joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ba1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x2c], 0xffffffff
and dword [ebp - 0x28], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call sym.net.dll__ipv6_available_0
push edi
mov ebx, eax
call fcn.100065bc
pop ecx
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x10008be0
push edi
call fcn.100065e8
pop ecx
jmp 0x10008be3
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
jge 0x10008c01
test eax, eax
jns 0x10008c01
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
jmp 0x10008c63
cmp dword [ebp + 0x10], 2
mov dword [ebp - 0x28], 0x10
je 0x10008c1a
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10008c24
cmp dword [ebp - 0x24], 0xffffffff
jne 0x10008c2a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x24], 0xffffffff
je 0x10008bed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10008c55
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x10008bfd
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.1000c288
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0xc
Function at 0x1000939b
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x10012588]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100093d1
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e6
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10009405
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e5
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x100094d2
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1000947c
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.1000c288
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e4
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100094b6
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.1000c288
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e4
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x100094e4
push 0
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1000a553
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
call fcn.100091ff
push edi
mov ebx, eax
call fcn.1000922b
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0x14
test ebx, ebx
jns 0x1000a5cd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jns 0x1000a5cd
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0x10
cmp dword [ebp + 0x10], 0xf
jne 0x1000a670
push 0x1c
pop eax
push eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1000a5fa
push edi
call fcn.1000922b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x1000a622
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x1000a5b9
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.1000c288
mov edi, eax
test edi, edi
je 0x1000a5b9
push dword [ebp - 0x38]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x1000a5b9
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x38]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x1000a5bc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x1000a68e
push str.Invalid_option
jmp 0x1000a5ae
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 4
cmp edi, 0x80
je 0x1000a6a4
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call fcn.1000c288
test eax, eax
jns 0x1000a6ce
push str.getsockopt
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x1000a5b9
cmp edi, 8
jg 0x1000a6e9
je 0x1000a709
dec edi
je 0x1000a709
dec edi
dec edi
je 0x1000a71a
dec edi
je 0x1000a709
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x1000a5ae
cmp edi, 0x80
je 0x1000a722
cmp edi, 0x1000
jle 0x1000a6df
cmp edi, 0x1002
jle 0x1000a71a
cmp edi, 0x1003
jne 0x1000a6df
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x1000a5bc
mov eax, dword [ebp - 0x24]
jmp 0x1000a5bc
cmp word [ebp - 0x24], 0
je 0x1000a5b9
movzx eax, word [ebp - 0x22]
jmp 0x1000a5bc
Function at 0x1000bd72
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa8
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x1c], 5
ja 0x1000be06
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.ws2_32.dll_bind
mov dword [esi], 0x400
mov dword [esi + 4], 0x1387
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000be13
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push str.MaxUserPort
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0x24]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1000be13
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
jmp 0x1000be13
mov dword [esi], 0xc000
mov dword [esi + 4], 0xffff
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
xor eax, eax
call fcn.1000c212
add ebp, 0x78
leave
ret

Function at 0x1000c212
