joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90a2d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.0903cac1
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2d9d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.0903cac1
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2db4
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2e10
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2e03
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.0903cac1
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.0903cac1
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2eac
sub dword [ebp - 0x13d8], 1
jne 0x90a2ea2
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2dec
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.0903cac1
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.0903cac1
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.0903cac1
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0903cac1
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.0903cac1
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.0903cac1
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.0903cac1
int3
Function at 0x1001809
Capabilities:
Authenticate hmac

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100c010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
movzx esi, word [ebp + 0xc]
cmp esi, 0x40
push edi
mov dword [ebp - 0xc], eax
jg 0x1001c23
je 0x100442e
xor edi, edi
cmp esi, 0x15
jg 0x1001ce1
je 0x1004f54
cmp esi, 5
jle 0x1003b51
sub esi, 6
je 0x1004280
dec esi
je 0x100446f
sub esi, 8
jne 0x1004e8c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001564
leave
ret 0xc
cmp esi, 0x41
je 0x1001cb6
cmp esi, 0x2ff
jle 0x1004438
xor edi, edi
cmp esi, 0x301
jle 0x1001c8a
cmp esi, 0x302
jne 0x10050fc
call dword [0x1001260]
mov ecx, dword [0x100c028]
cmp eax, ecx
jne 0x1004487
push edi
push edi
push esi
push ecx
call dword [0x1001294]
jmp 0x100186a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xb0
push dword [0x100c028]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call dword [0x1001234]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x1001c4e
jmp 0x100186a
push 2
push dword [0x100c08c]
call dword [0x1001288]
push eax
push 0x10015bc
push dword [0x100c2d0]
push dword [0x100c020]
call dword [0x100137c]
jmp 0x100186a
cmp esi, 0x1a
jg 0x1001d63
je 0x100447b
sub esi, 0x16
je 0x1004f3c
dec esi
je 0x1004ee0
dec esi
je 0x1004ead
dec esi
jne 0x1004438
push dword [0x100c020]
call dword [0x1001264]
mov esi, dword [0x1001234]
xor edi, edi
push edi
push edi
push 0xe
push dword [0x100c028]
mov ebx, eax
call esi
push eax
push edi
push 0xb1
push dword [0x100c028]
call esi
push edi
push edi
push 0xb7
push dword [0x100c028]
call esi
push 1
push 0x19
push 1
push ebx
call dword [0x1001254]
push eax
call dword [0x1001250]
jmp 0x100186a
push 0x1b
pop ebx
sub esi, ebx
je 0x100507c
sub esi, 5
je 0x1004f97
dec esi
jne 0x1004438
xor edi, edi
push 0x38
lea eax, [ebp - 0x58]
push edi
push eax
mov dword [ebp - 0x5c], edi
call fcn.010015b5
add esp, 0xc
push edi
call dword [0x1001278]
mov ebx, eax
cmp ebx, edi
je 0x100186a
mov eax, dword [ebp - 0xc]
push 0x2d0
push 0x5a
mov esi, 0x100c200
push ebx
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], esi
call dword [0x100119c]
push eax
push dword [0x100c004]
call dword [0x10010c0]
neg eax
mov dword [0x100c200], eax
push ebx
mov eax, 0x2000
push edi
mov dword [ebp - 0x48], 0x1000041
mov word [ebp - 0x2c], ax
call dword [0x1001284]
lea eax, [ebp - 0x5c]
push eax
call dword [0x1001348]
test eax, eax
je 0x100186a
push dword [0x100c090]
mov ebx, dword [0x1001220]
call ebx
push esi
call dword [0x100114c]
mov esi, eax
cmp esi, edi
je 0x1001e4a
push dword [0x100c088]
call dword [0x10011a0]
push 1
push esi
push 0x30
push dword [0x100c028]
mov dword [0x100c088], esi
call dword [0x1001234]
mov eax, dword [ebp - 0x4c]
mov dword [0x100c004], eax
push dword [0x100c094]
call ebx
mov dword [0x100c03c], 1
jmp 0x100186a
Function at 0x1008b6e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1008c6a
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x1008bac
call ebx
test eax, eax
jne 0x1008c67
and edi, 0xffff7fff
cmp edi, 2
jne 0x1008bf7
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x1008bcf
call ebx
cmp eax, 6
je 0x1008bf7
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1008bd5
push esi
sub eax, edx
