joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001beba
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov dword [ebp - 4], 0
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001bf51
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x124]
push eax
call fcn.1001be1e
add esp, 8
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x1001bf3a
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x124]
push edx
call fcn.1001bd79
add esp, 8
and eax, 0xff
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001befa
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x1001bf6b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push edi
mov dword [ebp - 0x9c], 0
mov ecx, 0x26
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1001bfad
xor eax, eax
jmp 0x1001bfdb
cmp dword [ebp - 0x98], 5
jne 0x1001bfc2
mov dword [ebp - 0xa0], 1
jmp 0x1001bfd5
cmp dword [ebp - 0x98], 5
jbe 0x1001bfd5
mov dword [ebp - 0xa0], 2
mov eax, dword [ebp - 0xa0]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1001c2c1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0x104
push 0
push 0x10095ce8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push str.c:Ntlogs
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.c:Ntlogs_appinfo.dat
push 0x10095ce8
call sub.MSVCRT.dll_strcpy
add esp, 8
pop ebp
ret

Function at 0x1001c2f9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001c370
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push str.360tray.exe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x1001c35c
mov eax, 1
jmp 0x1001c372
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001c32c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001f8a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1001f8fa
cmp byte [esi + 0x5c], 0x77
jne 0x1001f8fa
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1001f8e5
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
je 0x1001f8de
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call fcn.100202b0
add esp, 0xc
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x1001fa60
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1001fa71
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x1001fabe
call sub.MSVCRT.dll__errno
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x1001fab9
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [edx + 0xc], 0x20
je 0x1001fad0
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi + 4]
xor ecx, ecx
dec eax
mov dword [esi + 4], eax
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
mov eax, ecx
pop esi
ret
Function at 0x1001fdd0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1001fe5f
cmp byte [esi + 0x5c], 0x77
jne 0x1001fe5f
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esi], ebp
mov dword [esi + 4], edi
je 0x1001fe43
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1001fe21
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
jne 0x1001fe3c
mov dword [esi + 0x10], eax
push 0
push esi
call fcn.10020380
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x1001fe43
mov eax, dword [esi + 4]
test eax, eax
jne 0x1001fdf6
jmp 0x1001fe43
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 0x4c]
push edi
push ebp
push edx
call fcn.10021a10
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
pop ebp
sub eax, ecx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x1001fe70
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
test esi, esi
push edi
je 0x1001ff1d
cmp byte [esi + 0x5c], 0x77
jne 0x1001ff1d
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x1001febe
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x1001ff03
mov edx, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], edx
test ebx, ebx
jne 0x1001ff0d
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.10020380
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x1001fedf
cmp eax, 0xfffffffb
jne 0x1001fedf
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1001fef0
cmp dword [esi + 0x38], 1
je 0x1001fef0
xor ebx, ebx
jmp 0x1001fef5
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001fe8e
cmp eax, 1
jne 0x1001ff0d
jmp 0x1001fe8e
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
mov esi, dword [esi + 0x38]
pop edi
