joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10117040
Capabilities:
Get disk information via ioctl

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x46c
push ebx
push esi
push str.Floppy
push eax
call fcn.10034330
add esp, 8
test eax, eax
mov eax, dword [esp + 0x47c]
setne cl
sub eax, 2
je 0x10117085
dec eax
je 0x1011708e
sub eax, 2
je 0x1011707e
pop esi
xor eax, eax
pop ebx
add esp, 0x46c
ret
mov ebx, 0x10227d98
jmp 0x10117093
test cl, cl
mov ebx, 0x10227df8
jne 0x10117093
mov ebx, 0x10227d88
push 0x12
push 0
push 0
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x101170b2
pop esi
xor eax, eax
pop ebx
add esp, 0x46c
ret
push ebp
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov dword [esp + 0x10], 0
mov dword [esp + 0x60], eax
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
lea ecx, [esp + 0x60]
push ecx
push edx
push ebx
push 0
push esi
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x44]
push eax
push ecx
push ebx
push 0
push esi
call edi
lea edx, [esp + 0x14]
push 0
push edx
push 0
lea eax, [esp + 0x50]
push 0
push eax
push esi
mov dword [esp + 0x2c], 0
call ebp
mov edx, dword [esp + 0x14]
test edx, edx
je 0x101171d2
cmp edx, 0x400
ja 0x101171d2
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x7c], 5
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x14]
push ecx
push eax
push edx
lea ecx, [esp + 0x88]
lea edx, [esp + 0x50]
push ecx
push edx
push esi
mov dword [esp + 0x40], 0x1c
call ebp
test eax, eax
je 0x101171d2
push 0
push 0
push 3
push 0
push 3
lea eax, [esp + 0x94]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x101171d2
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push 0
push 0
push 0x2d1080
push edi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x101171cb
mov eax, dword [esp + 0x480]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
je 0x101171db
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x10]
jmp 0x101170dc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x46c
ret
Function at 0x1011cac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x1011cb0e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1011cb0e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x1011cb13
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x1011caf9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x1011cb23
test esi, esi
jne 0x1011cb41
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1011cb3f
mov byte [eax + esi - 1], 0
jne 0x1011cb48
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x101222a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x101222f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x101222f0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x101222f5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x101222db
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10122302
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x10138d80
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x102481bc]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x10138d97
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x10138dd8
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x10248264]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x10138e0c
mov cl, byte [esp + edx + 0x50]
jmp 0x10138e10
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x10138e01
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x10138e2e
mov cl, byte [esp + edx + 0x50]
jmp 0x10138e32
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x10138e23
xor edx, edx
mov eax, 0x102481cc
xor ecx, ecx
mov cl, byte [edx + 0x10248274]
cmp byte [esp + ecx + 0x18], 0
je 0x10138e5d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x1024828c]
cmp byte [esp + ecx + 0x18], 0
je 0x10138e74
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x10138e44
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10138dcb
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.10138ec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x10139670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ef200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x10294024
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], edi
call fcn.101d2c95
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
push eax
mov ecx, ebx
call fcn.101d2c95
mov ecx, ebx
call fcn.101cbbbd
mov ecx, ebx
call fcn.101cbac6
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x30]
test eax, eax
jne 0x10139702
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push 0
push edi
mov dword [esi + 0x2c], 1
mov dword [ebp - 4], 0
call fcn.1013e4b0
mov ecx, dword [esi + 4]
