joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fd92
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x384], eax
mov eax, dword [ebp + 0x394]
push esi
mov esi, dword [ebp + 0x390]
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x1000fdc8
mov al, 1
jmp 0x1000ff36
push ebx
push 0x10063a50
push esi
mov ebx, esi
call fcn.10045450
pop ecx
pop ecx
cmp eax, esi
jne 0x1000fddf
lea ebx, [esi + 4]
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x185]
push 0
push eax
mov byte [ebp + 0x184], 0
call fcn.10045030
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000fe02
push edi
sub eax, ecx
mov edi, 0x200
cmp eax, edi
jae 0x1000fe24
lea eax, [ebp + 0x184]
push ebx
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp byte [ebp + 0x184], 0
je 0x1000fe3a
lea eax, [ebp + 0x184]
push eax
call fcn.10046d09
pop ecx
cmp dword [0x1017dd70], 0
je 0x1000fe52
push ebx
call fcn.1000f0c6
pop ecx
test al, al
jne 0x1000ff32
push esi
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.10045030
mov eax, dword [ebp - 0x80]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000fe6b
sub eax, ecx
cmp eax, edi
jae 0x1000fe86
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp byte [ebp - 0x7c], 0
je 0x1000fe96
lea eax, [ebp - 0x7c]
push eax
call fcn.10046d09
pop ecx
mov al, byte [ebp + 0x184]
cmp al, byte [ebp - 0x7c]
je 0x1000ff2e
cmp al, 0x41
jl 0x1000fead
cmp al, 0x5a
jle 0x1000fedc
cmp byte [ebx], 0x5c
je 0x1000fedc
cmp byte [ebx + 1], 0x5c
je 0x1000fedc
cmp dword [0x10157ca4], 0
jne 0x1000fedc
lea eax, [ebp + 0x184]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x184]
push eax
call fcn.10046d09
pop ecx
cmp byte [0x102e1000], 0
jne 0x1000feea
call sym.TC_AD.DLL_FDrv
cmp byte [ebp + 0x185], 0x3a
jne 0x1000ff0b
movsx eax, byte [ebp + 0x184]
lea ecx, [eax - 0x41]
cmp ecx, 0x1a
jge 0x1000ff0b
cmp byte [eax + 0x102e0fbf], 3
je 0x1000ff2e
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ff10
sub eax, edx
cmp eax, 2
jbe 0x1000ff32
mov al, byte [ebx + 1]
cmp al, 0x3a
je 0x1000ff32
cmp byte [ebx], 0x5c
jne 0x1000ff2e
cmp al, 0x5c
je 0x1000ff32
mov al, 1
jmp 0x1000ff34
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp + 0x384]
xor ecx, ebp
pop esi
call fcn.1004501f
add ebp, 0x388
leave
ret
Function at 0x10010b1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x188]
sub esp, 0x208
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x184], eax
test byte [0x10151868], 8
push ebx
push esi
mov esi, dword [ebp + 0x194]
push edi
mov dword [ebp - 0x80], 0xea60
je 0x10010b57
mov dword [ebp - 0x80], 0x2710
push 0x1ff
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.10045030
add esp, 0xc
cmp byte [esi], 0
je 0x10010c2a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010b7c
sub eax, edx
cmp eax, 0x200
jae 0x10010c2a
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.1000789a
lea eax, [ebp - 0x7c]
push eax
call fcn.10046d09
mov edi, dword [ebp + 0x190]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
mov ebx, 0x10091490
cmp dword [0x10151608], edi
jne 0x10010c11
cmp byte [0x10091490], 0
je 0x10010c11
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.10007842
pop ecx
pop ecx
test eax, eax
je 0x10010c11
call esi
mov ecx, dword [0x1009169c]
mov edx, dword [ebp - 0x80]
add ecx, edx
cmp ecx, eax
jbe 0x10010c11
cmp dword [0x1015668c], 0x48
jne 0x10010c05
lea eax, [ebp - 0x7c]
push eax
push str.SendInfoDisplayEDRL_dup___s
push 0
call fcn.100412e2
add esp, 0xc
call esi
mov dword [0x1009169c], eax
xor eax, eax
inc eax
jmp 0x10010c2c
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.1000789a
pop ecx
pop ecx
call esi
mov dword [0x1009169c], eax
mov dword [0x10151608], edi
xor eax, eax
mov ecx, dword [ebp + 0x184]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x188
leave
ret
Function at 0x10014e8e
Capabilities:
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0xf88], eax
mov ecx, dword [ebp + 0xf98]
push ebx
push edi
mov edi, dword [ebp + 0xf9c]
xor ebx, ebx
mov dword [ebp - 0x80], ecx
cmp edi, ebx
jne 0x10014ecb
xor eax, eax
jmp 0x10014fa2
cmp edi, 0xffffffff
je 0x10014ec4
mov eax, dword [ebp + 0xf94]
cmp eax, ebx
je 0x10014ec4
cmp ecx, ebx
je 0x10014ec4
cmp byte [eax], bl
je 0x10014ec4
mov dl, byte [ecx]
cmp dl, bl
je 0x10014ec4
mov eax, ecx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10014eee
sub eax, esi
cmp eax, 0x1f6
ja 0x10014f77
cmp dword [0x101580a8], ebx
je 0x10014f27
test dword [ebp + 0xfa0], 0x40000000
je 0x10014f27
push edx
call sym.TC_AD.DLL_isUSB
pop ecx
test al, al
jne 0x10014f22
cmp dl, 0x5c
jne 0x10014f27
or eax, 0xffffffff
jmp 0x10014fa1
push 0xfff
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call fcn.10045030
add esp, 0xc
test byte [0x10150600], 1
je 0x10014f4e
push 2
push 2
jmp 0x10014f8d
push ebx
lea eax, [ebp - 0x7c]
push eax
mov esi, 0x1000
push esi
lea eax, [ebp - 0x78]
push eax
push edi
call dword [0x101bf54c]
test eax, eax
je 0x10014f77
push ebx
push ebx
push ebx
push edi
call dword [0x101bf548]
cmp dword [ebp - 0x7c], ebx
jg 0x10014f7b
xor eax, eax
jmp 0x10014fa1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x7c], esi
jg 0x10014f8b
mov esi, dword [ebp - 0x7c]
push eax
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
mov ecx, 0x10189098
call fcn.1002b9a3
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp + 0xf88]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0xf8c
leave
ret
Function at 0x100155bb
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [0x10151cc8]
inc eax
and eax, 0x1f
mov dword [0x10151cc8], eax
imul eax, eax, 0x208
mov esi, 0x100dc0a8
add eax, esi
push 0x208
push eax
call fcn.10007867
mov eax, dword [0x10151cc8]
push dword [esp + 0x18]
imul eax, eax, 0x208
add eax, esi
push eax
call fcn.1000789a
mov eax, dword [0x10151cc8]
imul eax, eax, 0x208
add esp, 0x10
mov dword [eax + 0x100dc2ac], ebx
mov dword [eax + 0x100dc2a8], edi
pop edi
pop esi
pop ebx
ret

Function at 0x100160df
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001618c
cmp byte [esi], 0
je 0x1001618c
push str._USB
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10016119
push 0x10
pop eax
jmp 0x1001618e
cmp byte [esi], 0x5c
jne 0x10016133
push 0x10063d68
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10016133
push 0x20
jmp 0x10016116
mov cl, byte [esi]
cmp cl, 0x41
jl 0x1001613f
cmp cl, 0x5a
jle 0x10016149
cmp cl, 0x61
jl 0x1001618c
cmp cl, 0x7a
jg 0x1001618c
push edi
xor eax, eax
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
movsx eax, cl
push eax
lea eax, [ebp - 0xc]
push str._c:_
push eax
call fcn.10045378
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
pop edi
je 0x1001618c
dec eax
je 0x10016114
dec eax
dec eax
je 0x10016188
dec eax
jne 0x1001618c
mov eax, 0x80
jmp 0x1001618e
push 0x40
jmp 0x10016116
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004501f
leave
ret

Function at 0x1001622c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, ebx
je 0x100162ee
cmp byte [esi], bl
je 0x100162ee
cmp edi, ebx
je 0x100162ee
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp byte [esi], 0x5c
jne 0x10016280
inc esi
cmp byte [esi], 0x5c
jne 0x10016280
inc esi
cmp dword [0x1015668c], ebx
je 0x10016297
push esi
push str.pre_gethostbyname___s_
push ebx
call fcn.100412e2
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x100162e5
mov eax, dword [eax + 0xc]
cmp dword [eax], ebx
je 0x100162e5
push 4
push dword [eax]
lea eax, [ebp - 0x198]
push eax
call fcn.10007881
add esp, 0xc
push dword [ebp - 0x198]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
cmp esi, ebx
je 0x100162fd
cmp dword [0x1015668c], ebx
je 0x100162e5
push esi
push str.gethostbyname___s_
push ebx
call fcn.100412e2
add esp, 0xc
push esi
push edi
call fcn.1000789a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
leave
ret
mov byte [edi], bl
jmp 0x100162ee
Function at 0x10016352
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x102d3d90], bl
jne 0x100163a2
push 0x101adb18
call fcn.10033d04
pop ecx
test al, al
je 0x100163a2
mov eax, dword [0x1015668c]
cmp eax, 4
je 0x1001638e
cmp eax, 0x44
jne 0x1001639b
push str.isMS_Site_is_true
push ebx
call fcn.100412e2
pop ecx
pop ecx
xor al, al
jmp 0x100164a2
cmp dword [0x10078cd8], 0x501
push esi
jne 0x100163c7
cmp dword [0x102b5a3c], 7
jne 0x100163ea
push str.appwiz.cpl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10016443
cmp dword [0x102b5a3c], 7
jne 0x100163ea
mov eax, dword [0x10185a58]
cmp eax, dword [0x10152ad4]
je 0x10016443
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str.inetcpl.cpl
jmp 0x10016438
cmp dword [0x102b5a3c], 6
jne 0x10016447
mov esi, dword [0x10185a58]
cmp esi, ebx
je 0x10016447
push 0x1ff
lea eax, [ebp - 0x203]
push ebx
push eax
mov byte [ebp - 0x204], bl
call fcn.10045030
lea eax, [ebp - 0x204]
push eax
push esi
call fcn.10011073
add esp, 0x14
cmp byte [ebp - 0x204], bl
je 0x10016447
push str.system32_svchost.exe
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10016447
xor al, al
jmp 0x100164a1
cmp byte [0x102d3d91], bl
jne 0x10016483
call fcn.10036fbe
mov eax, dword [0x1015668c]
cmp eax, 4
je 0x10016463
cmp eax, 0x44
jne 0x10016483
cmp dword [0x100784a8], 0x1f2e3d4c
jne 0x10016476
push str.m_bMouseClick__MOUSE_CLICK_isRansomProcess
jmp 0x1001647b
push str.m_bMouseClick___MOUSE_CLICK_isRansomProcess
push ebx
call fcn.100412e2
pop ecx
pop ecx
mov eax, dword [0x1015668c]
cmp eax, 4
je 0x10016492
cmp eax, 0x44
jne 0x1001649f
push str.isRansomProcess_is_true
push ebx
call fcn.100412e2
pop ecx
pop ecx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004501f
leave
ret

Function at 0x100164b8
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1015668c], 0
je 0x100164d7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.beginthread_exit_Thread:_d
push 0
call fcn.100412e2
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100164e0
Capabilities:
Create thread
Terminate process

Disassembly:
push ecx
push esi
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10155228
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.TerminateProcess4Ransom__d___s_
xor edi, edi
push edi
call fcn.100412e2
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push 1
call esi
push eax
call dword [0x1018797c]
push 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 8]
push eax
push edi
push edi
push fcn.100164b8
push edi
push edi
call fcn.1004592d
add esp, 0x18
push edi
call fcn.100164b8
pop edi
pop esi
Function at 0x1002c5f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf9c]
mov eax, 0x101c
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0xf98], eax
mov eax, dword [ebp + 0xfa4]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa8]
push edi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xfac]
mov edi, 0x7ff
xor ebx, ebx
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x799]
push ebx
push eax
mov byte [ebp + 0x798], bl
call fcn.10045030
push edi
lea eax, [ebp - 0x67]
lea esi, [edi + 1]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x68], bl
call fcn.10045030
add esp, 0x18
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1002c686
cmp dword [ebp - 0x6c], ebx
je 0x1002c710
mov dword [ebp - 0x70], ebx
xor edi, edi
jmp 0x1002c6f7
cmp edi, ebx
jne 0x1002c702
push esi
lea eax, [ebp + 0x798]
push ebx
push eax
call fcn.10045030
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.10045030
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x798]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x1002c6f4
cmp dword [ebp - 0x74], esi
jae 0x1002c6f4
push dword [ebp - 0x80]
lea eax, [ebp + 0x798]
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1002c6fe
inc dword [ebp - 0x70]
cmp dword [ebp - 0x6c], ebx
jne 0x1002c68d
jmp 0x1002c710
mov al, 1
jmp 0x1002c712
cmp dword [ebp - 0x6c], ebx
je 0x1002c710
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0xf98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0xf9c
leave
ret
Function at 0x1002c72a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3a0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3a8]
xor ebx, ebx
mov esi, 0x1ff
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x195]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov byte [ebp + 0x194], bl
call fcn.10045030
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10045030
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push dword [ebp - 0x78]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c827
cmp dword [ebp - 0x70], ebx
je 0x1002c827
cmp dword [ebp - 0x70], 0xffffffff
je 0x1002c827
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x200
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x74]
mov esi, eax
cmp byte [ebp + 0x194], bl
je 0x1002c81e
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push str._s_s
push eax
call fcn.10045378
push dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.1002c5f4
add esp, 0x1c
test al, al
jne 0x1002c841
mov byte [ebp + 0x194], bl
cmp esi, 0x103
jne 0x1002c7b5
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x398
leave
ret
mov al, 1
jmp 0x1002c829
Function at 0x1002c90a
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x800
push 0x10153968
call fcn.10007867
pop ecx
pop ecx
push 6
pop ecx
xor ebx, ebx
push ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
push 4
rep stosd dword es:[edi], eax
call dword [0x10078d28]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0x1c
call sub.KERNEL32.dll_Thread32First
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x1002c9be
cmp dword [ebp - 4], 0x2710
jg 0x1002c9be
mov eax, dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 0x20], eax
jne 0x1002c9ae
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
je 0x1002c9ae
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp eax, ebx
je 0x1002c9ae
mov dword [edi*4 + 0x10153968], eax
inc edi
cmp edi, 0xc8
jge 0x1002c9be
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1002c96d
cmp dword [0x1015668c], 8
jne 0x1002c9d9
push edi
push dword [ebp - 4]
push str.FreezeTh_tot:_d__d
push ebx
call fcn.100412e2
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002d232
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp - 0x69]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10045030
mov al, byte [ebp + 0x39c]
push 0x1ff
mov byte [ebp - 0x6c], al
lea eax, [ebp + 0x191]
push ebx
push eax
mov byte [ebp + 0x190], bl
call fcn.10045030
add esp, 0x18
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d2f6
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp + 0x190]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1002d2f6
cmp dword [ebp - 0x80], ebx
jle 0x1002d2f6
cmp byte [ebp + 0x1a8], 7
jne 0x1002d2f6
mov al, 1
jmp 0x1002d2f8
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x394
leave
ret

Function at 0x1002d310
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp + 0x190]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp + 0x197]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10045030
