joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e59c
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x23
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1002e60a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10038cf0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1002e60a
push dword [ebp + 0x198]
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc ebx
cmp dword [ebp - 0x80], 0
je 0x1002e619
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x18c]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100366e3
add ebp, 0x190
leave
ret 4

Function at 0x1002e633
Capabilities:
Check if file exists

Disassembly:
push 0x674
mov eax, 0x1004e875
call fcn.10037d5a
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x678], esi
mov ebx, edx
mov dword [ebp - 0x680], edi
call fcn.10001eb4
xor esi, esi
mov dword [ebp - 4], edi
inc esi
push edi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x674], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x674]
push eax
push 0x1005459c
push esi
push edi
push 0x10056a44
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1002e7cc
mov eax, dword [ebp - 0x674]
lea edx, [ebp - 0x67c]
push edx
push 0x10056a54
mov dword [ebp - 0x67c], edi
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x1002e7c0
mov eax, dword [ebp - 0x67c]
mov ecx, dword [eax]
push edi
push ebx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x1002e7b4
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10038cf0
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax]
add esp, 0xc
push 4
lea edx, [ebp - 0x670]
push edx
mov esi, 0x104
push esi
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1002e7b4
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x678]
call fcn.100021ca
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002e7b4
call fcn.1002b885
test eax, eax
je 0x1002e7b4
push str.program_files__x86__
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1002e7b4
xor eax, eax
push ebx
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.10038cf0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push str.program_files_
push str.program_files__x86__
mov eax, esi
lea ecx, [ebp - 0x218]
call fcn.1002d61c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002e7b4
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x678]
call fcn.100021ca
mov eax, dword [ebp - 0x67c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x678]
call fcn.10037ddd
ret
Function at 0x1002e8f2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xor esi, esi
push esi
push esi
push 6
push 1
push 2
mov dword [ebp - 0x3c], esi
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x5c], esi
lea edi, [ebp - 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp ebx, 0xffffffff
je 0x1002ea85
mov eax, 0xddf3
mov word [ebp - 0x10], ax
mov eax, 0x4660
push 2
mov word [ebp - 0xe], ax
pop eax
mov word [ebp - 0x34], ax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x14], 0x25a207b9
mov byte [ebp - 0xc], 0x8e
mov byte [ebp - 0xb], 0xe9
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 9], 0xe5
mov byte [ebp - 8], 0x8c
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 6
mov byte [ebp - 5], 0x3e
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x30], eax
call sub.WS2_32.dll_htons
push 0x10
pop edi
mov word [ebp - 0x32], ax
push edi
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1002ea85
push 2
pop eax
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push 0x32e3
mov dword [ebp - 0x20], eax
call sub.WS2_32.dll_htons
push esi
push esi
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x48]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0xc8000006
push ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x1002ea6e
cmp dword [ebp - 0x38], esi
je 0x1002ea6e
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push edi
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [ebp - 0x38]
test eax, eax
jne 0x1002ea12
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1002ea85
push esi
push 0xbb8
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
test eax, eax
je 0x1002ea34
push ebx
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x1002ea85
lea eax, [ebp - 0x44]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1002ea85
push esi
push esi
push 0x7010
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1002ea85
mov dword [ebp - 0x3c], edi
jmp 0x1002ea85
push edi
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1002ea85
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x4c], esi
je 0x1002ea93
push dword [ebp - 0x4c]
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
cmp dword [ebp - 0x3c], esi
jne 0x1002eaa6
cmp ebx, 0xffffffff
je 0x1002eaa6
push ebx
call sub.WS2_32.dll_closesocket
or ebx, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100366e3
leave
ret
Function at 0x1003048c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.10045780
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call fcn.1003056f
test al, al
je 0x10030562
xor eax, eax
mov word [ebp - 0x80c], ax
mov word [ebp - 0x100c], ax
push str.__ls__ls
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1005d074
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2028]
push eax
call fcn.100303b1
cmp dword [eax + 0x18], 8
pop ecx
jb 0x100304fd
mov eax, dword [eax + 4]
jmp 0x10030500
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x100c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push 1
lea esi, [ebp - 0x2028]
call fcn.100021ef
xor eax, eax
mov word [ebp - 0x200c], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x800
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.100366e3
leave
ret

Function at 0x100306bc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
mov edi, str..gxdte_cd
push edi
call esi
cmp eax, 0xffffffff
jne 0x100307a3
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10038cf0
add esp, 0xc
call fcn.10030644
mov ebx, eax
push 0x104
lea eax, [ebp - 0x210]
push eax
xor ecx, ecx
call fcn.1002b6b2
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10030769
cmp word [0x1006d158], ax
je 0x10030769
push 0x1006d158
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.1002b885
mov ebx, str.gxdte64.sys
test eax, eax
jne 0x1003077c
mov ebx, str.gxdte32.sys
call fcn.1002dfa6
push ebx
lea ecx, [ebp - 0x210]
call fcn.10034695
call fcn.1002dec6
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100366e3
leave
ret

