joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cb80
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x1003cba8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1003cba8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x1003cc5b
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x1003cbbf
cmp al, 0x5c
jne 0x1003cbc1
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x1003cbb7
cmp esi, ebx
je 0x1003cbf5
sub esi, ebx
lea eax, [ebp - 0x208]
push esi
push ebx
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov byte [ebp + esi - 0x208], 0
lea edx, [ebp - 0x208]
mov ecx, edi
call fcn.1003cb80
mov byte [ebp - 0x104], 0
pop esi
test edi, edi
je 0x1003cc24
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003cc06
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
add esp, 0xc
push ebx
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1003cc5b
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10050cc6
push eax
mov dword fs:[0], esp
sub esp, 0x240
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1003d418
cmp dword [esi + 4], 0xffffffff
jne 0x1003d418
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.10001e70
push eax
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x40]
call fcn.100047c0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x1003d30b
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001780
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x10
jb 0x1003d32a
push dword [ebp - 0x40]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 0x104
lea edi, [esi + 0x140]
mov dword [ebp - 0x2c], 0xf
push 0
push edi
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push 0x103
push eax
push edi
call dword [sym.imp.MSVCR120.dll_strncpy]
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003d372
sub ecx, edx
mov al, byte [ecx + esi + 0x13f]
cmp al, 0x5c
je 0x1003d39e
cmp al, 0x2f
je 0x1003d39e
push 0x10059c78
push 0x104
push edi
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0xc
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x1003d3c0
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1003d3c0
mov esi, 0x2000000
jmp 0x1003d3f2
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.1003e810
add esp, 8
test eax, eax
jne 0x1003d3dc
mov esi, dword [ebp + 0x10]
jmp 0x1003d3f2
mov ecx, eax
call fcn.1003e0c0
mov dword [esi], eax
test eax, eax
jne 0x1003d3f0
mov esi, 0x200
jmp 0x1003d3f2
xor esi, esi
cmp dword [ebp - 0x14], 0x10
jb 0x1003d404
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
mov eax, 0x1000000
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003e320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x1003e355
cmp byte [edi + 1], 0
je 0x1003e34d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1003e35b
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x1003e380
cmp byte [edi + 1], 0
je 0x1003e379
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x1003e383
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x1003e392
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
cmp ebx, eax
jae 0x1003e395
mov dword [ebp - 8], ebx
push esi
push 0x404
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1003e3b4
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
jbe 0x1003e4b8
jmp 0x1003e3d0
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x1c], edx
sub ebx, ecx
mov dword [ebp - 0x18], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x1003e41a
cmp byte [edi + 1], 0
je 0x1003e4b8
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1003e41d
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x10], ebx
je 0x1003e445
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003e440
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x1003e46e
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x1003e458
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x10], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call sub.MSVCR120.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x1003e4b8
lea eax, [ebx - 3]
test eax, eax
js 0x1003e4a0
mov edi, edi
dec eax
cmp byte [eax + esi], 0x50
jne 0x1003e49c
cmp byte [eax + esi + 1], 0x4b
jne 0x1003e49c
cmp byte [eax + esi + 2], 5
jne 0x1003e49c
cmp byte [eax + esi + 3], 6
je 0x1003e4cc
test eax, eax
jns 0x1003e480
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003e4b8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x1003e3d0
push esi
call dword [sym.imp.MSVCR120.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x1003e4a3
Function at 0x1003e5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x1003e61b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003e616
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x1003e648
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1003e62c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call sub.MSVCR120.dll_memcpy
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x1003e65c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1003e653
cmp byte [esi + 8], 0
je 0x1003e653
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x1003e6c3
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003e6b5
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x1003e6d4
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call sub.MSVCR120.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003f0a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x10058060]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x10058060]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret

Function at 0x1003f130
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x10058060]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10058060]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x1003f180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1003f18b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1003f255
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
dec edi
jne 0x1003f1a0
pop edi
test esi, esi
je 0x1003f27a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10058060]
dec esi
jne 0x1003f260
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x10041b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x10041bc3
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x10041c0b
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call sub.MSVCR120.dll_memcpy
mov ecx, dword [edi + 0x78]
mov edx, esi
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
call fcn.100426e0
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x10041c04
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10041c0b
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.100426e0
add esp, 4
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10042070
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x1004214d
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x100420a5
cmp dword [esi + 0x40], ebx
jae 0x100420a5
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x100420be
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call sub.MSVCR120.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x1004214a
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x100596d0]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
and eax, 0xff
shr edx, 8
xor cl, bl
xor edx, dword [eax*4 + 0x100596d0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x100420d4
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1004218b
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x10042172
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x100421ad
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10042690
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100596d0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100596d0]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x100426e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100426eb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x100427b5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
dec edi
jne 0x10042700
pop edi
test esi, esi
je 0x100427da
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100596d0]
dec esi
jne 0x100427c0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x100434b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x100436b6
cmp dword [esi + 0x6af90], 3
jb 0x10043528
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x10043565
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x10043565
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x1004354f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.10043850
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x10043636
mov edx, dword [esi + 0x6af84]
lea eax, [edi - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.100440b0
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x100435fd
cmp dword [esi + 0x6af90], 3
jb 0x100435fd
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec edi
jne 0x100435a3
mov eax, dword [ebp - 4]
jmp 0x10043655
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x1004365b
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.100440b0
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x10043696
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x10043673
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x10043675
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.10044290
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x100436a9
mov ecx, esi
call fcn.100436f0
cmp dword [esi + 0x6af90], 0
jne 0x100434d3
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x100436ca
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x100436cc
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.10044290
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100453d0
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
xor ebx, ebx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov word [eax + 0x18], cx
push edi
mov byte [eax + 0x1a], cl
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, 0x41
mov dword [ebp - 0xc], eax
lea esi, [ebx + 1]
mov dword [ebp - 8], edi
cmp ebx, 0x1a
jge 0x10045547
test eax, esi
je case.0x1004544b.64
push edi
push str._c:_
lea eax, [ebp - 0x40]
push 0x21
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
add esp, 0x10
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.0x1004544b.64
jmp dword [eax*4 + 0x10045574]
mov eax, esi
xor cl, cl
test al, 1
jne 0x10045463
inc cl
shr eax, 1
cmp cl, 0x1a
jl 0x10045456
mov eax, dword [ebp + 8]
add cl, 0x41
mov byte [ebx + eax], cl
inc ebx
mov dword [ebp - 4], ebx
jmp case.0x1004544b.64
push edi
push str.__c:
push 0x12b
lea eax, [ebp - 0x16c]
push 0x12c
push eax
call dword [sym.imp.MSVCR120.dll__snprintf_s]
add esp, 0x14
mov byte [ebp - 0x41], 0
lea eax, [ebp - 0x16c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1004552f
push 0x227
call fcn.10013326
add esp, 4
mov dword [ebp - 0x1c], 0
mov edi, eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
push 0
push eax
push 0x227
push edi
push 0xc
lea eax, [ebp - 0x1c]
mov dword [edi + 4], 0x227
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004551b
cmp dword [edi + 0x1c], 7
jne 0x1004551b
push esi
call fcn.10045590
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov byte [ecx + edx], al
inc ecx
mov dword [ebp - 4], ecx
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
inc edi
rol esi, 1
mov dword [ebp - 8], edi
lea eax, [edi - 0x41]
cmp eax, 0x20
mov eax, dword [ebp - 0xc]
jb 0x10045412
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
xor cl, cl
test al, 1
jne 0x10045463
inc cl
shr eax, 1
cmp cl, 0x1a
jl 0x10045554
mov eax, dword [ebp + 8]
add cl, 0x41
mov byte [ebx + eax], cl
inc ebx
mov dword [ebp - 4], ebx
jmp case.0x1004544b.64