
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x66b2cc
push 6
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46fe53
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.0046f5eb
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46fde4
or dword [esp + 0x60], 0xffffffff
push 0x41b6bb
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.0057a921
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x470436
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac61c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41b6bb
push 0x46ef52
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.0057c246
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x47056a
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413f62
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046ef21
test eax, eax
jl 0x470544
cmp dword [esp + 0x18], 0
je 0x470544
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x66b2cc
push 0xf
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x470534
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.0046f5eb
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x4704c5
or dword [esp + 0x60], 0xffffffff
push 0x41b6bb
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.0057a921
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47059b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac61c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41b6bb
push 0x46ef52
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.0057c246
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x4706cc
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413f62
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046ef21
test eax, eax
jl 0x4706a6
cmp dword [esp + 0x18], 0
je 0x4706a6
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x66b2cc
push 0x10
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x470696
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.0046f5eb
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x470627
or dword [esp + 0x60], 0xffffffff
push 0x41b6bb
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.0057a921
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x470b4f
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x290
lea ebp, [esp - 4]
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp + 0x290], eax
push 0x3c
mov eax, 0x5b6e0f
call fcn.0058708e
mov eax, dword [0x6de794]
push 0x104
lea ecx, [ebp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x470d60
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 0x38]
push eax
lea esi, [ebp]
call fcn.00408172
mov byte [ebp - 4], 1
xor edi, edi
inc edi
push edi
mov eax, esi
call fcn.0047122e
cmp eax, 0xffffffff
je 0x470d53
mov ecx, dword [ebp + 0x14]
dec ecx
push ecx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
push eax
call fcn.00408368
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00409918
mov byte [ebp - 4], 1
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.00409bf1
lea eax, [ebp + 0x240]
push eax
push 0x679348
call fcn.0041d3c9
pop ecx
pop ecx
push 0x67935c
lea esi, [ebp - 0x2c]
call fcn.00408172
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x240]
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0044956a
add esp, 0xc
mov byte [ebp - 4], 5
push ebx
push edi
call fcn.00409bf1
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], ebx
je 0x470c71
cmp dword [ebp + 0x34], 8
jae 0x470c3f
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x67936c
mov edi, 0x679390
call fcn.004711aa
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x470c5c
lea eax, [ebp + 0x20]
push 0x679394
push 0x6793b8
push eax
call fcn.00471214
add esp, 0xc
jmp 0x470c86
cmp dword [ebp + 0x34], 8
jae 0x470c7a
lea eax, [ebp + 0x20]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x6793d4
lea esi, [ebp - 0x48]
call fcn.00408172
mov byte [ebp - 4], 6
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040de32
add esp, 0xc
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x1c]
call fcn.00409918
mov byte [ebp - 4], 6
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bf1
mov byte [ebp - 4], 5
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409bf1
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], ebx
je 0x470d1d
cmp dword [ebp + 0x34], 8
jae 0x470ce9
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x6793e4
mov edi, 0x6793e8
call fcn.004711aa
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x470d06
lea eax, [ebp + 0x20]
lea ecx, [ebp + 0x240]
push ecx
push 0x6793ec
push eax
call fcn.00471214
add esp, 0xc
jmp 0x470d32
cmp dword [ebp + 0x34], 8
jae 0x470d26
lea eax, [ebp + 0x20]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [ebp - 4], 1
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.00409bf1
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp]
call fcn.00409bf1
xor eax, eax
jmp 0x470d65
mov byte [ebp - 4], bl
push ebx
push edi
lea esi, [ebp]
call fcn.00409bf1
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
call fcn.005796dc
add ebp, 0x294
leave
ret
Function at 0x47107f
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x3c
mov eax, 0x5b6d72
call fcn.0058708e
mov eax, dword [ebp + 0x7c]
lea ecx, [ebp + 0x20]
push ecx
push eax
call fcn.0041d3c9
pop ecx
pop ecx
mov dword [ebp], 0x80004005
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.CLSID_
lea esi, [ebp - 0x2c]
call fcn.00408172
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp + 4]
push eax
call fcn.0044956a
add esp, 0xc
mov byte [ebp - 4], 3
push ebx
push 1
call fcn.00409bf1
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4710f2
lea eax, [ebp + 8]
push eax
push connect
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call edi
cmp eax, ebx
jne 0x47116e
push str.AppID_
lea esi, [ebp - 0x48]
call fcn.00408172
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044956a
add esp, 0xc
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 4]
call fcn.00409918
mov byte [ebp - 4], 4
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bf1
mov byte [ebp - 4], 3
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409bf1
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x47115f
lea eax, [ebp + 8]
push eax
push connect
call edi
cmp eax, ebx
jne 0x47116e
mov dword [ebp], ebx
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp + 4]
call fcn.00409bf1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.005796dc
add ebp, 0x74
leave
ret
Function at 0x472fe0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5b6900
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x47304a
test esi, 0xffff0000
jne 0x47304e
movzx esi, si
push esi
call fcn.00402e8e
add esp, 4
test eax, eax
je 0x47306b
push esi
push eax
