joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100c78a8], 0
je 0x10041b25
mov eax, 2
pop ebp
ret 8
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.10041fb0
test eax, eax
js 0x10041c25
push ebx
call fcn.100420d0
mov ebx, eax
test ebx, ebx
jg 0x10041b51
pop ebx
mov eax, 0xfffffffe
pop edi
pop ebp
ret 8
push esi
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10041b72
lea eax, [esi - 3]
pop esi
pop ebx
pop edi
pop ebp
ret 8
push edi
push esi
call fcn.10042150
mov eax, dword [0x100c78b0]
cmp dword [eax + 0xa0], 0
jbe 0x10041b96
cmp dword [eax + 0xa4], 0
jbe 0x10041b96
push esi
call fcn.10041d30
push esi
call fcn.10041dd0
mov edi, eax
test edi, edi
js 0x10041bf9
lea eax, [ebp + 0xc]
push eax
push 0x40
push ebx
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x100c78b0]
mov dword [eax + 0x34], esi
mov eax, dword [0x100c78b0]
mov eax, dword [eax + 0x28]
add eax, esi
mov dword [0x100c78a4], eax
jne 0x10041bd7
mov edi, 0xfffffffc
jmp 0x10041c13
push 0
push 1
push esi
call eax
test eax, eax
jne 0x10041be7
lea edi, [eax - 5]
jmp 0x10041bfe
mov dword [0x100c78a8], esi
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret 8
cmp edi, 0xfffffffb
jne 0x10041c13
push 0
push 0
push esi
call dword [0x100c78a4]
mov dword [0x100c78a4], 0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
mov eax, edi
pop ebx
pop edi
pop ebp
ret 8

Function at 0x10041fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x40
jb 0x100420bb
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100420bb
mov eax, 0x5a4d
mov dword [0x100c78ac], ecx
cmp ax, word [ecx]
jne 0x100420b1
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jae 0x10041ff6
mov eax, 0xffffffdf
pop esi
pop ebp
ret 8
add ecx, edx
mov dword [0x100c78b0], ecx
je 0x100420a7
cmp dword [ecx], 0x4550
jne 0x100420a7
movzx edx, word [ecx + 0x16]
mov eax, edx
push edi
and eax, 0x2000
xor edi, edi
cmp di, ax
jne 0x1004202c
lea eax, [edi - 0x23]
pop edi
pop esi
pop ebp
ret 8
test dl, 2
jne 0x1004203c
pop edi
mov eax, 0xffffffdc
pop esi
pop ebp
ret 8
mov eax, 0xe0
cmp ax, word [ecx + 0x14]
je 0x10042052
pop edi
mov eax, 0xffffffdb
pop esi
pop ebp
ret 8
lea eax, [ecx + 0xf8]
mov dword [0x100c78b4], eax
test eax, eax
jne 0x1004206c
pop edi
mov eax, 0xffffffda
pop esi
pop ebp
ret 8
movzx edi, word [ecx + 6]
xor edx, edx
test edi, edi
jle 0x10042091
lea ecx, [eax + 0x10]
lea esp, [esp]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
cmp eax, esi
ja 0x1004209c
inc edx
add ecx, 0x28
cmp edx, edi
jl 0x10042080
pop edi
mov eax, 0x1f
pop esi
pop ebp
ret 8
pop edi
mov eax, 0xffffffd9
pop esi
pop ebp
ret 8
mov eax, 0xffffffde
pop esi
pop ebp
ret 8
mov eax, 0xffffffe0
pop esi
pop ebp
ret 8
mov eax, 0xffffffe1
pop esi
pop ebp
ret 8
Function at 0x100425b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a0be6
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100c34c0]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
push edi
mov eax, dword [0x100c34c0]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.100119a0
mov dword [esp + 0xc0], 0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x10042693
lea ecx, [esp + 0x24]
call fcn.10042210
mov byte [esp + 0xc0], 1
lea ecx, [esp + 0xc]
cmp ecx, eax
je 0x1004265f
push 0xffffffffffffffff
push 0
push eax
call fcn.100119a0
mov byte [esp + 0xc0], 0
cmp dword [esp + 0x38], 0x10
jb 0x1004267a
push dword [esp + 0x24]
call fcn.10076e4c
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
test esi, esi
je 0x1004271e
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push ecx
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xac], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x44], 0x67452301
mov dword [esp + 0x48], 0xefcdab89
mov dword [esp + 0x4c], 0x98badcfe
mov dword [esp + 0x50], 0x10325476
call fcn.10043f10
cmp byte [esp + 0xa4], 0
jne 0x10042707
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], 1
call fcn.10043fc0
push ecx
lea eax, [esp + 0x98]
push eax
mov edx, esi
mov ecx, edi
call fcn.100423a0
add esp, 8
mov esi, eax
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x1004273c
push dword [esp + 0xc]
call fcn.10076e4c
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.10076e3d
mov esp, ebp
pop ebp
ret
Function at 0x10042b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100bdff8
push 0x1007e130
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100c34c0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
mov edi, dword [ebp + 8]
mov dword [edi], 0
xor esi, esi
cmp ebx, 4
jl 0x10042d05
mov eax, ebx
and eax, 0x80000003
jns 0x10042bdc
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10042d05
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
jge 0x10042c0c
mov al, byte [ecx + edx]
cmp al, 0x80
jae 0x10042cfe
movzx eax, al
cmp byte [eax + 0x100c4a18], 0xff
je 0x10042cfe
inc ecx
jmp 0x10042be7
push ebx
call fcn.10077bc8
mov dword [ebp - 0x1c], eax
push ebx
push 0
push eax
call fcn.1007c850
add esp, 0x10
mov edx, dword [ebp - 0x1c]
cmp esi, ebx
jge 0x10042cd1
mov ecx, dword [ebp - 0x20]
movzx eax, byte [esi + ecx]
mov dl, byte [eax + 0x100c4a18]
inc esi
mov dword [ebp - 0x24], esi
movzx eax, byte [esi + ecx]
mov al, byte [eax + 0x100c4a18]
inc esi
mov dword [ebp - 0x24], esi
movzx ecx, al
mov dword [ebp - 0x2c], ecx
shr ecx, 4
and ecx, 3
movzx eax, dl
shl eax, 2
or ecx, eax
mov eax, dword [edi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + eax], cl
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10042cd1
movzx eax, al
mov al, byte [eax + 0x100c4a18]
movzx ecx, al
mov eax, ecx
shr eax, 2
and eax, 0xf
mov edx, dword [ebp - 0x2c]
and edx, 0xf
shl edx, 4
or eax, edx
mov edx, dword [ebp - 0x1c]
mov edi, dword [edi]
mov byte [edi + edx], al
mov edi, dword [ebp + 8]
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10042cd1
movzx eax, al
mov al, byte [eax + 0x100c4a18]
and ecx, 3
shl ecx, 6
movzx eax, al
or ecx, eax
mov eax, dword [edi]
mov byte [eax + edx], cl
inc dword [edi]
jmp 0x10042c24
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10043400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x100adc40
push ecx
mov edi, edx
call fcn.1007a0f9
mov esi, eax
add esp, 8
test esi, esi
je 0x10043437
push esi
push edi
push 1
push dword [ebp + 8]
call fcn.1007a7a0
add esp, 0x10
push esi
cmp eax, edi
je 0x1004343d
call fcn.10079aa2
add esp, 4
pop edi
xor al, al
pop esi
pop ebp
ret
call fcn.10079aa2
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x10043de0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, ecx
ret
Function at 0x10043e10
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x1004f380
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1004f38b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1004f3a0
Function at 0x1004f830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov edx, dword [edi + 0x3c]
sub edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub edx, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, esi
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x1004f8bc
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.1007bf30
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
add esp, 0xc
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1004f88f
sub eax, esi
jmp 0x1004f891
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1004f880
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1004f8af
sub eax, esi
jmp 0x1004f8b1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1004f8a0
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x1004f9f0
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1004f8e9
xor eax, eax
jmp 0x1004f93c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1004f906
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.10050380
jmp 0x1004f91e
cmp eax, 2
jne 0x1004f924
mov edx, dword [ebx]
test edx, edx
jne 0x1004f915
xor eax, eax
jmp 0x1004f921
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1004f3a0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.1007bf30
mov eax, dword [ebp - 4]
add dword [ebx], eax
add esp, 0xc
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x1004f964
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x1004f978
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1004f840
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x1004f9f0
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x1004f9c0
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
push 0
push eax
mov dword [ebp - 8], ecx
call fcn.1007c850
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x1004f9f0
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
push esi
add eax, edx
push 0
push eax
call fcn.1007c850
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1824
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100c34c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.FXConfigImpl_class_ConfigEncode__class_CFXThreadMutex_.0
