joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024870
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0xb6
push eax
mov word [ebp - 0xbc], ax
xor ebx, ebx
lea eax, [ebp - 0xba]
mov dword [ebp - 0xcc], 0x43005f
push eax
mov dword [ebp - 0xc8], 0x6d006f
mov dword [ebp - 0xc4], 0x61004d
mov dword [ebp - 0xc0], 0x5f0070
call fcn.1006ff30
push esi
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.1006e675
add esp, 0x18
lea eax, [ebp - 0xcc]
push eax
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0xd8], eax
test eax, eax
je 0x10024a2d
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x10024a21
mov ecx, edi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10024920
sub ecx, edx
cmp ecx, 8
jae 0x10024935
xor eax, eax
jmp 0x10024a2f
push 1
push edi
lea eax, [ebp - 0xd0]
mov word [ebp - 0xd0], bx
push 2
push eax
call fcn.1006e5d1
lea esi, [edi + 1]
add esp, 0x10
test esi, esi
je 0x10024997
mov ecx, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10024960
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xd4], eax
cmp eax, 0x3fffffff
jle 0x1002497d
xor esi, esi
jmp 0x10024997
add eax, eax
call fcn.1006f880
mov eax, esp
push 3
push dword [ebp - 0xd4]
push esi
push eax
call fcn.10023c70
mov esi, eax
lea eax, [ebp - 0xd0]
push str.1234_
push eax
call fcn.1006e4f5
add esp, 8
test eax, eax
jne 0x100249b7
push esi
call fcn.10024140
jmp 0x10024a15
lea eax, [ebp - 0xd0]
push 0x1009be44
push eax
call fcn.1006e4f5
add esp, 8
test eax, eax
jne 0x100249d7
push esi
call fcn.100240e0
jmp 0x10024a15
lea eax, [ebp - 0xd0]
push 0x1009be48
push eax
call fcn.1006e4f5
add esp, 8
test eax, eax
jne 0x100249f7
push esi
call fcn.10024080
jmp 0x10024a15
lea eax, [ebp - 0xd0]
push 0x1009be4c
push eax
call fcn.1006e4f5
add esp, 8
test eax, eax
jne 0x10024a1a
push esi
call fcn.10023ff0
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea esp, [ebp - 0xe4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
Function at 0x10024c00
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f8
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0xb6
push eax
mov word [ebp - 0xbc], ax
lea eax, [ebp - 0xba]
push eax
mov dword [ebp - 0x8f8], edi
mov dword [ebp - 0xcc], 0x43005f
mov dword [ebp - 0xc8], 0x6d006f
mov dword [ebp - 0xc4], 0x61004d
mov dword [ebp - 0xc0], 0x5f0070
call fcn.1006ff30
add esp, 0xc
test ebx, ebx
jne 0x10024c70
xor eax, eax
jmp 0x10024cba
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10024c75
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jg 0x10024cb2
lea eax, [edi + edi]
call fcn.1006f880
mov esi, esp
test esi, esi
je 0x10024cb2
push edi
push esi
push 0xffffffffffffffff
xor eax, eax
push ebx
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x10024cb4
xor eax, eax
mov edi, dword [ebp - 0x8f8]
push eax
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.1006e675
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x10024d59
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x10024d59
push 0x824
lea eax, [ebp - 0x8f3]
mov byte [ebp - 0x8f4], 0
push 0
push eax
call fcn.1006ff30
push ebx
lea eax, [ebp - 0x8f4]
push 0x825
push eax
call fcn.1006dcec
push edi
lea eax, [ebp - 0x8f4]
push 0x825
push eax
call fcn.1006dd41
lea eax, [ebp - 0x8f4]
push eax
push 0x1000
push esi
call fcn.1006dcec
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea esp, [ebp - 0x904]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret

Function at 0x10025060
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov dword [0x1013ddbc], 1
test esi, esi
je 0x10025085
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x10025170
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xec]
push edi
mov edi, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ebx, dword [ebp - 0xd4]
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
shr ebx, 0x14
call fcn.1006ff30
mov eax, dword [ebp - 0xe4]
shr eax, 0x14
push eax
lea eax, [ebp - 0xcc]
push 0x1009be08
push eax
call fcn.10029d10
lea ecx, [ebp - 0xcc]
add esp, 0x18
mov eax, ecx
sub edi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x100251e5
push ebx
lea eax, [ebp - 0xcc]
push 0x1009be08
push eax
call fcn.10029d10
lea eax, [ebp - 0xcc]
add esp, 0xc
mov ecx, eax
sub esi, ecx
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [esi + eax - 2], cx
test cx, cx
jne 0x10025214
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
Function at 0x10027560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x100275d0
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x100275d0
call fcn.10023da0
mov esi, eax
jmp 0x10027689
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100275f3
call fcn.10023da0
jmp 0x1002767c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x10027608
call fcn.10023da0
jmp 0x1002767c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x10027620
mov esi, 0x8007000e
jmp 0x1002767e
push eax
lea ecx, [ebp - 0x408]
call fcn.10023b40
cmp dword [ebp - 0x408], 0
jne 0x1002763c