push 0x1ff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call fcn.10045030
mov eax, dword [ebp + 0x39c]
lea edx, [ebp + 0x190]
add esp, 0x18
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1002d374
lea eax, [ebp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002d387
push ebx
push ebx
push 3
push ebx
sub eax, edx
push 3
mov byte [ebp + eax + 0x18f], bl
push bind
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d3fd
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp - 0x70]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1002d3fd
cmp dword [ebp - 0x80], ebx
jle 0x1002d3fd
cmp byte [ebp - 0x58], 7
jne 0x1002d3fd
mov al, 1
jmp 0x1002d3ff
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x394
leave
ret
Function at 0x1002d417
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x8c8]
sub esp, 0x948
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x8c4], eax
mov eax, dword [ebp + 0x8d4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x8d8]
mov esi, 0x1ff
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4c5]
push ebx
push eax
mov byte [ebp + 0x4c4], bl
call fcn.10045030
lea eax, [ebp + 0x4c4]
push edi
push eax
call fcn.1000789a
push esi
lea eax, [ebp + 0x2c5]
push ebx
push eax
mov byte [ebp + 0x2c4], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x6c5]
push ebx
push eax
mov byte [ebp + 0x6c4], bl
call fcn.10045030
push esi
lea eax, [ebp + 0xc5]
push ebx
push eax
mov byte [ebp + 0xc4], bl
call fcn.10045030
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
call fcn.1000789a
lea edi, [ebp + 0x6c4]
add esp, 0x40
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1002d4c5
mov eax, dword [0x10189060]
mov esi, str..
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp eax, ebx
je 0x1002d4ec
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x6c4]
push ecx
call eax
jmp 0x1002d4fd
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x6c4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002d50b
xor eax, eax
jmp 0x1002d5b3
mov esi, str._s_s
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x2c4]
push esi
push eax
call fcn.10045378
add esp, 0x10
test byte [ebp - 0x7c], 0x10
je 0x1002d566
cmp byte [ebp - 0x50], 0x2e
je 0x1002d596
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0xc4]
push esi
push eax
call fcn.10045378
lea eax, [ebp + 0xc4]
push eax
push dword [ebp - 0x80]
push dword [ebp + 0x8d0]
call fcn.1002d417
jmp 0x1002d593
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x6c4]
push esi
push eax
call fcn.10045378
lea eax, [ebp + 0x2c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
push dword [ebp + 0x8d0]
call fcn.1001f46a
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002d510
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x8c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x8c8
leave
ret
Function at 0x1002d890
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.10045030
lea eax, [ebp - 0x68]
push 0x10066ef0
push eax
call fcn.1000789a
add esp, 0x14
xor esi, esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esi + 0x102e1000], al
cmp eax, 3
jne 0x1002d8f9
test byte [0x10157880], 0x10
jne 0x1002d931
push dword [ebp - 0x68]
call fcn.1002d232
pop ecx
test al, al
je 0x1002d931
mov byte [esi + 0x102e1000], 2
jmp 0x1002d931
mov cl, byte [0x10157880]
cmp eax, 2
jne 0x1002d909
test cl, 0x10
jne 0x1002d92a
cmp eax, 5
jne 0x1002d912
test cl, cl
js 0x1002d92a
cmp eax, 4
jne 0x1002d91c
test cl, 0x40
jne 0x1002d92a
cmp dword [0x10154a10], 0
je 0x1002d931
cmp eax, 1
jne 0x1002d931
mov byte [esi + 0x102e1000], 3
inc byte [ebp - 0x68]
inc esi
cmp esi, 0x1a
jl 0x1002d8c5
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004501f
leave
ret