call fcn.1013e6a0
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 8], eax
call fcn.1013edd0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1013cbe0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101ef5a0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.10052d40
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.10052d40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x1079ca94]
test eax, eax
je 0x1013cc98
cmp ebp, eax
jne 0x1013cc98
mov eax, dword [0x1079ca98]
test eax, eax
je 0x1013cc98
cmp ebx, eax
jb 0x1013cc98
add eax, 0x493e0
cmp eax, ebx
jb 0x1013cc98
mov ebp, dword [0x1079ca9c]
push 1
inc ebp
push 0x1079c9b0
lea ecx, [esp + 0x18]
mov dword [0x1079ca9c], ebp
call fcn.100d7a60
push 0x1079c9e0
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.10052f90
push 0x1079c9d0
mov ecx, edi
call fcn.10052f90
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1013cd0e
push edi
push esi
mov dword [0x1079ca9c], 0
call fcn.1013d010
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x1079c9b0
call fcn.100d7a60
push 0xffffffffffffffff
push 0
mov ecx, 0x1079c9e0
mov dword [esp + 0x38], 1
mov dword [0x1079ca94], ebp
mov dword [0x1079ca98], ebx
call fcn.10052d40
push esi
mov ecx, 0x1079c9e0
call fcn.10052f90
push 0xffffffffffffffff
push 0
mov ecx, 0x1079c9d0
call fcn.10052d40
push edi
mov ecx, 0x1079c9d0
call fcn.10052f90
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.100d7ac0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1013d010
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101ef606
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.10052d40
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.10052d40
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1013d149
mov edx, dword [0x10268f14]
mov cx, word [0x10268f18]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.1004b6f0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100533d0
mov edx, dword [0x1022a194]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.1004c240
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100533d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.1004bf60
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.1004bf60
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1013d06b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x1013e8c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
push ebp
lea edi, [esi + 0xec]
mov ecx, edi
call fcn.10144620
test al, al
jne 0x1013e8e1
pop edi
pop esi
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.10142a90
cmp eax, 1
jne 0x1013e8f6
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov al, byte [esi + 0xe8]
test al, al
je 0x1013e908
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x20]
call fcn.10143b40
push ebp
mov ecx, edi
call fcn.10144640
mov ecx, dword [esi + 0x114]
call fcn.101425b0
test al, al
je 0x1013e9bf
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1013e93a
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
jbe 0x1013e9ab
mov eax, dword [esi + 0xc]
mov cl, byte [edi + eax]
mov eax, dword [esi + 0x14]
mov byte [esp + 0x10], cl
mov ecx, esi
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.101414d0
mov edx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edx
mov edx, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.101414d0
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
inc edi
cmp edi, eax
jb 0x1013e958
mov ecx, esi
call fcn.10141250
test al, al
jne 0x1013e9bf
push 0xffffffffffffff94
mov ecx, esi
call fcn.1013e560
mov eax, dword [esi + 0x114]
mov di, word [eax + 0xe]
test di, di
je 0x1013e9dd
cmp di, 8
je 0x1013e9e3
push 0xffffffffffffff9b
mov ecx, esi
call fcn.1013e560
cmp di, 8
jne 0x1013ea1a
mov al, byte [esi + 4]
test al, al
je 0x1013e9f2
lea eax, [esi + 0xcc]
jmp 0x1013e9f4
xor eax, eax
push 0x38
push str.1.1.4
lea ecx, [esi + 0x28]
push 0xfffffffffffffff1
push ecx
mov dword [esi + 0x50], eax
call fcn.10133f90
test eax, eax
je 0x1013ea1a
cmp eax, 2
je 0x1013ea1a
push eax
mov ecx, esi
call fcn.1013e560
mov ecx, dword [esi + 0x114]
mov edx, dword [ecx + 0x18]
mov dword [esi + 0x64], edx
call fcn.101425b0
test al, al
je 0x1013ea33
add dword [esi + 0x64], 0xfffffff4
mov eax, dword [esi + 0x114]
pop edi
mov ecx, dword [eax + 0x1c]
mov dword [esi + 0x68], 0
mov dword [esi + 0x60], ecx
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe8], 0xff
pop esi
mov al, 1
pop ebp
ret 4
Function at 0x1013ef80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ef7fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
cmp byte [edi + 0xe8], 0xff
je 0x1013efcb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp + 0xc]
mov esi, 1
test al, al
mov dword [ebp - 0x14], esi
jne 0x1013f10a
mov eax, dword [edi + 0x60]
test eax, eax
jne 0x1013f07a
mov eax, dword [edi + 0x114]
mov ecx, dword [edi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x1013f081
lea ecx, [edi + 0x78]
call fcn.10142d40
cmp eax, 0xffffffff
jne 0x1013f023
push 0x10294024
lea ecx, [ebp - 0x1c]
call fcn.101d2b7a
mov ebx, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
jmp 0x1013f03d
mov ecx, dword [edi + 0x94]
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ebx, 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], esi
mov eax, dword [eax]
push eax
push 0xffffffffffffff9a
call fcn.10145b90
add esp, 8
mov dword [ebp - 4], 0
test bl, 2
je 0x1013f064
and ebx, 0xfffffffd
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x18], ebx
call fcn.101d2b0c
test bl, 1
mov dword [ebp - 4], 0xffffffff
je 0x1013f081
lea ecx, [ebp - 0x1c]
call fcn.101d2b0c
jmp 0x1013f081
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [edi + 0x114]
cmp word [eax + 0xe], 8
jne 0x1013f097
lea ecx, [edi + 0x28]
push ecx
call fcn.10133f40
mov esi, dword [ebp + 8]
test esi, esi
je 0x1013f10a
lea edx, [ebp + 0xc]
mov dword [ebp - 4], 2
push edx
call fcn.101cbeaf
mov eax, dword [eax]
mov ecx, dword [edi + 0x114]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 0x124], 0
push eax
call fcn.10141f60
mov ecx, dword [eax]
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x130], ecx
call fcn.101d8bd0
mov eax, dword [edi + 0x114]
mov eax, dword [eax + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1013f103
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xec]
call fcn.10144700
lea ecx, [edi + 0x6c]
mov byte [edi + 0xe8], 0
call fcn.10143c60
mov eax, dword [edi + 0xd8]
test eax, eax
je 0x1013f157
mov esi, dword [edi + 0xd0]
test esi, esi
je 0x1013f14c
mov eax, esi
mov esi, dword [esi]
mov ecx, dword [eax + 8]
push ecx
call fcn.101d1786
add esp, 4
test esi, esi
jne 0x1013f138
lea ecx, [edi + 0xcc]
call fcn.101ce2c7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1013fa10
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x101ef9cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
mov eax, dword [esp + 0x138]
push ebx
push edi
push eax
lea ecx, [esp + 0xc]
call fcn.101d2b7a
push 0x10267160
lea ecx, [esp + 0xc]
mov dword [esp + 0x13c], 0
call fcn.101cba31
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.1013f590
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x148], 1
call fcn.10146a86
add esp, 0x10
or edi, 0xffffffff
test eax, eax
je 0x1013fb49
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
call fcn.10145f8e
push 0
push esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x144], 2
call fcn.10146051
test eax, eax
jne 0x1013fb09
lea edx, [esp + 0x30]
push 0x104
push edx
call fcn.10148350
add esp, 8
test eax, eax
je 0x1013faf4
push esi
call fcn.101482ca
add esp, 4
test eax, eax
jne 0x1013faf4
lea eax, [esp + 0x30]
push eax
call fcn.101482ca
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 1
call fcn.10145fcb
mov eax, edi
jmp 0x1013fb3b
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 1
call fcn.10145fcb
xor eax, eax
jmp 0x1013fb3b
lea ecx, [esp + 0x14]
call fcn.10146271
mov edx, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [edx + 0x38]
neg eax
sbb eax, eax
lea ecx, [esp + 0x14]
and al, 0xfe
mov byte [esp + 0x13c], 1
inc eax
mov esi, eax
call fcn.10145fcb
mov eax, esi
cmp eax, edi
pop esi
sete al
test al, al
jne 0x1013fb49
xor bl, bl
jmp 0x1013fb4b
mov bl, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], 0
call fcn.101d2b0c
test bl, bl
jne 0x1013fbd6
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.1013f590
mov eax, dword [eax]
mov byte [esp + 0x140], 3
push eax
call fcn.1013fa10
add esp, 0xc
lea ecx, [esp + 0xc]
test al, al
sete bl
mov byte [esp + 0x138], 0
call fcn.101d2b0c
test bl, bl
jne 0x1013fbad
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1013fbd6
lea ecx, [esp + 8]
mov dword [esp + 0x138], edi
call fcn.101d2b0c
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
add esp, 0x134
ret
lea ecx, [esp + 8]
mov dword [esp + 0x138], edi
call fcn.101d2b0c
mov ecx, dword [esp + 0x130]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x134
ret
Function at 0x101403a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0xe8], 1
je 0x101403b2
xor al, al
pop ebx
ret 8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x114]
push ecx
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
push eax
mov eax, dword [esi + 0x14]
push eax
call fcn.101777c0
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
jbe 0x101404fc
push ebp
push edi
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x1014045a
mov ecx, dword [ebx + 0x114]
call fcn.101425b0
test al, al
je 0x10140435
mov eax, dword [ebx + 0x64]
xor ebp, ebp
test eax, eax
jbe 0x10140435
mov esi, dword [ebx + 0x70]
mov edi, dword [ebx + 0x1c]
add esi, ebp
and edi, 0xfffd
or edi, 2
mov cl, byte [esi]
push ecx
mov ecx, ebx
call fcn.101411e0
mov edx, edi
mov al, byte [esi]
xor edx, 1
imul edx, edi
sar edx, 8
xor al, dl
inc ebp
mov byte [esi], al
mov eax, dword [ebx + 0x64]
cmp ebp, eax
jb 0x10140401
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x70]
push 0
push eax
push ecx
lea ecx, [ebx + 0x78]
call fcn.101437b0
mov dword [ebx + 0x64], 0
mov edx, dword [ebx + 0x74]
mov dword [ebx + 0x38], edx
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x34], eax
mov ecx, dword [ebx + 0x114]
cmp word [ecx + 0xe], 8
jne 0x10140495
mov esi, dword [ebx + 0x3c]
lea eax, [ebx + 0x28]
push 0
push eax
call fcn.10132c90
test eax, eax
je 0x10140486
cmp eax, 2
je 0x10140486
push eax
mov ecx, ebx
call fcn.1013e560
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x64]
sub edx, esi
add eax, edx
mov dword [ebx + 0x64], eax
jmp 0x101404ef
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x38]
cmp eax, ecx
jb 0x101404a1
mov eax, ecx
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x34]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x38]
mov ebp, dword [ebx + 0x28]
mov edi, dword [ebx + 0x34]
mov esi, dword [ebx + 0x30]
sub edx, eax
sub ecx, eax
mov dword [ebx + 0x2c], edx
mov edx, dword [ebx + 0x3c]
mov dword [ebx + 0x38], ecx
mov ecx, dword [ebx + 0x64]
add ebp, eax
add edi, eax
add esi, eax
add edx, eax
add ecx, eax
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x64], ecx
mov eax, dword [ebx + 0x2c]
test eax, eax
ja 0x101403e2
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x10140510
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe8], 1
je 0x10140520
xor al, al
pop esi
ret
mov eax, dword [esi + 0x114]
push ebx
mov dword [esi + 0x2c], 0
push ebp
cmp word [eax + 0xe], 8
push edi
jne 0x101405da
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x101405a5
mov ecx, dword [esi + 0x114]
call fcn.101425b0
test al, al
je 0x10140580
mov eax, dword [esi + 0x64]
xor ebp, ebp
test eax, eax
jbe 0x10140580
mov edi, dword [esi + 0x70]
mov ecx, esi
add edi, ebp
call fcn.10141360
mov cl, byte [edi]
mov bl, al
push ecx
mov ecx, esi
call fcn.101411e0
mov dl, byte [edi]
xor dl, bl
inc ebp
mov byte [edi], dl
mov eax, dword [esi + 0x64]
cmp ebp, eax
jb 0x1014055a
mov edx, dword [esi + 0x64]
mov eax, dword [esi + 0x70]
push 0
push edx
push eax
lea ecx, [esi + 0x78]
call fcn.101437b0
mov dword [esi + 0x64], 0
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x38], ecx
mov edx, dword [esi + 0x70]
mov dword [esi + 0x34], edx
mov edi, dword [esi + 0x3c]
lea eax, [esi + 0x28]
push 4
push eax
call fcn.10132c90
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x64]
sub ecx, edi
add edx, ecx
test eax, eax
mov dword [esi + 0x64], edx
je 0x1014053b
cmp eax, 1
je 0x101405da
cmp eax, 2
je 0x101405da
push eax
mov ecx, esi
call fcn.1013e560
mov eax, dword [esi + 0x64]
test eax, eax
jbe 0x1014063f
mov ecx, dword [esi + 0x114]
call fcn.101425b0
test al, al
je 0x1014062d
mov eax, dword [esi + 0x64]
xor ebx, ebx
test eax, eax
jbe 0x1014062d
mov edi, dword [esi + 0x70]
mov ebp, dword [esi + 0x1c]
add edi, ebx
and ebp, 0xfffd
mov ecx, esi
or ebp, 2
mov dl, byte [edi]
push edx
call fcn.101411e0
mov eax, ebp
mov dl, byte [edi]
xor eax, 1
imul eax, ebp
sar eax, 8
xor dl, al
inc ebx
mov byte [edi], dl
mov eax, dword [esi + 0x64]
cmp ebx, eax
jb 0x101405f9
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x70]
push 0
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.101437b0
mov eax, dword [esi + 0x114]
pop edi
pop ebp
pop ebx
cmp word [eax + 0xe], 8
jne 0x10140669
lea ecx, [esi + 0x28]
push ecx
call fcn.10133010
test eax, eax
je 0x10140669
cmp eax, 2
je 0x10140669
push eax
mov ecx, esi
call fcn.1013e560
mov eax, dword [esi + 0x114]
mov edx, dword [esi + 0x3c]
mov ecx, dword [eax + 0x18]
add ecx, edx
mov dword [eax + 0x18], ecx
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 0x30]
mov dword [eax + 0x1c], ecx
lea ecx, [esi + 0xec]
call fcn.101449b0
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe8], 0
call fcn.10143c60
mov al, 1
pop esi
ret

Function at 0x10140a30
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.10140a60
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
call fcn.101d2b0c
mov al, bl
pop ebx
ret