call fcn.10056cf0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
sub esp, 8
mov dword [ebp - 0x10], ecx
call fcn.1004c570
mov byte [ebp - 4], 4
lea ecx, [esi + 0x40]
push 0xffffffffffffffff
mov byte [esi + 0x3c], 0
push 0
lea eax, [ebp + 8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.100119a0
mov byte [ebp - 4], 5
lea edi, [esi + 0x58]
xor eax, eax
push 0xffffffffffffffff
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push eax
mov word [edi], ax
lea eax, [ebp + 0x20]
push eax
mov ecx, edi
call fcn.10011ff0
mov byte [ebp - 4], 6
lea eax, [esi + 0x78]
push eax
mov byte [esi + 0x70], 0
mov dword [esi + 0x74], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [ebp + 0x18], 0
je 0x10054be0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edi
mov word [ecx], ax
call fcn.10011ff0
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.100119a0
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
mov ecx, esi
call fcn.10055700
push 0
push 0
push esi
push 0x10055f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x74], eax
mov byte [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x10
jb 0x10054c0c
push dword [ebp + 8]
call fcn.10076e4c
add esp, 4
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x34], 8
jb 0x10054c36
push dword [ebp + 0x20]
call fcn.10076e4c
add esp, 4
xor eax, eax
mov word [ebp + 0x20], ax
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x30], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x30
Function at 0x10064620
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a40e1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x100c34c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x16c], esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x170], 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x170], 1
mov dword [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.10010970
mov byte [ebp - 4], 2
lea edx, [esi + 0x18]
lea ecx, [ebp - 0x48]
call fcn.1001c1d0
mov edi, eax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xf0]
call fcn.1001c1d0
mov esi, eax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
lea ecx, [ebp - 0xd8]
call fcn.1001c1d0
mov byte [ebp - 4], 5
push eax
push 0x100b1f48
lea eax, [ebp - 0x90]
push eax
call fcn.10064870
add esp, 0xc
mov byte [ebp - 4], 6
push 0x100b1f44
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.100154a0
add esp, 0xc
mov byte [ebp - 4], 7
push esi
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.10015190
add esp, 4
mov byte [ebp - 4], 8
push 0x100b1f40
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.100154a0
add esp, 0xc
mov byte [ebp - 4], 9
push edi
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.10015190
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc0]
call fcn.10010820
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x78]
call fcn.10010820
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa8]
call fcn.10010820
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x90]
call fcn.10010820
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd8]
call fcn.10010820
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xf0]
call fcn.10010820
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x48]
call fcn.10010820
lea ecx, [ebp - 0x164]
call fcn.10043de0
call fcn.10043e10
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
push dword [ebp - 0x20]
push eax
call fcn.10043f10
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x164]
call fcn.100448e0
mov byte [ebp - 4], 0x12
push eax
mov ecx, ebx
call fcn.100107e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x48]
call fcn.10010820
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.10010820
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.10010a70
mov dword [ebp - 4], 0
mov eax, ebx
jmp 0x10064845
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10076e3d
mov esp, ebp
pop ebp
ret 4
Function at 0x10068d90
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a4820
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100c34c0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x100c34c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [0x100c6b78], 0
mov dword [0x100c6b74], 0
call fcn.10068820
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0x100c6b78
push 0x100ad514
push 1
push 0
push 0x100ad5e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0x100c6b78], 0