push edi
call fcn.0040cec6
jmp 0x47306b
xor eax, eax
jmp 0x473062
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x473053
sub eax, edx
sar eax, 1
push eax
push esi
mov eax, edi
call fcn.0040b3ac
mov dword [esp + 0x14], 1
mov eax, dword [edi]
push eax
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x4731d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ac5d4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.00579757
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x47322c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x47322e
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4732d4
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x473295
mov eax, dword [edi]
push esi
push eax
call fcn.0057c558
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x473292
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.0057e5e0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4732bb
cmp dword [esp + 0x40], esi
je 0x4732d4
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x4732d4
mov eax, dword [esi]
push ebx
push eax
call fcn.0057c558
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4732f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x473366
ja 0x473309
cmp esi, dword [esp + 0x20]
jae 0x47336a
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x473325
jb 0x473321
cmp ecx, 0x10000
jae 0x473325
mov edi, ecx
jmp 0x47332a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x473366
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x473366
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x473309
ja 0x473366
cmp esi, dword [esp + 0x20]
jb 0x473309
cmp esi, dword [esp + 0x20]
jne 0x473387
cmp ebp, ebx
jne 0x473387
or esi, ebp
je 0x47337f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x473390
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5adf18
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x473435
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
call fcn.004732f0
add esp, 0x10
test al, al
je 0x47341d
mov dword [esp + 0x18], 0xffffffff
push esi
call ebx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esp + 0x2c], 0
je 0x473435
push esi
call ebx
or esi, 0xffffffff
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x18], 0xffffffff
cmp esi, 0xffffffff
je 0x473445
push esi
call ebx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4734d0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4734f6
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x473a30
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5adeec
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x34], ebx
push 0xc
mov dword [esp + 0x1c], ebx
call fcn.00579757
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, 1
mov dword [esp + 0x34], edi
cmp eax, ebx
je 0x473a8c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
jmp 0x473a8e
xor eax, eax
mov byte [esp + 0x34], bl
mov dword [ebp], eax
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x473b2d
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and edx, dword [esp + 0x20]
cmp edx, 0xffffffff
je 0x473b2d
push ebx
push ebx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004731d0
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 2
mov esi, dword [ebp]
add dword [esi + 8], 0xffffffff
jne 0x473af5
xor edi, edi
call fcn.00428d6c
mov edi, 1
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
add dword [eax + 8], edi
mov dword [ebp], eax
mov byte [esp + 0x34], bl
mov eax, dword [esp + 0x14]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x473b2d
xor edi, edi
call fcn.00428d6c
mov edx, dword [esp + 0x14]
push edx
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x473c50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b3c69
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], 1
call fcn.00473b50
add esp, 8
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x18]
cmp dword [eax], ebx
je 0x473d12
cmp dword [eax + 4], ebx
je 0x473d12
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x473cf2
mov eax, esi
mov ecx, ebp
call fcn.0040d99b
cmp esi, ebx
mov eax, dword [ebp]
jl 0x473d54
cmp esi, dword [eax - 8]
jg 0x473d54
push esi
mov dword [eax - 0xc], esi
mov edx, dword [ebp]
push edi
push eax
mov byte [esi + edx], bl
call fcn.0057e690
add esp, 0xc
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x18]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x473d3e
xor edi, edi
call fcn.00428d6c
mov eax, dword [esp + 0x18]
push eax
call fcn.005796d1
add esp, 4
mov dword [esp + 0x18], ebx
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00402d79
int3
Function at 0x474220
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5ba0fc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x50], ebp
mov edi, ecx
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
call fcn.00474440
mov dword [esp + 0x50], ebp
push ebp
push ebp
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
cmp ebx, ebp
je 0x47441c
lea esi, [ebx + 1]
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], cx
cmp esi, 0xffffffff
jne 0x4742a9
call fcn.005785f1
jmp 0x4742b1
cmp esi, 0x7ffffffe
jbe 0x4742ba
call fcn.005785f1
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x4742ef
mov edx, dword [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x30]
push eax
call fcn.0040cd36
mov eax, dword [esp + 0x40]
cmp esi, ebp
jbe 0x47434c
cmp esi, 1
jne 0x47430b
cmp eax, 8
mov eax, dword [esp + 0x2c]
jae 0x4742e8
lea eax, [esp + 0x2c]
xor edx, edx
mov word [eax], dx
jmp 0x474333
cmp esi, ebp
jne 0x4742d4
cmp eax, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebp
jae 0x474304
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax], cx
jmp 0x47434c
mov edi, dword [esp + 0x2c]
cmp eax, 8
jae 0x474318
lea edi, [esp + 0x2c]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x474346
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x474367
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4743f0
cmp dword [esp + 0x40], esi
mov esi, dword [esp + 0x2c]
jae 0x474381
lea esi, [esp + 0x2c]
cmp word [esi], bp
je 0x4743f0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00472fe0
mov byte [esp + 0x50], 2
mov ebx, eax
call fcn.004744b0
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4743c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x4743d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4743d0
mov edi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x474386
xor ebp, ebp
mov byte [esp + 0x50], 0
cmp dword [esp + 0x40], 8
jb 0x474409
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.005796d1
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], dx
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005796dc
add esp, 0x40
ret