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x10021a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10021a1b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x10021b1e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1007f9fc]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1007f9fc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1007f9fc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1007f9fc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1007f9fc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1007f9fc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1007f9fc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1007f9fc]
xor eax, edx
inc ecx
dec edi
jne 0x10021a36
pop edi
test esi, esi
je 0x10021b40
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1007f9fc]
xor eax, edx
inc ecx
dec esi
jne 0x10021b22
pop esi
pop ebx
not eax
ret
Function at 0x100350b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, dword [esi + 0x60]
cmp ebx, ebp
jle 0x100351b1
mov al, byte [esi + 6]
test al, al
je 0x100351b1
mov ecx, dword [esi + 0x5c]
lea eax, [ebx + ebx*2]
shl eax, 4
push eax
push ecx
call fcn.10029860
mov edx, eax
add esp, 8
test edx, edx
jne 0x100350f5
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
ret
lea eax, [ebp + ebp*2]
shl eax, 4
lea edi, [eax + edx]
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x14], edi
lea ecx, [eax + eax*2]
xor eax, eax
shl ecx, 4
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
mov ebx, dword [esp + 0x18]
and ecx, 3
cmp ebp, ebx
rep stosb byte es:[edi], al
mov dword [esi + 0x5c], edx
jge 0x100351b1
mov ecx, dword [esp + 0x14]
lea edi, [ecx + 0x18]
mov edx, dword [esi + 0x18]
mov dword [edi - 4], edx
mov eax, dword [esi + 0x40]
cmp dword [eax], 0
je 0x10035156
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
test eax, eax
jl 0x10035156
jg 0x10035151
test ecx, ecx
jbe 0x10035156
mov dword [edi - 0x14], eax
jmp 0x10035163
mov ecx, dword [esi + 0x94]
mov dword [edi - 0x14], 0
mov dword [edi - 0x18], ecx
mov edx, dword [esi + 0x34]
mov dword [edi], edx
mov eax, dword [esi + 0x18]
push eax
call fcn.100301b0
add esp, 4
mov dword [edi - 8], eax
test eax, eax
je 0x100350eb
push esi
call fcn.100303e0
add esp, 4
test eax, eax
je 0x100351a2
mov edx, dword [esi + 0xd0]
lea ecx, [edi + 4]
push ecx
push edx
call fcn.10035220
add esp, 8
lea eax, [ebp + 1]
add edi, 0x30
mov ebp, eax
mov dword [esi + 0x60], eax
cmp ebp, ebx
jl 0x10035133
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100456e0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
test ecx, ecx
jne 0x1004579a
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor eax, eax
mov ecx, dword [esi + 0x40]
mov edi, dword [esi + 0x38]
lea ebx, [ecx + edx*2]
xor ecx, ecx
mov cl, byte [esi + 5]
xor edx, edx
mov ah, byte [ebx]
mov ebp, ecx
mov al, byte [ebx + 1]
mov dh, byte [edi + ebp + 5]
mov dl, byte [edi + ebp + 6]
cmp eax, edx
jb 0x10045787
mov ecx, dword [esp + 0x1c]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x34]
cmp edx, dword [ecx + 0x24]
ja 0x10045787
mov edx, dword [esp + 0x1c]
push edx
push eax
push esi
call fcn.100457a0
add esp, 0xc
test eax, eax
je 0x1004574c
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
ret
dec word [esi + 0x10]
mov ax, word [esi + 0x10]
mov ecx, dword [esp + 0x18]
and eax, 0xffff
sub eax, ecx
lea edx, [ebx + 2]
add eax, eax
push eax
push edx
push ebx
call sub.MSVCRT.dll_memmove
mov al, byte [esi + 0x11]
add esp, 0xc
mov byte [edi + ebp + 3], al
mov cl, byte [esi + 0x10]
mov byte [edi + ebp + 4], cl
add word [esi + 0xe], 2
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xdf90
call fcn.1007d9d0
mov edx, dword [esp + 0x24]
add esp, 4
mov dword [edx], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10045d30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov eax, dword [esi + 0x34]
mov ecx, dword [eax]
push ecx
call fcn.10045ef0
mov ebp, dword [esi + 0x38]
xor ecx, ecx
mov cx, word [esi + 0x10]
mov ebx, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x34]
xor edx, edx
xor eax, eax
mov dl, byte [esi + 5]
mov ax, word [esi + 0xc]
mov esi, dword [ecx + 0x24]
xor ecx, ecx
mov ch, byte [edx + ebp + 5]
mov dword [esp + 0x14], esi
mov cl, byte [edx + ebp + 6]
mov dword [esp + 0x28], ebx
mov edi, ecx
mov ecx, esi
sub ecx, edi
add esp, 4
lea esi, [edi + ebp]
add edi, ebx
mov ebx, ecx
mov dword [esp + 0x2c], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x10]
and ecx, 3
mov dword [esp + 0x18], 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
lea edi, [eax + ecx*2]
mov dword [esp + 0x20], edi
jle 0x10045e61
add eax, ebp
mov dword [esp + 0x14], eax
jmp 0x10045dc3
mov eax, dword [esp + 0x14]
xor edx, edx
mov dh, byte [eax]
mov dl, byte [eax + 1]
mov esi, edx
cmp esi, edi
mov dword [esp + 0x28], esi
jl 0x10045ec9
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp esi, eax
jg 0x10045ec9
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
add esi, ecx
push esi
push edx
call fcn.10044e20
and eax, 0xffff
add esp, 8
sub ebx, eax
cmp ebx, edi
jl 0x10045eb5
mov ecx, dword [esp + 0x28]
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
jg 0x10045eb5
mov ecx, eax
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
add eax, 2
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov edi, dword [esp + 0x20]
sar ecx, 8
mov byte [eax - 2], cl
mov ecx, dword [esp + 0x18]
mov byte [eax - 1], bl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x10045dbf
mov edx, dword [esp + 0x2c]
mov eax, ebx
mov byte [edx + ebp + 6], bl
sub ebx, edi
mov byte [edx + ebp + 1], 0
sar eax, 8
mov ecx, ebx
mov byte [edx + ebp + 5], al
mov byte [edx + ebp + 2], 0
mov byte [edx + ebp + 7], 0
mov edx, ecx
xor eax, eax
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
mov ax, word [ecx + 0xe]
pop ebp
cmp ebx, eax
pop ebx
je 0x10045edd
add esp, 0x20
mov dword [esp + 4], 0xcdee
jmp fcn.1007d9d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
mov dword [esp + 4], 0xcddd
jmp fcn.1007d9d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
mov dword [esp + 4], 0xcdd1
jmp fcn.1007d9d0
xor eax, eax
add esp, 0x20
ret
Function at 0x1004dc70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x1004dc9c
mov ecx, dword [esp + 8]
push ebx
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx]
mov bl, byte [edx + 0x10080fd8]
lea edx, [eax*8]
xor ebx, edx
xor eax, ebx
inc ecx
dec esi
jne 0x1004dc80
pop ebx
pop esi
ret
Function at 0x1005b740
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x1005b753
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebp, dword [esp + 0x14]
push 8
push ebp
call fcn.100299e0
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
jne 0x1005b771
pop edi
pop esi
pop ebp
pop ebx
ret
mov cl, byte [esp + 0x1c]
mov eax, dword [ebx]
test cl, 1
mov dword [edi], eax
jne 0x1005b78f
mov ecx, dword [ebx]
mov eax, 1
cmp ecx, eax
jle 0x1005b78f
add eax, eax
cmp eax, ecx
jl 0x1005b789
lea eax, [eax + eax*2]
shl eax, 3
push eax
push ebp
call fcn.100299e0
mov esi, eax
add esp, 8
test esi, esi
mov dword [edi + 4], esi
jne 0x1005b7b9
push edi
push ebp
call fcn.10029770
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edi, dword [ebx + 4]
xor ebx, ebx
cmp dword [ecx], 0
jle 0x1005b826
mov edx, dword [esp + 0x1c]
mov eax, dword [edi]
push edx
push eax
push ebp
call fcn.1005b400
mov dword [esi], eax
mov eax, dword [edi + 4]
push eax
push ebp
call fcn.1003c090
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
push ecx
push ebp
call fcn.1003c090
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
mov dl, byte [edi + 0xc]
and al, 0xfe
mov byte [esi + 0xc], dl
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x10]
add esp, 0x1c
xor ecx, eax
add esi, 0x18
and ecx, 2
add edi, 0x18
xor ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esi - 8], ecx
mov edx, dword [edi - 4]
mov dword [esi - 4], edx
mov ecx, dword [eax]
inc ebx
cmp ebx, ecx
jl 0x1005b7c7
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1028d40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 8

Function at 0x1028d70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1028da0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c0]
push esi
call ecx
xor eax, eax
test esi, esi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x102cf70
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x260]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push eax
call ecx
mov esi, eax
test esi, esi
je 0x102cfcc
cmp esi, 0xffffffff
je 0x102cfcc
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 0x25c]
push ebx
lea edx, [ebp + 0xc]
push edx
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push esi
call ecx
test eax, eax
je 0x102cfc3
mov ebx, 1
mov edx, dword [edi + 0x1c0]
push esi
call edx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x102d4c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x102d508
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x102d507
mov ecx, 1
cmp edi, ecx
jbe 0x102d504
movzx eax, byte [ebp + 0x10]
cdq
push ebx
mov ebx, 0xff
idiv ebx
lea eax, [esi + 1]
or esi, 0xffffffff
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
inc ecx
xor byte [eax], bl
inc eax
cmp ecx, edi
jb 0x102d4f1
mov esi, dword [ebp + 8]
pop ebx
xor byte [esi], 0xac
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x102d520
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x102d563
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102d563
xor byte [esi], 0xac
lea ecx, [eax - 1]
test ecx, ecx
jbe 0x102d563
movzx eax, byte [ebp + 0x10]
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x102d553
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x102dbf0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push edi
push 0x15
push 8
xor edi, edi
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x102dc54
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
lea ecx, [ebp + 8]
push ecx
push edi
push esi
push 0x102da80
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push edi
push edi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x102dc48
cmp edi, 0xffffffff
jne 0x102dc56
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x102e5d0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x102e5e2
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp esi, 8
jb 0x102e6a4
mov edi, esi
shr edi, 3
push ebx
lea esp, [esp]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
inc ecx
sub esi, 8
sub edi, 1
jne 0x102e600
pop ebx
test esi, esi
je 0x102e6c7
jmp 0x102e6b0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edx + edi*4]
inc ecx
sub esi, 1
jne 0x102e6b0
pop edi
not eax
pop esi
pop ebp
ret 0x10
Function at 0x102e950
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
jge 0x102e966
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
mov eax, esi
cdq
and edx, 3
add eax, edx
push ebx
sar eax, 2
xor ebx, ebx
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jle 0x102e98a
mov dl, byte [edi]
cmp dl, byte [ecx + edi]
jne 0x102e9b6
inc ecx
cmp ecx, eax
jl 0x102e980
xor eax, eax
test esi, esi
jle 0x102e99d
mov cl, byte [edi]
cmp cl, byte [eax + edi]
je 0x102e998
inc ebx
inc eax
cmp eax, esi
jl 0x102e992
mov eax, esi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp ebx, eax
jge 0x102e9b6
pop edi
pop ebx
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
test esi, esi
jle 0x102e9f1
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 0x14]
mov edx, dword [esi + 4]
movzx ebx, byte [edi]
mov eax, dword [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
shl eax, 8
mov ebx, eax
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
xor edx, dword [eax + ecx*8 + 4]
inc edi
sub dword [ebp + 0x10], 1
mov dword [esi], ebx
mov dword [esi + 4], edx
jne 0x102e9c0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x102ea00
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor eax, eax
xor edx, edx
test ecx, ecx
jle 0x102ea45
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
lea esp, [esp]
movzx ebx, byte [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
xor edx, dword [edi + ecx*8 + 4]
shl eax, 8
xor eax, dword [edi + ecx*8]
inc esi
sub dword [ebp + 0x10], 1
jne 0x102ea20
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x102ee40
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov eax, 0xffff
test edx, edx
jbe 0x102ee82
push esi
mov esi, dword [ebp + 8]
push edi
jmp 0x102ee60
movzx edi, byte [ecx + esi]
xor edi, eax
shr ax, 8
and edi, 0xff
xor ax, word [edi*2 + 0x117f258]
inc ecx
movzx eax, ax
cmp ecx, edx
jb 0x102ee60
pop edi
pop esi
pop ebp
ret 8

Function at 0x10319f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [eax + ecx + 0x18]
mov edi, eax
sub edi, edx
cmp edi, esi
jae 0x1031a48
movzx ecx, word [ecx + 6]
lea edi, [ecx + ecx*4]
add edi, edi
add edi, edi
add edi, edi
sub edi, edx
add edi, eax
cmp edi, esi
jae 0x1031a48
xor esi, esi
test ecx, ecx
jbe 0x1031a48
mov edi, dword [ebp + 8]
nop
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x1031a40
mov ebx, dword [eax + 8]
add ebx, edx
cmp edi, ebx
jb 0x1031a4a
inc esi
add eax, 0x28
cmp esi, ecx
jb 0x1031a30
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10