jne 0x10068e21
mov eax, 0xfffffffd
jmp 0x10068ef2
lea ecx, [esp + 8]
call fcn.10066070
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 8
jb 0x10068e3a
mov eax, dword [eax]
push eax
lea ecx, [esp + 8]
call fcn.10061a70
mov byte [esp + 0x30], 1
mov edx, dword [eax]
test edx, edx
je 0x10068e53
mov edx, dword [edx]
jmp 0x10068e55
xor edx, edx
mov eax, dword [0x100c6b78]
push 0x100c6b74
mov ecx, dword [eax]
push 0
push 0
push 0x80
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov byte [esp + 0x30], 0
lea ecx, [esp + 4]
call fcn.10061b10
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x10068e9e
push dword [esp + 8]
call fcn.10076e4c
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
cmp dword [0x100c6b78], eax
jne 0x10068ec4
mov eax, 0xfffffffc
jmp 0x10068ef2
call fcn.10068780
test eax, eax
jne 0x10068ed4
mov eax, 0xfffffffb
jmp 0x10068ef2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x100c6b74]
call eax
neg eax
sbb eax, eax
and eax, 0xfffffffa
inc eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10076e3d
mov esp, ebp
pop ebp
ret
Function at 0x1006acd0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a499b
mov eax, dword fs:[0]
push eax
mov eax, 0x37e4
call fcn.10084330
mov eax, dword [0x100c34c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
mov dword [ebp - 0x37e8], eax
xor edi, edi
lea ecx, [ebp - 0x37e4]
call fcn.1004c780
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x1006ad2c
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1004c910
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x37d0], 0x10
jb 0x1006ad5b
push dword [ebp - 0x37e4]
call fcn.10076e4c
add esp, 4
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x37d0], 0xf
mov dword [ebp - 0x37d4], 0
mov byte [ebp - 0x37e4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006af31
push 0x2710
xorps xmm0, xmm0
lea eax, [ebp - 0x2ff0]
movq qword [ebp - 0x37cc], xmm0
push 0
push eax
mov dword [ebp - 0x37ec], 0
mov dword [ebp - 0x37c4], 0
mov dword [ebp - 0x37cc], 0
mov dword [ebp - 0x37c8], 0
call fcn.1007c850
add esp, 0xc
lea eax, [ebp - 0x37ec]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2ff0]
push eax
push 0xc
lea eax, [ebp - 0x37cc]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x1006af2a
mov edx, dword [ebp - 0x2fe4]
lea eax, [ebp - 0x37c0]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.1006ab70
mov edx, dword [ebp - 0x2fe0]
lea eax, [ebp - 0x8e0]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.1006ab70
mov edx, dword [ebp - 0x2fdc]
lea eax, [ebp - 0x33d8]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.1006ab70
mov edx, dword [ebp - 0x2fd8]
lea eax, [ebp - 0x4f8]
push eax
push 1
lea ecx, [ebp - 0x2ff0]
call fcn.1006ab70
add esp, 0x20
cmp byte [0x100c7190], 0
jne 0x1006aef3
mov al, byte [ebp - 0x4f8]
test al, al
je 0x1006aef3
cmp al, 0xa
je 0x1006aef3
movsx eax, al
push eax
call fcn.10077e4a
add esp, 4
test eax, eax
jne 0x1006aeb7
movsx eax, byte [ebp - 0x4e5]
push eax
call fcn.10077e4a
add esp, 4
test eax, eax
je 0x1006aef3
lea eax, [ebp - 0x4f8]
push eax
push 0x400
push 0x100c7190
call fcn.10081cfa
add esp, 0xc
lea eax, [ebp - 0x8e0]
push eax
push 0x400
push 0x100c6d90
call fcn.10081cfa
add esp, 0xc
mov dword [ebp - 0x37e8], 1
push 0x2710
lea eax, [ebp - 0x2ff0]
push 0
push eax
call fcn.1007c850
add esp, 0xc
lea eax, [ebp - 0x37ec]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2ff0]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x1006ad12
mov eax, dword [ebp - 0x37e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10076e3d
mov esp, ebp
pop ebp
ret
Function at 0x1006b2b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x100c34c0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x100a666d
push 0x400
push 0x100c7190
xor edi, edi
call fcn.10081cfa
add esp, 0xc
lea eax, [esp + 8]
push 0x114
push edi
push eax
call fcn.1007c850
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
jne 0x1006b334
call fcn.1006a780
test eax, eax
jne 0x1006b350
call fcn.1006b0f0
test eax, eax
jne 0x1006b350
call fcn.1006acd0
test eax, eax
jne 0x1006b350
call fcn.1006a9b0
jmp 0x1006b350
xor esi, esi
test edi, edi
jne 0x1006b350
cmp byte [0x100c7190], 0
jne 0x1006b350
call fcn.1006af70
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x1006b336
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
mov eax, 0x100c7190
call fcn.10076e3d
mov esp, ebp
pop ebp
ret