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100120b4]
jne 0x1000c21c
repz ret
jmp fcn.1000c5cb

Function at 0x1000c288
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000c297
pop dword [ebp - 0x4c]
mov eax, 0xfc43594d
sub eax, 0xec4296b6
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x814a5177
sub dword [ebp - 0x5c], 0x32f80c2c
mov dword [ebp - 0x58], 0x98b0b024
sub dword [ebp - 0x58], 0x667d63df
mov dword [ebp - 0x54], 0xacd53717
add dword [ebp - 0x54], 0x9f770d17
mov dword [ebp - 0x50], 0x4b9af8f6
sub dword [ebp - 0x50], 0x4b9af8f6
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x84bbff37
add eax, 0x8b44d105
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9d9b9029
sub dword [ebp - 0x5c], 0x292926d3
mov dword [ebp - 0x58], 0xb3f1180a
add dword [ebp - 0x58], 0x8d7b496b
mov dword [ebp - 0x54], 0x6731bf26
sub dword [ebp - 0x54], 0x3c252ba
mov dword [ebp - 0x50], 0x5150574d
sub dword [ebp - 0x50], 0x5150574d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34a5b
push 0
call eax
mov ecx, 0x149d92cb
sub ecx, 0x149d5580
xor edi, edi
add edi, eax
mov ebx, 0x10015200
add ebx, dword [ebp - 0x4c]
mov edx, 0x5e268b25
add edx, 0xb547bb5a
xor dword [ebp - 0x38], edx
mov esi, dword [ebx]
add dword [ebp - 8], edx
xor esi, edx
sub dword [ebp - 4], 0x674c39a6
mov dword [edi], esi
sub dword [ebp - 0x28], 0x9d4a7c49
add edi, 4
add ebx, 0xfb8fb815
sub ebx, 0xfb8fb811
loop 0x1000c3b0
add eax, 0x6ff0791b
sub eax, 0x6fef911c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001ba36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001ba45
pop dword [ebp - 0x24]
mov eax, 0xa24dd584
add eax, 0x6db3e4c1
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x39298
push 0
mov eax, 0xb87bac7b
add eax, 0x578634e9
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x599d7be2
sub ecx, 0x599d33d0
xor edx, edx
add edx, eax
mov edi, 0x57adb75f
sub edi, 0x47a9795f
add edi, dword [ebp - 0x24]
mov esi, 0x282f2c9f
add esi, 0x5d215bb9
xor dword [ebp - 0xc], 0xdca8dccf
mov ebx, dword [edi]
add dword [ebp - 0x20], 0x58feaa2b
sub ebx, esi
mov dword [edx], ebx
mov dword [ebp - 0x20], 0x89ea6a79
add edx, 0x6f11ba30
sub edx, 0x6f11ba2c
add edi, 0xae7e6072
sub edi, 0xae7e606e
loop 0x1001baa6
add eax, 0x8c93174
add eax, 0xf737e1a7
xor ebx, ebx
add ebx, eax
add eax, 0x82ac80e3
add eax, 0x7d537f22
mov ecx, 0x3994e6c2
add ecx, 0xd66b193e
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x483d60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x54000]
push edi
or ebp, 0xffffffff
jmp 0x483d82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x483d89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x483d78
mov eax, 1
add ebx, ebx
jne 0x483d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x483dac
jne 0x483dcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x483dcb
dec eax
add ebx, ebx
jne 0x483db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x483d90
add ebx, ebx
jne 0x483dc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x483e1d
xor ecx, ecx
sub eax, 3
jb 0x483de3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x483e52
sar eax, 1
mov ebp, eax
jmp 0x483dee
add ebx, ebx
jne 0x483dee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x483dbc
inc ecx
add ebx, ebx
jne 0x483dfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x483dbc
add ebx, ebx
jne 0x483e09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x483dfe
jne 0x483e1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x483dfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x483e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x483e2e
jmp 0x483d7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x483e3c
add edi, ecx
jmp 0x483d7e
pop esi
mov edi, esi
mov ecx, 0x268a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x483e5a
cmp byte [edi], 0x14
jne 0x483e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x483e5f
lea edi, [esi + 0x80000]
mov eax, dword [edi]
or eax, eax
je 0x483ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa53f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa54b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x483e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa54b8]
or eax, eax
je 0x483ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x483ea9
call dword [esi + 0xa54b4]
mov ebp, dword [esi + 0xa54bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x483f02
sub esp, 0xffffff80
jmp 0x44cb98
Function at 0x100144b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 8]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [0x10037310]
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [esp + 0x18], eax
mov eax, 0xc
push edx
mov dword [esp + 0x30], str.dummy
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x1001454c
mov eax, dword [0x10037310]
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0
push str.dummy
push str.dummy
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x1001454c
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
add esp, 0x28
ret

Function at 0x100168d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [0x1002b250]
xor edi, edi
mov dword [ebp - 4], eax
jmp 0x100168fb
xchg edi, edi
je 0x100168f3
xchg ebp, ebp
add eax, 0x5bc2758b
jmp 0x10016902
mov eax, 0x4275042e
jmp 0x100168ed
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov eax, ecx
dec ecx
test eax, eax
jbe 0x10016975
mov eax, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, esi
add edi, eax
mov eax, dword [ebp - 4]
shl ecx, 4
add ecx, eax
mov eax, esi
shr eax, 5
add eax, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, eax
lea eax, [edi + esi]
xor ecx, eax
mov eax, dword [ebp - 0x10]
add edx, ecx
mov ecx, edx
shl ecx, 4
add ecx, eax
mov eax, edx
shr eax, 5
add eax, ebx
xor ecx, eax
lea eax, [edi + edx]
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, ecx
dec eax
mov dword [ebp + 0xc], eax
jne 0x1001692d
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [0x1002b250]
jmp 0x100169ad
mov eax, ecx
jmp 0x100169be
mov ecx, 0x92073839
nop
nop
mov ebx, 0xc304180
or ecx, ebx
jmp 0x100169a9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, edi
shl eax, 5
dec edi
test ecx, ecx
jbe 0x10016a34
mov ecx, dword [ebp + 0xc]
inc edi
mov dword [ebp + 0xc], edi
mov ebx, dword [ecx + 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 8], ebx
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, esi
shr ecx, 5
add ecx, edi
mov edi, esi
shl edi, 4
add edi, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, edi
lea edi, [eax + esi]
xor ecx, edi
mov edi, dword [ebp - 0x10]
sub edx, ecx
mov ecx, edx
shr ecx, 5
add ecx, edi
mov edi, edx
shl edi, 4
add edi, ebx
xor ecx, edi
lea edi, [eax + edx]
xor ecx, edi
mov edi, dword [ebp - 4]
sub esi, ecx
mov ecx, dword [ebp + 0xc]
sub eax, edi
dec ecx
mov dword [ebp + 0xc], ecx
jne 0x100169ec
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10019310
Capabilities:
Get disk information

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push edi
mov edi, dword [esp + 0x40]
xor ebx, ebx
lea eax, [ebx + 0x41]
lea ecx, [esp + 0x40]
push eax
push 0x1002fc6c
push ecx
call fcn.1001cfc0
add esp, 0xc
lea edx, [esp + 0x40]
push edx
call esi
cmp eax, 5
jne 0x10019366
push edi
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.1001b400
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebp
je 0x10019377
inc ebx
cmp ebx, 0x1a
jb 0x10019327
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10019384
add bl, 0x41
mov byte [eax], bl
mov ax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x1001ac60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x50
push ebx
push esi
mov esi, dword [esp + 0x5c]
push edi
push 0x7f00
push 0
mov eax, dword [esi]
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], 0x1001abd0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 6
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x1001ace0
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov eax, dword [esi]
lea ecx, [esp + 0x60]
mov dword [0x10038de4], eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.1001aa10
mov edx, dword [esi]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push 0
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push 0x80000000
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x1001ad43
xor ax, ax
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov dword [0x10037fc4], esi
call fcn.1001a590
test ax, ax
je 0x1001ad57
xor edi, edi
jmp 0x1001ad63
push esi
mov edi, 1
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x10037fc4]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x24]
push edx
push eax
call esi
test eax, eax
je 0x1001adec
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x1c], 0x12
je 0x1001add3
lea ecx, [esp + 0x18]
push ecx
call edi
lea edx, [esp + 0x18]
push edx
call ebx
mov eax, dword [0x10037fc4]
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
call esi
test eax, eax
jne 0x1001ad9c
mov ax, 1
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x10037fc4]
push edx
push eax
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov ax, 1
pop ebx
add esp, 0x50
ret