lea ecx, [ebp - 0x10]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1008c67
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push esi
push eax
call edi
mov ebx, eax
cmp ebx, esi
je 0x1008c67
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1008c67
push esi
push esi
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push dword [ebp - 0xc]
call edi
cmp eax, esi
je 0x1008c56
push esi
lea ecx, [ebp - 0x10]
push ecx
dec eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100909e
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x101fd98
call fcn.01009b04
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1022718
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1008eb3
cmp eax, esi
jne 0x1008ea6
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1008eb6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008e8d
xor esi, esi
inc esi
mov eax, dword [0x1022714]
cmp eax, esi
jne 0x1008ec9
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1008f04
mov eax, dword [0x1022714]
test eax, eax
jne 0x1008efe
mov dword [0x1022714], esi
push 0x1001338
push 0x100132c
call fcn.01008e0a
pop ecx
pop ecx
test eax, eax
je 0x1008f04
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1008fce
mov dword [0x10223bc], esi
mov eax, dword [0x1022714]
cmp eax, esi
jne 0x1008f28
push 0x1001328
push 0x1001320
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1022714], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1008f35
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1022720], ebx
je 0x1008f56
push 0x1022720
call fcn.01009a79
pop ecx
test eax, eax
je 0x1008f56
push ebx
push 2
push ebx
call dword [0x1022720]
push dword [0x10223a4]
push dword [0x10223a8]
push dword [0x10223a0]
call fcn.0100885c
add esp, 0xc
mov dword [0x10223b8], eax
cmp dword [0x10223ac], ebx
jne 0x1008fb4
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10223bc], ebx
jne 0x1008fc2
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10223b8]
call fcn.01009b49
ret
call fcn.01009c51
jmp 0x1008e6b
Function at 0x100c0e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100c116
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01009179
add esp, 0x14
jmp 0x100c1f4
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100c1f4
test al, 0x40
jne 0x100c1f4
test al, 2
je 0x100c138
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100c1f4
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100c0f8
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100c1e4
cmp eax, 0xffffffff
je 0x100c1e4
test byte [esi + 0xc], 0x82
jne 0x100c1b9
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100c1a4
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100c1a4
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100c1a9
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100c1b9
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100c1d7
mov eax, dword [esi + 0xc]
test al, 8
je 0x100c1d7
test eax, 0x400
jne 0x100c1d7
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x100c1f7
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100da17
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100da46
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01009179
add esp, 0x14
jmp 0x100db30
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100db30
test al, 0x40
jne 0x100db30
test al, 2
je 0x100da68
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100db30
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100da28
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100db20
cmp eax, 1
je 0x100db20
cmp eax, 0xffffffff
je 0x100db20
test byte [esi + 0xc], 0x82
jne 0x100daf2
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100dadd
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100dadd
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100dae2
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100daf2
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100db10
mov eax, dword [esi + 0xc]
test al, 8
je 0x100db10
test eax, 0x400
jne 0x100db10
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100db35
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100fa13
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100fa2e
test al, 0x50
jne 0x100fa2e
inc esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100fade
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x105
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x100fb46
push edi
push edi
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov esi, eax
cmp esi, edi
je 0x100fb46
test byte [ebp - 0x214], 8
jne 0x100fb46
push 0x32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010090b9
leave
ret 4

Function at 0x100fb5d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, 0x80
cmp ebx, esi
je 0x100fb9c
test ebx, 0xffffff78
je 0x100fb9c
push dword [ebp + 8]
and dword [ebp + 0xc], 0
push ebx
push 0x1002d08
push 4
call fcn.01011772
add esp, 0x10
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100fc2a
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100fbe1
and dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.01011513
cmp esi, 2
je 0x100fbcf
push esi
push edi
push 0x1002ca8
push 3
jmp 0x100fc1a
push edi
push 0x1002c48
push 2
call fcn.01011772
add esp, 0xc
jmp 0x100fc22
and eax, 0x3120
or eax, ebx
or eax, esi
cmp eax, esi
je 0x100fbf3
and eax, 0xffffff7f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100fc29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.01011513
push esi
push edi
push 0x1002be8
push 4
call fcn.01011772
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1010fa5
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push 1
push eax
mov dword [ebp - 8], 0x1003ad0
call fcn.01012139
mov esi, eax
test esi, esi
je 0x1010fdd
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0101243a
mov esi, eax
cmp dword [ebp - 4], 0
je 0x1010ff5
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
leave
ret 8

Function at 0x101113a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x1011165
and dword [0x102272c], esi
jmp 0x1011282
cmp word [edi], 0x5c
jne 0x10111d6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1011170
push 2
sub eax, edx
pop ecx
sar eax, 1
mov dword [ebp - 0x210], eax
mul ecx
lea ecx, [ebp - 0x210]
push ecx
push edx
push eax
call fcn.01010cef
mov esi, eax
test esi, esi
jl 0x1011282
lea eax, [ebp - 0x210]
push eax
push 2
push dword [ebp - 0x210]
call fcn.01010d21
mov esi, eax
test esi, esi
jl 0x1011282
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100952e
add esp, 0xc
jmp 0x1011247
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10111f7
mov esi, 0xc000000d
jmp 0x1011282
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1011200
push 2
sub eax, edx
pop ecx
sar eax, 1
mov dword [ebp - 0x210], eax
mul ecx
lea ecx, [ebp - 0x210]
push ecx
push edx
push eax
call fcn.01010cef
mov esi, eax
test esi, esi
jl 0x1011282
lea eax, [ebp - 0x210]
push eax
push 2
push dword [ebp - 0x210]
call fcn.01010d21
mov esi, eax
test esi, esi
jl 0x1011282
push dword [ebp - 0x210]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x102272c], eax
test eax, eax
jne 0x101126c
mov esi, 0xc0000017
jmp 0x1011282
push dword [ebp - 0x210]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
setge al
pop edi
xor ecx, ebp
pop esi
call fcn.010090b9
leave
ret 4
Function at 0x101153b
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
jne 0x10115b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x101159d
cmp esi, 3
je 0x101159d
push esi
push ebx
call fcn.01011513
push esi
push ebx
push 0x1004178
push 4
call fcn.01011772
add esp, 0x10
jmp 0x10116b8
push ebx
push 0x10040e8
push 2
call fcn.01011772
add esp, 0xc
jmp 0x10116b8
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10115e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011513
push dword [ebp - 4]
push ebx
push 0x1004080
push 4
call fcn.01011772
add esp, 0x10
jmp 0x10116ac
cmp dword [ebp - 0xc], esi
je 0x1011610
push 0x57
pop eax
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011513
push ebx
push 0x1004050
push 4
call fcn.01011772
add esp, 0xc
jmp 0x10116ac
push esi
push dword [ebp - 0x10]
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, esi
jne 0x101164a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011513
push dword [ebp - 4]
push ebx
push 0x1003ff0
push 4
call fcn.01011772
add esp, 0x10
jmp 0x10116a1
push dword [ebp - 0x10]
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
jne 0x1011686
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011513
push dword [ebp - 4]
push ebx
push 0x1003f98
push 4
call fcn.01011772
add esp, 0x10
jmp 0x101169c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
cmp dword [ebp - 8], esi
jne 0x10116bf
cmp edi, esi
je 0x10116ac
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc