joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [ebp - 0x14], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4107d9
xor eax, eax
jmp 0x410867
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4107d2
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x14], eax
je 0x410858
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x410858
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00405434
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x41086e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
xor ebx, ebx
sub esp, 0x40
lea eax, [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne 0x410915
mov edi, dword [ebp + 0x18]
mov al, bl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
not ecx
dec ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0xc]
sete bl
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push edx
lea esp, [ebp - 8]
mov al, bl
pop ebx
pop edi
pop ebp
ret
Function at 0x41091e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4109d6
mov eax, dword [ebp - 0x24]
lea edi, [ebp - 0x20]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4109ca
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 0x20], eax
jae 0x4109ca
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete bl
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ecx
lea esp, [ebp - 0xc]
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4109e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
sub esp, 0x34
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x410a3e
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
mov eax, dword [ebp - 0xc]
push ebx
push ebx
sete bl
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov al, bl
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x410a45
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x27c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0x21c]
cmp byte [edx], 0
je 0x410a84
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.0040afa3
jmp 0x410a98
mov dword [esp + 8], 0x204
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040ad48
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteKeyA
mov dl, 1
push ecx
test eax, eax
push ecx
je 0x410bb4
lea eax, [ebp - 0x264]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x410ae8
cmp eax, 2
jmp 0x410b65
lea edi, [ebp - 0x260]
mov dword [ebp - 0x260], 0x40
lea esi, [ebp - 0x25c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov eax, dword [ebp - 0x264]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
test eax, eax
je 0x410b6a
mov eax, dword [ebp - 0x264]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteKeyA
push edx
test eax, eax
push edx
sete dl
jmp 0x410bb4
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00410a45
test al, al
je 0x410b43
mov dword [ebp - 0x260], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
jmp 0x410b22
lea esp, [ebp - 0xc]
mov al, dl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410bbe
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xcc
lea eax, [ebp - 0xa0]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
xor edx, edx
sub esp, 0x14
test eax, eax
jne 0x410cc2
mov dword [ebp - 0x9c], 0x40
xor ebx, ebx
lea edi, [ebp - 0x9c]
lea esi, [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
cmp eax, 0x103
je 0x410cb1
lea edx, [ebp - 0x58]
inc ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x41483e
mov dword [esp + 4], 0x40
mov dword [esp], edx
mov dword [ebp - 0xac], edx
call fcn.0040afa3
test eax, eax
jle 0x410ca2
mov dword [esp + 8], eax
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00411fcc
mov dword [ebp - 0x9c], 0x40
jmp 0x410c1b
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
mov dl, 1
push ebx
lea esp, [ebp - 0xc]
mov al, dl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x411cb3
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
ret

Function at 0x4120bc
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.0040b1ee
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4148fc
mov dword [esp], eax
call fcn.0040ad48
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test eax, eax
mov ebx, eax
push ecx
push ecx
je 0x412174
lea edi, [ebp - 0x140]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x140], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
push edx
push edx
je 0x41216b
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x138], eax
jne 0x41215d
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.0040ad48
jmp 0x41216b
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
jmp 0x412131
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4019a4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00401e6a
jmp 0x401a6b
mov dh, byte ss:[eax + ebp - 0x400]
jmp 0x401b18
add cl, dl
jmp 0x401abd
je 0x4019e8
jmp 0x401a86
xor ecx, ecx
jmp 0x401a90
jmp 0x401a5e
jmp 0x401b05
mov esi, dword [ebp + 0x10]
jmp 0x401a4d
jne 0x401a03
jmp 0x401a9e
dec esi
jmp 0x401a60
inc bl
jmp 0x401b25
jmp 0x401ab0
mov ecx, 0x40
jmp 0x401a03
mov esi, dword [ebp + 0xc]
jmp 0x401a49
jmp 0x401ae5
mov byte ss:[eax + ebp - 0x400], dl
jmp 0x401a72
add al, byte [ebx + edi]
jmp 0x401a64
xor edx, edx
jmp 0x4019df
mov dl, byte ss:[ecx + ebp - 0x400]
jmp 0x401a23
cld
jmp 0x401b0c
jne 0x401ac7
jmp 0x401a44
mov edi, dword [ebp + 0x14]
jmp 0x4019ed
jmp 0x401a14
test edi, edi
jmp 0x4019d8
mov byte ss:[eax + ebp - 0x400], dl
jmp 0x4019d1
jmp 0x4019fc
je 0x401ac9
jmp 0x401a14
add al, dl
jmp 0x4019c4
mov eax, 0xfffefdfc
jmp 0x401a08
inc cl
jmp 0x401a3c
mov edi, dword [ebp + 8]
jmp 0x401ac9
sub eax, 0x4040404
jmp 0x401a8a
xor byte [esi], cl
jmp 0x401aba
xor eax, eax
jmp 0x401a28
dec ecx
jmp 0x4019f2
xor ebx, ebx
jmp 0x4019e6
xor ebx, ebx
jmp 0x401a0f
xor eax, eax
jmp 0x401a76
add al, dl
jmp 0x401aa6
mov cl, byte ss:[eax + ebp - 0x400]
jmp 0x401af0
jmp 0x401ad2
jne 0x4019e6
jmp 0x401aec
inc esi
jmp 0x401b09
mov cl, byte ss:[ecx + ebp - 0x400]
jmp 0x401a82
jmp 0x401b07
jmp 0x401aea
inc bl
jmp 0x4019f9
mov dword [ebp + ecx*4 - 0x404], eax
jmp 0x401a7b
mov ecx, 0x40
jmp 0x401a36
jmp 0x401a2c
jmp 0x401a97
xor eax, eax
jmp 0x401afd
mov byte ss:[ebx + ebp - 0x400], cl
jmp 0x401a51
lea edi, [ebp - 0x400]
jmp 0x401adb
jmp 0x401b13
jmp 0x401acb
dec edi
jmp 0x401ab2
rep stosd dword es:[edi], eax
jmp 0x4019e8
popal
leave
ret 0x10
mov byte ss:[ecx + ebp - 0x400], dh
jmp 0x401a19
mov dl, byte ss:[ebx + ebp - 0x400]
jmp 0x401aa2

Function at 0x401c7d
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edi
push esi
mov dword [ebp - 4], 0xa
cmp dword [ebp + 0x14], 0
je 0x401c9d
push 0xffffffffffffffff
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x401ce6
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.00401e30
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401cec
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x401cec
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x401cec
cmp dword [ebp + 0x10], 0
jne 0x401ca2
cmp dword [ebp + 0x14], 0
je 0x401cfa
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x401d04
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push edi
push esi
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
call fcn.00401e30
lea edx, [ebp - 8]
cmp dword [ebp + 0x14], 0
jne 0x401d2b
xor edx, edx
push edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401d50
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_recv
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x401d57
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.00401e6a
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.00401e6a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sub.ws2_32.dll_getaddrinfo
or eax, eax
jne 0x401dd6
mov esi, dword [ebp - 0x24]
jmp 0x401dd2
cmp dword [ebp + 0xc], 2
jne 0x401dcf
cmp dword [esi + 4], 2
jne 0x401dcf
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x24]
call sub.ws2_32.dll_freeaddrinfo
jmp 0x401dd6
mov esi, dword [esi + 0x1c]
or esi, esi
jne 0x401dad
mov eax, dword [ebp - 0x42c]
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x402010
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe4c
lea ecx, [ebp]
sub ecx, esp
push ecx
lea eax, [esp + 4]
push eax
call fcn.00401e6a
push 0x2710
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x18e]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x402029
mov dword [ebp - 0x198], 0x404010
lea eax, [ebp - 0x1a0]
push eax
push 0xffffffffffffffff
push 0x404072
call fcn.00401e81
lea eax, [ebp - 0x1a0]
push eax
call fcn.00401dfb
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0x1a4]
push dword [ebp - 0x198]
call fcn.0040141f
test eax, eax
jne 0x4020ae
cmp dword [ebp - 0x198], 0x404010
jne 0x4020a4
mov dword [ebp - 0x198], 0x404041
jmp 0x4020ae
mov dword [ebp - 0x198], 0x404010
push 0x2bf20
call sub.kernel32.dll_Sleep
jmp 0x402077

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001ab1
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x24c
mov eax, 0x10021c4d
call fcn.10006cd4
and dword [ebp - 4], 0
push 0
push 2
mov dword [ebp - 0x240], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x10001baa
jmp 0x10001b93
and dword [ebp - 0x258], 0
lea eax, [ebp - 0x21c]
and dword [ebp - 0x248], 0
lea ecx, [ebp - 0x258]
push eax
mov dword [ebp - 0x244], 7
call fcn.10003d0d
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov edx, dword [ebp - 0x248]
lea ecx, [ebp - 0x258]
cmovae eax, dword [ebp + 8]
cmp dword [ebp - 0x244], 8
cmovae ecx, dword [ebp - 0x258]
cmp edx, dword [ebp + 0x18]
jne 0x10001b5d
push edx
push eax
push ecx
call fcn.10001180
add esp, 0xc
test eax, eax
jne 0x10001b5d
mov bl, 1
jmp 0x10001b5f
xor bl, bl
lea ecx, [ebp - 0x258]
call fcn.10003cdf
test bl, bl
je 0x10001b93
push dword [ebp - 0x238]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x10001af6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.10003cdf
call fcn.10006c92
ret
Function at 0x10001f48
Capabilities:
Get storage device properties

Disassembly:
push 0x44
mov eax, 0x10021d81
call fcn.10006cd4
mov edi, ecx
mov dword [ebp - 0x50], edi
xor eax, eax
mov dword [ebp - 0x50], edi
push eax
push eax
push 3
push eax
push 3
push eax
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10001f8d
xor eax, eax
mov dword [edi + 0x14], 0xf
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov byte [edi], al
jmp 0x100020fe
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], fcn.10002106
mov dword [ebp - 0x24], ebx
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x30]
movlpd qword [ebp - 0x30], xmm0
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10001ff0
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], al
mov dword [ebp - 4], 1
jmp 0x100020f3
mov esi, dword [ebp - 0x2c]
push esi
call fcn.100068ef
push esi
push 0
push eax
mov dword [ebp - 0x50], eax
call fcn.10007ea0
mov eax, dword [ebp - 0x50]
add esp, 0x10
mov dword [ebp - 0x4c], eax
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push esi
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x20]
push esi
push 0xc
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002054
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
push esi
mov byte [edi], al
call fcn.10006280
pop ecx
mov dword [ebp - 4], 3
jmp 0x100020f3
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x10002079
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
push esi
mov byte [edi], al
call fcn.10006280
pop ecx
mov dword [ebp - 4], 4
jmp 0x100020f3
xor ecx, ecx
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x48], ecx
add eax, esi
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x48], cl
lea ecx, [ebp - 0x48]
push eax
call fcn.10003ed5
mov byte [ebp - 4], 5
mov ecx, edi
cmp dword [ebp - 0x38], 0
jne 0x100020d4
xor eax, eax
mov dword [edi + 0x14], 0xf
mov dword [edi], eax
mov dword [edi + 0x10], eax
push str.noDriveInfo
mov byte [edi], al
call fcn.10003ed5
lea ecx, [ebp - 0x48]
call fcn.10003e74
push esi
call fcn.10006280
pop ecx
mov dword [ebp - 4], 6
jmp 0x100020f3
lea eax, [ebp - 0x48]
push eax
call fcn.10003800
lea ecx, [ebp - 0x48]
call fcn.10003e74
push esi
call fcn.10006280
pop ecx
mov dword [ebp - 4], 7
test ebx, ebx
je 0x100020fe
push ebx
call fcn.10002106
pop ecx
mov eax, edi
call fcn.10006c92
ret
Function at 0x10002774
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10032050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10033d60], 0
push ebx
mov ebx, dword [ebp + 8]
je 0x100027f2
push esi
push edi
push 0x20
pop ecx
mov esi, 0x10033ce0
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x84]
xor ecx, ecx
sub esi, eax
mov edx, ecx
lea eax, [ebp - 0x84]
add eax, edx
add edx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [esi + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp edx, 0x80
jl 0x100027b5
pop edi
pop esi
cmp dword [ebp + 0xc], ecx
jle 0x100027f2
mov eax, ecx
and eax, 0x7f
mov al, byte [ebp + eax - 0x84]
xor byte [ebx + ecx], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x100027dd
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10006272
leave
ret 0xc

Function at 0x10002c2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10002c54
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000321e
jmp 0x10002d09
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10002c76
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10002c78
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10002cfd
jg 0x10002c8d
test esi, esi
je 0x10002cfd
test ecx, ecx
jl 0x10002ce0
jg 0x10002c97
test eax, eax
je 0x10002ce0
cmp edi, ecx
jg 0x10002cab
jl 0x10002ca1
cmp esi, eax
jae 0x10002cab
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.10007910
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x10002cfd
jg 0x10002ce3
test esi, esi
je 0x10002cfd
jmp 0x10002ce3
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x10002cfd
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1000b1fb
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002d12
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x10002d3c
jl 0x10002d33
test edi, edi
jne 0x10002d3c
xor eax, eax
xor edx, edx
jmp 0x10002dee
cmp dword [ecx + 0x38], 0
je 0x10002d4f
push esi
push edi
push edx
call fcn.100032e5
jmp 0x10002dee
mov eax, dword [ecx + 0x1c]
push ebx
mov ebx, edi
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10002d8f
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10002d8f
cmp dword [eax], edi
mov esi, edi
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.10007910
mov ecx, dword [ebp - 8]
sub ebx, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
mov edx, ebx
je 0x10002de4
call fcn.10003a68
mov edx, ebx
jmp 0x10002dc2
push dword [ecx + 0x4c]
push eax
push 1
push dword [ebp - 4]
call fcn.1000b80f
add dword [ebp - 4], eax
sub ebx, eax
add esp, 0x10
mov edx, ebx
cmp eax, 0xfff
jne 0x10002df4
mov ecx, dword [ebp - 8]
mov eax, 0xfff
cmp ebx, eax
ja 0x10002da0
test edx, edx
je 0x10002de4
push dword [ecx + 0x4c]
push ebx
push 1
push dword [ebp - 4]
call fcn.1000b80f
mov edx, ebx
add esp, 0x10
sub edx, eax
sub edi, edx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x10002de6