mov esi, 0x8007000e
jmp 0x1002767e
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1002765c
call fcn.10023da0
jmp 0x1002767c
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.10027400
mov esi, eax
test edi, edi
je 0x10027689
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x100276a2
lea ecx, [ebp - 0x408]
call fcn.100250e0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10028460
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x10028479
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10028485
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x10028480
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100284c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x100284d5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x100284e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100284e0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10028510
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10023fc0
push 0
push 0
call fcn.1006f19c
add esp, 0x18
ret
Function at 0x10028c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a4
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x1c]
xor eax, eax
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.1006ff30
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x194], ax
lea eax, [ebp - 0x192]
push eax
call fcn.1006ff30
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10025170
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x5a4], ax
lea eax, [ebp - 0x5a2]
push eax
call fcn.1006ff30
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x39c], ax
lea eax, [ebp - 0x39a]
push eax
call fcn.1006ff30
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x5a4]
push eax
call fcn.10025240
add esp, 0x40
cmp word [esi], 0
jne 0x10028d2e
xor ecx, ecx
jmp 0x10028d42
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10028d33
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x100bd098
call fcn.10029a20
push 0x11e8
call fcn.1006daa9
mov esi, eax
add esp, 4
test esi, esi
je 0x10028de8
push 0x11e8
push 0
push esi
call fcn.1006ff30
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x11e4], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esi + 0x1114], eax
lea eax, [esi + 4]
push 0x888
push eax
mov dword [esi], ecx
call fcn.1006e6e1
push ebx
lea eax, [esi + 0x111c]
push 0x64
push eax
call fcn.1006e6e1
mov eax, dword [ebp + 0x14]
add esp, 0x24
mov dword [esi + 0x1118], eax
push edi
call fcn.100245c0
test eax, eax
jne 0x10028de2
push eax
push eax
push esi
push 0x10028080
push eax
push eax
call fcn.1006f19c
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret 0x1c
push esi
call fcn.10028280
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10034a50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, 2
movdqu xmmword [ebp - 0x14], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov word [ebp - 0x12], ax
call ebx
push esi
cmp eax, 0xffffffff
jne 0x10034aca
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10034b1a
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x10034b1a
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10034ac9
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call ebx
push 6
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10034b1a
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x4e20
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10034b2d
mov ecx, edi
call fcn.10034b50
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret

Function at 0x10034b50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x10034bca
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x8004667e
push dword [edi]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push 0xffffff7f
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x80
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10039580
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2988
call fcn.1006f8b0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2988]
mov ecx, 0xa62
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0
push 0x64
call fcn.1006daa9
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x100395d2
xor eax, eax
jmp 0x10039783
push 0x64
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.1006ff30
add esp, 0xc
mov dword [ebp - 0x28ac], 0x2880
lea eax, [ebp - 0x28ac]
push eax
lea ecx, [ebp - 0x28a0]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x28b8], eax
cmp dword [ebp - 0x28b8], 0
jne 0x10039780
lea eax, [ebp - 0x28a0]
mov dword [ebp - 0x28c4], eax
cmp dword [ebp - 0x28c4], 0
je 0x10039780
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x28c4]
movzx eax, byte [edx + ecx + 0x194]
test eax, eax
jne 0x100396cf
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0x28c4]
movzx edx, byte [ecx + eax + 0x194]
test edx, edx
jne 0x100396cf
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 0x28c4]
movzx edx, byte [ecx + eax + 0x194]
test edx, edx
jne 0x100396cf
mov eax, 1
imul ecx, eax, 3
mov edx, dword [ebp - 0x28c4]
movzx eax, byte [edx + ecx + 0x194]
test eax, eax
jne 0x100396cf
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0x28c4]
movzx edx, byte [ecx + eax + 0x194]
test edx, edx
jne 0x100396cf
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0x28c4]
movzx eax, byte [edx + ecx + 0x194]
test eax, eax
jne 0x100396cf
jmp 0x1003976d
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0x28c4]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 2
mov edx, dword [ebp - 0x28c4]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp - 0x28c4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 1
mov eax, dword [ebp - 0x28c4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 0x28c4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x28c4]
movzx edx, byte [ecx + eax + 0x194]
push edx
push str._02X__02X__02X__02X__02X__02X
push 0x32
mov eax, dword [ebp - 0x18]
push eax
call fcn.1007006a
add esp, 0x24
jmp 0x10039780
mov eax, dword [ebp - 0x28c4]
mov ecx, dword [eax]
mov dword [ebp - 0x28c4], ecx
jmp 0x1003961e
mov eax, dword [ebp - 0x18]
push edx
mov ecx, ebp
push eax
lea edx, [0x100397b4]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x2988
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret
Function at 0x100397f0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d30
call fcn.1006f8b0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2d30]
mov ecx, 0xb4c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
jne 0x1003982e
xor eax, eax
jmp 0x10039a1c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x24], 0
jmp 0x1003984e
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x10
jge 0x10039a19
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x24]
push eax
push str..PhysicalDrive_d
lea ecx, [ebp - 0x138]
push ecx
call fcn.10011aa0
add esp, 0xc
mov esi, esp
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x10039a14
mov dword [ebp - 0x158], 0
mov byte [ebp - 0x2870], 0
push 0x270f
push 0
lea eax, [ebp - 0x286f]
push eax
call fcn.1006ff30
add esp, 0xc
push 0xc
push 0
lea eax, [ebp - 0x14c]
push eax
call fcn.1006ff30
add esp, 0xc
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
push 0x2710
push 0
lea eax, [ebp - 0x2870]
push eax
call fcn.1006ff30
add esp, 0xc
mov esi, esp
push 0
lea eax, [ebp - 0x158]
push eax
push 0x2710
lea ecx, [ebp - 0x2870]
push ecx
push 0xc
lea edx, [ebp - 0x14c]
push edx
push 0x2d1400
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x10039a01
lea eax, [ebp - 0x2870]
mov dword [ebp - 0x287c], eax
mov byte [ebp - 0x2c6c], 0
push 0x3e7
push 0
lea eax, [ebp - 0x2c6b]
push eax
call fcn.1006ff30
add esp, 0xc
lea eax, [ebp - 0x2c6c]
push eax
push 1
mov ecx, dword [ebp - 0x287c]
mov edx, dword [ecx + 0x18]
push edx
lea eax, [ebp - 0x2870]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10039ad0
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x2c6c]
push edx
call fcn.10070a7c
add esp, 4
test eax, eax
jne 0x100399cd
mov eax, 1
imul ecx, eax, 0x13
movsx edx, byte [ebp + ecx - 0x2c6c]
push edx
call fcn.10070a7c
add esp, 4
test eax, eax
je 0x10039a01
lea eax, [ebp - 0x2c6c]
push eax
push 0x3e9
mov ecx, dword [ebp + 8]
push ecx
call fcn.1006dcec
add esp, 0xc
mov dword [ebp - 0x18], 1
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100705ff
jmp 0x10039a19
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100705ff
jmp 0x10039845
mov eax, dword [ebp - 0x18]
push edx
mov ecx, ebp
push eax
lea edx, [0x10039a50]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x2d30
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b4f0
Capabilities:
Patch process command line

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x13c]
mov ecx, 0x4f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x18], eax
mov esi, esp
push str.NtQueryInformationProcess
mov edi, esp
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1003b583
mov esi, esp
push 0
push 0x18
lea eax, [ebp - 0x6c]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [ebp - 0x4c]
cmp esi, esp
call fcn.100705ff
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
jmp 0x1003b58a
xor eax, eax
jmp 0x1003b63d
mov eax, dword [ebp - 0x24]
add eax, 0x10
mov dword [ebp - 0x78], eax
mov esi, esp
push 0
push 4
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003b5bd
xor eax, eax
jmp 0x1003b63d
mov eax, dword [ebp - 0x30]
add eax, 0x40
mov dword [ebp - 0x78], eax
mov esi, esp
push 0
push 8
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003b5ed
xor eax, eax
jmp 0x1003b63d
mov eax, dword [ebp + 0xc]
shl eax, 1
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.1006ff30
add esp, 0xc
movzx eax, word [ebp - 0x40]
cmp dword [ebp + 0xc], eax
jae 0x1003b60e
xor eax, eax
jmp 0x1003b63d
mov esi, esp
push 0
movzx eax, word [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003b638
xor eax, eax
jmp 0x1003b63d
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x1003b670]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x13c
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 8