Function at 0x10030945
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x10030956
mov eax, dword [eax + 4]
jmp 0x10030959
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1003098c
cmp dword [ebp - 8], 4
jne 0x1003098c
mov eax, dword [ebp - 0xc]
leave
ret
xor eax, eax
leave
ret
Function at 0x10032d7d
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
xor esi, esi
push edi
cmp dword [0x1006c09c], esi
je 0x10032d9d
push esi
push esi
mov dword [0x1006c09c], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0xc]
push eax
push 0x100568b4
xor edi, edi
inc edi
push edi
push esi
push 0x10056984
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x10032dc7
xor eax, eax
jmp 0x10032ea6
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10032e9a
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jl 0x10032e91
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push esi
push 0x30
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov ecx, dword [eax]
push 0x1005d400
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x10032e91
mov dword [ebp - 0x10], edi
push ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0x3c]
push edx
push 0xa
push 0xffffffffffffffff
push eax
xor ebx, ebx
call dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x10032e87
xor edi, edi
cmp dword [ebp + 8], esi
jbe 0x10032e67
push dword [ebp + 0x10]
push dword [ebp + edi*4 - 0x3c]
call dword [ebp + 0xc]
test eax, eax
je 0x10032e64
inc edi
cmp edi, dword [ebp + 8]
jb 0x10032e4e
jmp 0x10032e67
xor ebx, ebx
inc ebx
xor edi, edi
cmp dword [ebp + 8], esi
jbe 0x10032e7e
mov eax, dword [ebp + edi*4 - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc edi
cmp edi, dword [ebp + 8]
jb 0x10032e6e
cmp ebx, esi
jne 0x10032e87
cmp dword [ebp - 0x14], esi
je 0x10032e28
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 0xc

Function at 0x100332a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x100332dd
cmp eax, 3
jne 0x100332f5
push ebx
call fcn.1002bbe4
pop ecx
cmp eax, 0xffffffff
je 0x10033302
cmp eax, 7
jne 0x100332f5
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x10033304
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100366e3
leave
ret
Function at 0x10033511
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1003352b
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10033527
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10033646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1003380c
mov bl, al
mov al, dl
call fcn.1003380c
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1003380c
mov bl, al
mov al, byte [esi - 4]
call fcn.1003380c
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1003380c
mov bl, al
mov al, byte [esi]
call fcn.1003380c
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1003380c
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1003380c
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1003366e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100366e3
leave
ret 4
Function at 0x100336fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10033888
push ebx
mov dl, al
call fcn.10033861
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1003381c
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1003383a
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1003381c
push ebx
mov byte [ebp - 0x15], al
call fcn.1003383a
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10033861
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10033888
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10033861
mov bl, al
mov al, byte [edi + 4]
call fcn.10033888
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1003383a
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1003381c
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1003383a
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1003381c
xor bl, al
mov al, dl
call fcn.10033888
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10033861
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10033727
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100366e3
leave
ret 4
Function at 0x10033f4c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x1004ddde
call fcn.10037d5a
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10033f6b
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10002438
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x10034070
jmp 0x10033f9c
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10057cb8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10033fb0
cmp al, 0xff
je 0x10033f9c
cmp al, 0xff
je 0x10034070
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10057cb8]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x10033fd0
cmp cl, 0xff
je 0x10033fb8
cmp cl, 0xff
je 0x10034070
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001e540
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x10034070
movsx eax, al
mov al, byte [eax + 0x10057cb8]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x10034010
cmp al, 0xff
je 0x10033ff0
cmp al, 0xff
je 0x10034070
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001e540
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x10034070
movsx eax, al
mov cl, byte [eax + 0x10057cb8]
cmp esi, dword [ebp - 0x30]
jae 0x1003404e
cmp cl, 0xff
je 0x10034030
cmp cl, 0xff
je 0x10034070
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.1001e540
cmp esi, dword [ebp - 0x30]
jb 0x10033f99
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001e60
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100020f3
mov eax, dword [ebp - 0x38]
call fcn.10037ddd
ret

Function at 0x1003416e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.1002ae26
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.1000f27c
test al, al
jne 0x100341cb
call fcn.1000b132
cmp dword [eax + 0x18], 8
jb 0x100341b7
mov eax, dword [eax + 4]
jmp 0x100341ba
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.1000b697
jmp 0x1003418c
lea eax, [ebp - 0x30]
push eax
call fcn.1000d31e
pop edi
pop esi
leave
ret
Function at 0x10034539
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
call fcn.1002bdcf
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10038cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x210]
push eax
call esi
lea edx, [ebp - 0x210]
call fcn.1003416e
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100345e8
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x10034679
push edi
lea ecx, [ebp - 0x210]
call fcn.1002b403
test eax, eax
jne 0x10034677
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
test eax, eax
jne 0x10034677
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.10034148
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
pop ecx
jae 0x10034639
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x10034664
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x10034667
push 9
pop edi
push ebx
push 1
lea esi, [ebp - 0x22c]
call fcn.100021ef
jmp 0x10034679
xor edi, edi
push dword [ebp - 0x230]
call fcn.1002be0f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100366e3
leave
ret

Function at 0x10034f02
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x1003610a
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x1003628e
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x1003629d
push 0x40
pop esi
cmp edx, esi
jae 0x10036318
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x100362de
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x10057b60]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x10036349
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret