joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100156a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
shrd ecx, eax, 9
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0x1c]
push ebx
lea edx, [ecx + 0x5710]
push esi
mov esi, dword [ebp + 0xc]
shr eax, 9
add ecx, 0x2a80
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
jmp 0x100156e7
mov eax, dword [esp + 0x34]
add dword [esp + 0x30], 1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x30]
adc eax, 0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push edx
call fcn.10011eb0
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor ecx, dword [esp + 0x20]
xor edx, dword [esp + 0x24]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x18]
push eax
push esi
xor ecx, edi
xor edx, ebx
push esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.10011eb0
xor dword [esi + 8], edi
mov ecx, dword [esp + 0x20]
xor dword [esi], ecx
xor dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x24]
xor dword [esi + 4], ecx
add dword [ebp + 8], 0x10
mov eax, ebx
shld ebx, edi, 1
mov edx, ecx
shr edx, 0x1f
add edi, edi
or edi, edx
mov edx, dword [esp + 0x20]
shr eax, 0x1f
shld ecx, edx, 1
imul eax, eax, 0x87
add edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, edx
mov edx, dword [esp + 0x1c]
xor ecx, eax
add esi, 0x10
dec dword [esp + 0x10]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
jne 0x10015717
sub dword [ebp + 0x10], 0x200
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
jne 0x100156e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100157c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
shrd ecx, eax, 9
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea edx, [ecx + 0x4670]
shr eax, 9
add ecx, 0x19e0
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
jmp 0x10015814
mov eax, dword [esp + 0x2c]
add dword [esp + 0x28], 1
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
adc eax, 0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call fcn.1000c440
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x20
mov edx, dword [edi]
xor edx, eax
mov eax, dword [edi + 4]
xor eax, ebx
mov dword [esi], edx
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
mov eax, dword [edi + 0xc]
xor eax, dword [esp + 0x24]
xor edx, ecx
mov ecx, dword [esp + 0x14]
push ecx
push esi
push esi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call fcn.1000cb61
mov edx, dword [esp + 0x1c]
xor dword [esi + 4], edx
mov ebx, dword [esp + 0x24]
xor dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x20]
xor dword [esi + 8], ecx
mov eax, dword [esp + 0x18]
xor dword [esi], eax
mov edx, ebx
shld ebx, ecx, 1
shr edx, 0x1f
mov dword [esp + 0x24], ebx
imul edx, edx, 0x87
mov ebx, dword [esp + 0x1c]
shr ebx, 0x1f
add ecx, ecx
or ecx, ebx
mov ebx, dword [esp + 0x1c]
shld ebx, eax, 1
add eax, eax
xor eax, edx
add edi, 0x10
add esi, 0x10
dec dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
jne 0x10015848
sub dword [ebp + 0x10], 0x200
jne 0x10015810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100158f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
shrd ecx, eax, 9
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea edx, [ecx + 0x4670]
shr eax, 9
add ecx, 0x19e0
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
jmp 0x10015944
mov eax, dword [esp + 0x2c]
add dword [esp + 0x28], 1
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
adc eax, 0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call fcn.1000c440
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x20
mov edx, dword [edi]
xor edx, eax
mov eax, dword [edi + 4]
xor eax, ebx
mov dword [esi], edx
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
mov eax, dword [edi + 0xc]
xor eax, dword [esp + 0x24]
xor edx, ecx
mov ecx, dword [esp + 0x14]
push ecx
push esi
push esi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call fcn.1000c440
mov edx, dword [esp + 0x1c]
xor dword [esi + 4], edx
mov ebx, dword [esp + 0x24]
xor dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x20]
xor dword [esi + 8], ecx
mov eax, dword [esp + 0x18]
xor dword [esi], eax
mov edx, ebx
shld ebx, ecx, 1
shr edx, 0x1f
mov dword [esp + 0x24], ebx
imul edx, edx, 0x87
mov ebx, dword [esp + 0x1c]
shr ebx, 0x1f
add ecx, ecx
or ecx, ebx
mov ebx, dword [esp + 0x1c]
shld ebx, eax, 1
add eax, eax
xor eax, edx
add edi, 0x10
add esi, 0x10
dec dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
jne 0x10015978
sub dword [ebp + 0x10], 0x200
jne 0x10015940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10015c50
Capabilities:
Encrypt data using aes via x86 extensions
Reference processor manufacturer constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025bc0
push 0x1001e3f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea esi, [ebp - 0x40]
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov edi, ebx
pop ebx
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x38]
test eax, 0x2000000
je 0x10015ccb
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test eax, eax
jns 0x10015da7
lea esi, [ebp - 0x40]
mov eax, 0x40000000
xor ecx, ecx
push ebx
cpuid
mov edi, ebx
pop ebx
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x3c], 0x7263694d
jne 0x10015da7
cmp dword [ebp - 0x38], 0x666f736f
jne 0x10015da7
cmp dword [ebp - 0x34], 0x76482074
jne 0x10015da7
xor eax, eax
mov dword [ebp - 4], eax
movdqa xmm0, xmmword [0x10025450]
movdqa xmm1, xmmword [0x10025460]
aesenc xmm1, xmm0
movdqa xmmword [ebp - 0x40], xmm1
cmp dword [ebp - 0x40], 0x4b7b7b54
jne 0x10015d89
cmp dword [ebp - 0x3c], 0x5f77774d
jne 0x10015d89
cmp dword [ebp - 0x38], 0x427c7c58
jne 0x10015d89
cmp dword [ebp - 0x34], 0x63636367
jne 0x10015d89
mov eax, 1
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10016ac0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or eax, 0xffffffff
inc ecx
mov edx, 8
push edi
jmp 0x10016ad0
movzx esi, byte [ecx - 1]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx + 1]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx + 2]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
add ecx, 4
dec edx
jne 0x10016ad0
pop edi
pop esi
ret
Function at 0x10016b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or eax, 0xffffffff
inc ecx
mov edx, 0x1ee
push edi
jmp 0x10016b40
movzx esi, byte [ecx - 1]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx + 1]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
movzx esi, byte [ecx + 2]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10024e00]
add ecx, 4
dec edx
jne 0x10016b40
pop edi
not eax
pop esi
ret

Function at 0x10016e40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x10016e90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
push 0
push eax
push esi
push ebx
call fcn.1001e310
or eax, edx
jne 0x10016ecd
mov eax, dword [ebp + 0x10]
xor edx, edx
div dword [edi + 8]
test edx, edx
jne 0x10016ecd
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
jmp 0x10016f08
mov edi, dword [edi + 8]
push 0
push edi
push esi
push ebx
call fcn.1001e310
mov edx, dword [ebp + 0x10]
xor ecx, ecx
sub ebx, eax
sbb esi, ecx
mov dword [ebp - 4], esi
lea esi, [eax + edx]
mov dword [ebp + 0x18], eax
mov eax, esi
xor edx, edx
div edi
mov dword [ebp - 8], ebx
sub edi, edx
add esi, edi
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, dword [ebp + 8]
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x10016f14
lea esi, [ebx + 9]
jmp 0x10016fa7
mov ecx, dword [ebp - 8]
mov edx, dword [edi]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10016f36
mov esi, 0xf
jmp 0x10016fa7
push 0
cmp ebx, dword [ebp + 0xc]
je 0x10016f8c
mov ecx, dword [edi]
lea eax, [ebp + 8]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10016f55
lea esi, [eax + 0xf]
jmp 0x10016fa7
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push edx
push eax
lea edx, [ebx + ecx]
push edx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 8]
mov edx, dword [edi]
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [edi]
push 0
lea eax, [ebp + 8]
push eax
push esi
push ebx
push ecx
jmp 0x10016f95
mov eax, dword [edi]
lea edx, [ebp + 8]
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0xf
cmp ebx, dword [ebp + 0xc]
je 0x10016fb6
push ebx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push edi
mov edi, dword [ebp + 0x18]
push 0
push eax
push edi
push ebx
call fcn.1001e310
or eax, edx
jne 0x10016ffd
mov eax, dword [ebp + 0x10]
xor edx, edx
div dword [esi + 8]
test edx, edx
jne 0x10016ffd
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
jmp 0x10017038
mov esi, dword [esi + 8]
push 0
push esi
push edi
push ebx
call fcn.1001e310
mov edx, dword [ebp + 0x10]
xor ecx, ecx
sub ebx, eax
sbb edi, ecx
mov dword [ebp - 4], edi
lea edi, [eax + edx]
mov dword [ebp + 0x18], eax
mov eax, edi
xor edx, edx
div esi
mov dword [ebp - 8], ebx
sub esi, edx
add edi, esi
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, dword [ebp + 8]
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x10017041
lea edi, [ebx + 9]
jmp 0x10017080
mov ecx, dword [ebp - 8]
mov edx, dword [esi]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10017063
mov edi, 0xf
jmp 0x10017080
mov ecx, dword [esi]
push 0
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff1
add edi, 0xf
mov eax, dword [ebp + 0xc]
cmp ebx, eax
je 0x100170a9
test edi, edi
jne 0x1001709f
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push edx
lea edx, [ebx + ecx]
push edx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100173a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100173cf
mov eax, 0xd
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0x10]
push eax
mov dword [edi], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, dword [ebp + 0xc]
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x100173f7
lea edi, [eax + 9]
jmp 0x10017421
mov edx, dword [edi]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001741f
mov eax, dword [ebx]
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov edi, 0xf
jmp 0x10017421
xor edi, edi
test esi, esi
je 0x1001742c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10017488
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xd
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100174a0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x100174f8
lea eax, [ebx + 9]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
push esi
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1001750e
lea esi, [eax + 1]
jmp 0x1001751b
mov esi, dword [ebp - 0x14]
neg esi
sbb esi, esi
and esi, 0xffffffe5
add esi, 0x1b
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x10017529
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d340
mov esp, ebp
pop ebp
ret

Function at 0x10017670
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100278f8]
sub esp, 0x20
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x100176b0
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100176da
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 4
lea eax, [ebp + 8]
push eax
push 0x2201f4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10017718
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10017718
mov edx, dword [ebp + 8]
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x10017718
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x20], eax
jne 0x1001771b
cmp dword [ebp - 0x1c], eax
jne 0x1001771b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10017710
mov byte [eax], 0
inc eax
dec ecx
jne 0x10017703
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov eax, dword [ebp + 8]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017730
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push 0x40
push 0x3000
push esi
push 0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10017759
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push 0x2201f0
call sym.dcapi.dll_dc_device_control
add esp, 0x14
test eax, eax
je 0x1001777f
mov ecx, dword [ebp - 0xc]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push ebx
push esi
mov esi, dword [eax + 8]
push edi
xor ebx, ebx
push ebx
push esi
push ebx
push ebx
call fcn.1001e310
mov edi, eax
mov ecx, eax
or ecx, edx
jne 0x10017e12
xor edx, edx
mov eax, 0x200
div esi
test edx, edx
jne 0x10017e12
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov edi, 0x200
mov dword [ebp - 4], eax
jmp 0x10017e45
xor edx, edx
mov ebx, edi
neg ebx
adc edx, edx
neg edx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edx
add edi, 0x200
mov eax, edi
xor edx, edx
div esi
mov dword [ebp - 0x10], ebx
sub esi, edx
add edi, esi
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
add esp, 4
cmp dword [ebp - 4], 0
jne 0x10017e52
mov esi, 9
jmp 0x10017e95
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10017e74
mov esi, 0xf
jmp 0x10017e92
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
push 0
lea edx, [ebp + 8]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb esi, esi
and esi, 0xfffffff1
add esi, 0xf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
cmp ecx, eax
je 0x10017ec2
test esi, esi
jne 0x10017eb2
add ecx, dword [ebp - 8]
push 0x200
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp + 0xc]
add esp, 4
test esi, esi
jne 0x10017f1e
mov ecx, 0xaa55
cmp word [eax + 0x1fe], cx
je 0x10017ede
lea eax, [esi + 0x12]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 2]
cmp ecx, 0x10eb9090
je 0x10017efd
cmp ecx, 0x20b60251
je 0x10017efd
mov eax, 0x15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0xe]
mov edi, dword [eax + 0x12]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + 8]
shld edi, edx, 9
shl edx, 9
mov dword [ecx], edx
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0x14]
shl eax, 9
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018db0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100278f4]
push ebx
push esi
push edi
xor edi, edi
push 0x1001f2cc
cmp dword [ebp + 0xc], edi
je 0x10018dce
push 0x8d
jmp 0x10018dd3
push 0x8c
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10018e09
mov ecx, dword [0x100278f4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x100278f4]
push esi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
jmp 0x10018e0c
mov ebx, dword [ebp + 0xc]
test edi, edi
jne 0x10018e18
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10018e55
push 0
lea ecx, [ebp + 0xc]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xd
pop ebx
pop ebp
ret
Function at 0x10019b00
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push ebx
push esi
push edi
cmp ecx, 0x5c
je 0x10019b43
push ecx
push str.._c:
lea ecx, [esp + 0x40]
push 0x104
push ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
jmp 0x10019b57
push 0x104
push eax
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10019b92
mov eax, 0xd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x18
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0x70000
push edi
call esi
test eax, eax
je 0x10019c86
cmp dword [esp + 0x28], 0xb
je 0x10019bcb
mov esi, 0x28
jmp 0x10019c8b
test dword [esp + 0x34], 0x1ff
je 0x10019bdf
mov esi, 0x22
jmp 0x10019c8b
push 0
lea eax, [esp + 0x14]
push eax
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x2d1080
push edi
call esi
test eax, eax
je 0x10019c86
cmp dword [ebp + 0xc], 0
jne 0x10019c55
mov edx, dword [esp + 0x18]
push edx
call fcn.10017f30
add esp, 4
test eax, eax
je 0x10019c1f
mov esi, 0x29
jmp 0x10019c8b
mov ebx, dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push ebx
push 1
push eax
call sym.dcapi.dll_dc_set_mbr
mov esi, eax
add esp, 0xc
cmp esi, 0x14
jne 0x10019c8b
mov ecx, dword [esp + 0x18]
push ebx
push 0
push ecx
call sym.dcapi.dll_dc_set_mbr
mov esi, eax
add esp, 0xc
cmp esi, 0x14
jne 0x10019c8b
lea esi, [eax + 0x15]
jmp 0x10019c8b
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x2c]
mov ecx, edi
call fcn.10019510
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov esi, 1
test edi, edi
je 0x10019c96
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret