joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a0e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x102c5070], 0
je 0x1006a2ef
push esi
mov esi, dword [ebp + 8]
mov eax, 0x917636
push esi
call eax
mov edx, 0x91850f
mov ecx, eax
call edx
mov edx, eax
test edx, edx
je 0x1006a2ee
test esi, esi
js 0x1006a182
cmp esi, 0xe00
jge 0x1006a12a
cmp dword [0x102c5078], 0
jmp 0x1006a1cb
cmp esi, 0x1800
jge 0x1006a13e
cmp dword [0x102c5074], 0
jmp 0x1006a1cb
cmp esi, 0x1831
jl 0x1006a152
cmp esi, 0x1832
jle 0x1006a2ee
cmp esi, 0x1828
je 0x1006a2ee
cmp esi, 0x1882
je 0x1006a2ee
cmp esi, 0x1887
je 0x1006a2ee
cmp esi, 0x1a1e
je 0x1006a2ee
xor ecx, ecx
mov eax, 0x100decf4
nop dword [eax]
cmp ecx, 0x63
ja 0x1006a1ac
cmp dword [eax], ecx
jne 0x1006a1ac
test eax, eax
je 0x1006a1ac
cmp dword [eax + 4], esi
jne 0x1006a1ac
cmp dword [eax + 8], 1
je 0x1006a2ee
add eax, 0x4c
inc ecx
cmp eax, 0x100e0aa4
jl 0x1006a190
cmp byte [edx + 0x22e], 6
jne 0x1006a2ee
cmp dword [0x102c507c], 0
je 0x1006a2ee
mov esi, dword [ebp + 0xc]
test esi, esi
js 0x1006a2ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1027a878]
cmp eax, 0x3e8
jb 0x1006a2ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1027a878], eax
mov ecx, 0x10276dcc
lea eax, [ebp + 8]
mov byte [0x1027a87d], 1
push eax
lea eax, [ebp - 0xc]
mov dword [0x11c4454], 1
push eax
mov dword [0x10276de4], esi
mov dword [ebp + 8], esi
call fcn.10042020
mov eax, dword [ebp - 4]
mov ecx, dword [0x10276dcc]
cmp byte [eax + 0xd], 0
jne 0x1006a23e
cmp esi, dword [eax + 0x10]
jge 0x1006a240
mov eax, ecx
cmp eax, ecx
jne 0x1006a255
mov dword [0x10276e0c], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
movups xmm1, xmmword [eax + 0x14]
movups xmmword [0x10276e0c], xmm1
movups xmm2, xmmword [eax + 0x24]
movups xmmword [0x10276e1c], xmm2
movq xmm0, qword [eax + 0x34]
movq qword [0x10276e2c], xmm0
movaps xmm0, xmm1
mov eax, dword [0x10276e2c]
psrldq xmm0, 4
movd dword [0x10276de8], xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
movd dword [0x10276dec], xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
movd dword [0x10276df8], xmm0
movaps xmm0, xmm2
movd dword [0x10276df4], xmm2
psrldq xmm1, 0xc
psrldq xmm0, 8
psrldq xmm2, 0xc
mov dword [0x10276e04], eax
mov eax, dword [0x10276e30]
movd dword [0x10276df0], xmm1
movd dword [0x10276dfc], xmm0
movd dword [0x10276e00], xmm2
mov dword [0x10276e08], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1006ad40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x102c4f44], 0
je 0x1006af49
push edi
mov edi, 0x936aac
call edi
mov edx, 0x4e245f
mov ecx, dword [eax + 0x124]
call edx
test al, al
jne 0x1006af48
push esi
call edi
mov esi, 0x927c78
mov ecx, dword [eax + 0x94]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0xb8]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0xec]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x12c]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x100]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0xdc]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x19c]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x18c]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x9c]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x180]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x17c]
call esi
test al, al
jne 0x1006af47
call edi
mov ecx, dword [eax + 0x16c]
call esi
test al, al
jne 0x1006af47
push ebx
push 0x39
mov esi, 0x7fc95b
call esi
mov ebx, 0x7fb628
mov ecx, eax
call ebx
test al, al
jne 0x1006af46
push 1
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1006af46
push 0x41
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1006af46
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x102778d8]
cmp eax, 0x5dc
jb 0x1006af46
call esi
cmp byte [0x102778dd], 1
mov dword [0x102778d8], eax
jne 0x1006aeca
pop ebx
pop esi
mov byte [0x102778dd], 0
mov dword [0x11c4454], 0
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, 0x10276e38
call fcn.10073e40
xorps xmm0, xmm0
mov dword [0x108474dc], 0
movups xmmword [0x108474cc], xmm0
mov eax, 0x32
mov ecx, 0xffff
mov word [0x10847534], cx
mov word [0x108487f4], cx
sub eax, 1
jne 0x1006aef2
mov dword [ebp - 7], eax
lea edx, [eax + 5]
mov byte [0x102778dd], 1
lea ecx, [ebp - 8]
mov dword [0x11c4454], 1
mov dword [ebp - 8], 0xe8f305c1
mov byte [ebp - 4], 3
call fcn.10098a10
call edi
mov eax, dword [eax + 0x94]
mov esi, dword [eax]
call edi
mov ecx, dword [eax + 0x94]
mov eax, dword [esi + 0x3c]
call eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1006cf80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x102778dd], 0
je 0x1006d14d
mov eax, dword [0x104f9dc8]
xorps xmm4, xmm4
movss xmm1, dword [0x11b3794]
add eax, 0x140
movss xmm0, dword [0x100d183c]
movd xmm3, eax
xor eax, eax
comiss xmm0, xmm1
cvtdq2ps xmm3, xmm3
setae al
movd xmm5, eax
cvtdq2ps xmm5, xmm5
mulss xmm3, xmm1
ucomiss xmm5, xmm4
lahf
test ah, 0x44
jnp 0x1006cfd6
movaps xmm0, xmm1
jmp 0x1006cfde
movss xmm0, dword [0x11b3798]
mulss xmm0, dword [0x100d1e74]
ucomiss xmm5, xmm4
subss xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1006cff8
movaps xmm2, xmm1
jmp 0x1006d000
movss xmm2, dword [0x11b3798]
mulss xmm2, dword [0x100d1d58]
ucomiss xmm5, xmm4
addss xmm2, xmm3
lahf
test ah, 0x44
jnp 0x1006d01a
movaps xmm0, xmm1
jmp 0x1006d022
movss xmm0, dword [0x11b3798]
ucomiss xmm5, xmm4
mulss xmm0, xmm4
lahf
addss xmm0, xmm2
divss xmm0, xmm1
test ah, 0x44
jnp 0x1006d03c
movaps xmm3, xmm1
jmp 0x1006d044
movss xmm3, dword [0x11b3798]
movss xmm6, dword [0x100d1d9c]
mulss xmm3, xmm6
ucomiss xmm5, xmm4
addss xmm3, xmm2
lahf
divss xmm3, xmm1
movss dword [ebp - 4], xmm3
test ah, 0x44
jnp 0x1006d06b
movaps xmm2, xmm1
jmp 0x1006d073
movss xmm2, dword [0x11b3798]
mulss xmm2, xmm6
push ebx
push esi
push edi
divss xmm2, xmm1
push 0xd2
cvttss2si eax, xmm0
cvttss2si ebx, xmm2
push ebx
push 0x50
push eax
mov eax, 0x799756
call eax
mov edi, dword [ebp + 8]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 1
jne 0x1006d0ea
cmp word [edi + 0x16], 0
jle 0x1006d0c6
call esi
sub eax, dword [0x108474ec]
cmp eax, 0x32
jbe 0x1006d0ea
mov eax, dword [0x108474d8]
test eax, eax
jle 0x1006d0ea
dec eax
jmp 0x1006d0de
call esi
sub eax, dword [0x108474ec]
cmp eax, 0x32
jbe 0x1006d0ea
mov eax, dword [0x108474d8]
cmp eax, 0xc
jge 0x1006d0ea
inc eax
mov dword [0x108474d8], eax
call esi
mov dword [0x108474ec], eax
cvttss2si eax, dword [ebp - 4]
push 0xd2
push ebx
push 0x50
push eax
mov eax, 0x799756
call eax
add esp, 0x10
cmp al, 1
jne 0x1006d14a
cmp word [edi + 0x16], 0
jle 0x1006d126
call esi
sub eax, dword [0x108474ec]
cmp eax, 0x32
jbe 0x1006d14a
mov eax, dword [0x108474dc]
test eax, eax
jle 0x1006d14a
dec eax
jmp 0x1006d13e
call esi
sub eax, dword [0x108474ec]
cmp eax, 0x32
jbe 0x1006d14a
mov eax, dword [0x108474dc]
cmp eax, 0xc
jge 0x1006d14a
inc eax
mov dword [0x108474dc], eax
call esi
mov dword [0x108474ec], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10076050
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x100db040]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
mov dword [0x10849ac8], 0x100d0484
mov ecx, 0x2000
mov eax, 0x10849ad0
xor edx, edx
mov byte [eax - 4], 0
mov word [eax - 2], dx
lea eax, [eax + 0x10]
mov byte [eax - 0x10], dl
mov word [eax - 0xe], dx
mov byte [eax - 0xc], dl
mov dword [eax - 8], edx
sub ecx, 1
jne 0x10076081
xor eax, eax
mov byte [0x10869acc], dl
push str.DataLocalItemAddOption.bmd
lea ecx, [esp + 0x14]
mov word [0x10869ace], ax
mov byte [0x10869ad0], al
mov word [0x10869ad2], ax
mov byte [0x10869ad4], al
mov dword [0x10869ad8], eax
call fcn.10017800
cmp dword [esp + 0x24], 0xf
lea eax, [esp + 0x10]
push 0x100cd104
cmova eax, dword [esp + 0x14]
push eax
call fcn.100a3afa
mov edi, eax
add esp, 8
test edi, edi
je 0x100761ad
push edi
push 1
push 0x20000
push 0x10849acc
call fcn.100a3f78
add esp, 0x10
mov word [esp + 0xc], 0xcffc
xor esi, esi
mov byte [esp + 0xe], 0xab
lea ebx, [esi + 2]
nop dword [eax]
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xc]
lea ecx, [ebx - 1]
xor byte [esi + 0x10849acc], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xd]
mov ecx, esi
xor byte [esi + 0x10849acd], al
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xe]
lea ecx, [ebx + 1]
xor byte [esi + 0x10849ace], al
add ebx, 4
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xf]
xor byte [esi + 0x10849acf], al
add esi, 4
cmp ebx, 0x20002
jl 0x10076120
push edi
call fcn.100a3d6f
add esp, 4
mov bl, 1
jmp 0x100761af
xor bl, bl
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x100761e1
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100761d7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10076251
push ecx
push edx
call fcn.100a01e3
add esp, 8
test bl, bl
jne 0x10076237
push 0xff
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.100a23c0
add esp, 0xc
lea eax, [esp + 0x28]
push str.DataLocalItemAddOption.bmd
push str._s___File_not_exist.
push eax
call fcn.10011730
add esp, 0xc
lea eax, [esp + 0x28]
push 0
push 0
push eax
push dword [0x11c3e7c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
push dword [0x11c3e7c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x12c]
mov eax, 0x10849ac8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
call fcn.100a95e0
int3
Function at 0x10094190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100db040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1f8], 0
je 0x100941f5
lea ecx, [ebp - 0x408]
call fcn.100049f0
push ecx
lea eax, [ebp - 0x40c]
push eax
lea eax, [esi + 0x1bb]
push eax
lea ecx, [ebp - 0x408]
call fcn.10004b20
test al, al
je 0x10094204
mov eax, dword [esi + 0x1f8]
cmp eax, dword [ebp - 0x40c]
jne 0x10094204
push ecx
mov ecx, esi
call fcn.10094230
mov ecx, esi
call fcn.100944f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100a0150
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push str.CheckSumFile_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100944f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x100db040]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x232bc0]
cmp esi, dword [edi + 0x232bc4]
je 0x10094589
lea ebx, [edi + 0x232bcc]
lea ecx, [esp + 0x18]
call fcn.100049f0
push esi
push str.CheckSum_Error__file:__s_
push ebx
call fcn.1007cb60
add esp, 0xc
lea eax, [esp + 0x10]
push 0x100cfbe0
push esi
push eax
call fcn.100a3b11
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x1009459e
push eax
call fcn.100a3d6f
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.10004b20
test al, al
je 0x1009459e
mov eax, dword [esi + 0x80]
cmp eax, dword [esp + 0x14]
jne 0x1009459e
add esi, 0x84
cmp esi, dword [edi + 0x232bc4]
jne 0x10094523
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10099360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100db040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x118d320], 5
jne 0x100995a1
cmp dword [0x10643bc0], 2
je 0x100995a1
cmp dword [0x10643ba0], 0
je 0x10099445
mov byte [0x8b159e3], 0
cmp dword [0x118d320], 5
jne 0x100993da
mov eax, 0x870a77
call eax
mov eax, 0x4dbf16
call eax
mov eax, 0x6d3d57
call eax
mov eax, 0x936aac
call eax
mov edx, 0x98213a
mov ecx, dword [eax + 0xcc]
call edx
mov eax, 0x62d9d6
call eax
mov eax, 0x62a1cf
call eax
mov dword [0x118d320], 2
mov eax, 0x4e210f
mov byte [0x11c4464], 0
mov word [0x11c4466], 0
mov byte [0x11c4436], 0
mov dword [0x8b15884], 0
mov dword [0x8b159f4], 0
call eax
mov edx, 0x4f7365
mov ecx, eax
call edx
mov eax, 0x6360aa
call eax
mov dword [0x10643ba0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [0x102c4d88]
mov dword [0x10643bc0], 1
mov dword [0x10643bbc], 0
call esi
mov dword [0x10643bb8], eax
call esi
mov dword [0x10643bb4], eax
xor esi, esi
mov eax, dword [0x11c4494]
mov ecx, 0x43734e
mov dword [0x10643bb0], 0x7530
mov dword [0x10643bac], edi
mov dword [0x10643ba8], 0
movzx eax, byte [eax + 8]
mov dword [0x10643ba4], eax
nop word [eax + eax]
xor al, al
mov edi, 6
mov byte [ebp - 0x105], al
mov ebx, 4
lea eax, [ebp - 0x100]
sub edi, eax
nop word [eax + eax]
push esi
call ecx
mov ecx, eax
mov eax, 0x9265d0
call eax
test eax, eax
je 0x10099527
cmp byte [eax + 0x328], 0
je 0x10099527
movzx ecx, word [eax + 0x7e]
mov eax, ecx
mov byte [ebp - 0x10b], cl
shr eax, 8
mov byte [ebp - 0x10c], al
lea eax, [edi + ebx]
lea eax, [ebp + eax - 0x104]
cmp eax, 0x100
ja 0x10099535
mov ax, word [ebp - 0x10c]
mov word [ebp + ebx - 0x104], ax
add ebx, 2
inc byte [ebp - 0x105]
inc esi
mov ecx, 0x43734e
cmp esi, 0x190
jb 0x100994d0
mov al, byte [ebp - 0x105]
push 0xffffffffffffffff
mov byte [ebp - 0x101], al
lea eax, [ebp - 0x104]
push ebx
push eax
push 0x14
mov byte [ebp - 0x104], 0xc1
mov byte [ebp - 0x103], bl
mov byte [ebp - 0x102], 0x14
call int.100947f0
add esp, 0x10
mov ecx, 0x43734e
cmp esi, 0x190
jb 0x100994b0
mov ecx, dword [0x8499dcc]
pop edi
pop esi
pop ebx
movq xmm0, qword [ecx]
movq qword [0x10643bd4], xmm0
mov ax, word [ecx + 8]
mov word [0x10643bdc], ax
mov al, byte [ecx + 0xa]
mov byte [0x10643bde], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a0150
mov esp, ebp
pop ebp
ret

Function at 0x10099cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10099d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x10099d30
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10099d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.100a1e40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10099e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100db040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100a23c0
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
call fcn.10075de0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10099fd0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d86c8
push 0x100a1c70
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x100db040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x148], edx
push ecx
push str..PhysicalDrive_d
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x14c], esi
cmp esi, 0xffffffff
je 0x1009a177
mov dword [ebp - 0x130], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x140], xmm0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
push 0
lea eax, [ebp - 0x144]
push eax
push 8
lea eax, [ebp - 0x140]
push eax
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1009a0af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1009a177
push dword [ebp - 0x13c]
call fcn.100a08b7
mov edi, eax
mov dword [ebp - 0x150], edi
push dword [ebp - 0x13c]
push 0
push edi
call fcn.100a23c0
add esp, 0x10
push 0
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x13c]
push edi
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1009a167
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1009a167
mov dword [ebp - 4], 0
add eax, edi
push eax
push 0x100
push dword [ebp - 0x148]
call fcn.100a9652
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100a08c0
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1009a179
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100a08c0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
Function at 0x1009eb30
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
mov ecx, 0x78
push edi
call fcn.1009ea80
mov esi, dword [esp + 0x1c]
mov ebp, eax
xor edx, edx
nop dword [eax + eax]
movzx ecx, byte [edx + str.91__]
dec ecx
mov eax, ecx
and ecx, 7
sar eax, 3
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100cd3f4], al
movzx ecx, byte [edx + 0x100cd455]
setne al
dec ecx
mov byte [edx + ebp], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100cd3f4], al
movzx ecx, byte [edx + 0x100cd456]
setne al
dec ecx
mov byte [edx + ebp + 1], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100cd3f4], al
movzx ecx, byte [edx + 0x100cd457]
setne al
dec ecx
mov byte [edx + ebp + 2], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100cd3f4], al
setne al
mov byte [edx + ebp + 3], al
add edx, 4
cmp edx, 0x38
jl 0x1009eb50
xor ebx, ebx
nop word [eax + eax]
movzx esi, byte [ebx + 0x100cd444]
xorps xmm0, xmm0
movq qword [ebp + 0x70], xmm0
xor edx, edx
lea edi, [esi - 0x1c]
cmp edx, 0x1c
mov ecx, esi
sbb eax, eax
and eax, 0xffffffe4
add eax, 0x38
cmp esi, eax
cmovge ecx, edi
inc esi
inc edi
mov al, byte [ecx + ebp]
mov byte [edx + ebp + 0x38], al
inc edx
cmp edx, 0x38
jl 0x1009ec04
xor ecx, ecx
nop word [eax + eax]
movzx eax, byte [ecx + 0x100cd414]
cmp byte [eax + ebp + 0x37], 0
je 0x1009ec61
mov eax, 0xaaaaaaab
mul ecx
mov eax, ecx
shr edx, 2
lea esi, [edx + ebp]
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
mov eax, dword [eax*4 + 0x100cd3f4]
sar eax, 2
or byte [esi + 0x70], al
inc ecx
cmp ecx, 0x30
jl 0x1009ec30
movzx ecx, byte [ebp + 0x70]
movzx eax, byte [ebp + 0x72]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x74]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x76]
shl ecx, 8
or ecx, eax
mov eax, dword [edx + 0x8c]
mov dword [eax + ebx*8], ecx
movzx ecx, byte [ebp + 0x71]
movzx eax, byte [ebp + 0x73]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x75]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x77]
shl ecx, 8
or ecx, eax
mov eax, dword [edx + 0x8c]
mov dword [eax + ebx*8 + 4], ecx
inc ebx
cmp ebx, 0x10
jl 0x1009ebf0
cmp dword [esp + 0x18], 1
jne 0x1009ed15
xor ebx, ebx
mov edi, 0x7c
mov eax, dword [edx + 0x8c]
mov ecx, dword [eax + ebx]
lea edx, [eax + ebx]
lea esi, [eax + edi]
mov eax, dword [esi - 4]
mov dword [edx], eax
mov dword [esi - 4], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x8c]
mov ecx, dword [eax + ebx + 4]
lea edx, [eax + ebx]
lea esi, [eax + edi]
sub edi, 8
mov eax, dword [esi]
lea ebx, [ebx + 8]
mov dword [edx + 4], eax
mov edx, dword [esp + 0x10]
mov dword [esi], ecx
cmp edi, 0x3c
jg 0x1009ecd4
xor al, al
mov edi, ebp
mov ecx, 0x78
rep stosb byte es:[edi], al
push ebp
call fcn.100a40b3
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x1009f780
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
mov ecx, esi
push 8
push dword [edi + 0x20]
call fcn.1009e6f0
mov ecx, dword [edi + 0x3c]
add esp, 8
add ecx, 4
push esi
push dword [esp + 0x14]
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
mov edx, dword [edi + 0x38]
mov ecx, 2
sub edx, esi
mov eax, dword [esi + edx]
lea esi, [esi + 4]
xor dword [esi - 4], eax
sub ecx, 1
jne 0x1009f7b6
pop edi
pop esi
ret 0xc

Function at 0x100b060c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100b064b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b064b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b064b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100b064b
cmp dword [ecx + 0x74], 0xe
jbe 0x100b064b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret