joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10019940
test al, al
je 0x1001987f
mov eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.10066620
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100198c8
mov eax, dword [ebp - 0x114]
cmp eax, 5
jne 0x100198d8
mov eax, 1
cmp dword [ebp - 0x110], eax
je 0x100198ca
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x100198c8
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x100198fa
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10019912
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x100198c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 4
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10019a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [edi], 0x10126264
mov byte [edi + 4], bl
mov eax, 0xf
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], ebx
mov dword [ebp - 0x84], edi
mov byte [edi + 8], bl
mov dword [ebp - 4], ebx
mov dword [edi + 0x38], eax
mov dword [edi + 0x34], ebx
mov byte [edi + 0x24], bl
mov dword [edi + 0x54], eax
mov dword [edi + 0x50], ebx
mov byte [edi + 0x40], bl
mov dword [edi + 0x5c], 0x1012670c
mov dword [edi + 0x78], eax
mov dword [edi + 0x74], ebx
mov byte [edi + 0x64], bl
mov dword [edi + 0x94], eax
mov dword [edi + 0x90], ebx
mov byte [edi + 0x80], bl
mov dword [edi + 0x60], ebx
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 3
call fcn.10013d50
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x38], ebx
je 0x10019ac8
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x10019ab8
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x10019ad4
lea ecx, [ebp - 0x48]
push ecx
call fcn.1000d470
add esp, 4
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.1000b1b0
push eax
mov edx, 0x10126160
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.1000a500
add esp, 0xc
push eax
mov edx, 0x10126158
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.1000a500
add esp, 4
push eax
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 7
call fcn.10004040
mov esi, 0x10
cmp dword [ebp - 0x50], esi
jb 0x10019b2e
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10065453
add esp, 4
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
cmp dword [ebp - 0x6c], esi
jb 0x10019b4c
mov edx, dword [ebp - 0x80]
push edx
call fcn.10065453
add esp, 4
mov byte [ebp - 4], 4
mov dword [ebp - 0x6c], 0xf
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
cmp dword [ebp - 0x18], esi
jb 0x10019b6e
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
call fcn.1001ca40
add esp, 4
push eax
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 8
call fcn.10004040
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], esi
jb 0x10019b9c
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
lea eax, [ebp - 0x2c]
push eax
call fcn.1001cea0
add esp, 4
push eax
lea ecx, [edi + 8]
mov byte [ebp - 4], 9
call fcn.10004040
cmp dword [ebp - 0x18], esi
jb 0x10019bc6
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x34], 8
jb 0x10019bd8
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1001a2e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b0e6
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x448], edi
mov esi, edx
mov dword [ebp - 0x430], eax
cmp byte [edi + 4], bl
jne 0x1001a335
call fcn.10019c90
cmp al, bl
je 0x1001a4a6
push 0x3ff
lea ecx, [ebp - 0x40f]
push ebx
push ecx
mov byte [ebp - 0x410], bl
call fcn.10066620
mov ecx, 0x10
add esp, 0xc
cmp dword [esi + 0x14], ecx
jb 0x1001a35c
mov esi, dword [esi]
cmp dword [edi + 0x54], ecx
lea eax, [edi + 0x40]
jb 0x1001a366
mov eax, dword [eax]
push esi
push eax
push str.SELECT__FROM__s_WHERE_key_s
lea edx, [ebp - 0x410]
push 0x400
push edx
call fcn.100665ff
lea eax, [ebp - 0x410]
add esp, 0x14
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], ebx
mov byte [ebp - 0x42c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001a3a0
sub eax, edx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.10004560
mov dword [ebp - 4], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov edi, eax
add eax, 2
push eax
push 0x40
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x434], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp dword [ebp - 0x418], 0x10
mov esi, eax
mov eax, dword [ebp - 0x42c]
jae 0x1001a40c
lea eax, [ebp - 0x42c]
push edi
push eax
push esi
call fcn.10065960
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x44c]
push ecx
mov ecx, dword [eax + 0x60]
lea edx, [ebp - 0x444]
push edx
push 0x1002fbf0
push esi
push ecx
call fcn.10088310
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x440]
mov eax, dword [ebp - 0x444]
mov edx, ecx
sub edx, eax
and edx, 0xfffffff0
mov esi, 0x10
cmp edx, esi
je 0x1001a4aa
cmp eax, ebx
je 0x1001a47d
mov edx, dword [ebp - 0x430]
push edx
push ecx
call fcn.1001a690
mov eax, dword [ebp - 0x444]
push eax
call fcn.10065453
add esp, 0xc
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
cmp dword [ebp - 0x418], esi
jb 0x1001a4a6
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.10065453
add esp, 4
xor al, al
jmp 0x1001a515
mov edx, dword [eax]
mov ecx, dword [ebp - 0x430]
push 0xffffffffffffffff
push ebx
add edx, 0x1c
push edx
call fcn.10004180
mov eax, dword [ebp - 0x444]
cmp eax, ebx
je 0x1001a4ea
mov ecx, dword [ebp - 0x430]
mov edx, dword [ebp - 0x440]
push ecx
push edx
call fcn.1001a690
mov eax, dword [ebp - 0x444]
push eax
call fcn.10065453
add esp, 0xc
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
cmp dword [ebp - 0x418], esi
jb 0x1001a513
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.10065453
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b330
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a44b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1013ba54]
test edi, edi
jne 0x1001b396
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1001b385
mov esi, eax
call fcn.10011610
jmp 0x1001b387
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x2c]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10009ff0
lea eax, [ebp - 0x48]
push eax
call fcn.1001ad00
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x1001b3e5
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1001b41b
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1001b3f6
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1001b41b
cmp dword [ebp - 0x18], esi
jb 0x1001b417
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1001b42e
cmp dword [ebp - 0x18], esi
jb 0x1001b42c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1001b450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a44b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1013ba54]
test edi, edi
jne 0x1001b4b6
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1001b4a5
mov esi, eax
call fcn.10011610
jmp 0x1001b4a7
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x2c]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10009ff0
lea eax, [ebp - 0x48]
push eax
call fcn.1001a820
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x1001b505
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1001b53b
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1001b516
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1001b53b
cmp dword [ebp - 0x18], esi
jb 0x1001b537
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1001b54e
cmp dword [ebp - 0x18], esi
jb 0x1001b54c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1001b570
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a44b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1013ba54]
test edi, edi
jne 0x1001b5d6
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1001b5c5
mov esi, eax
call fcn.10011610
jmp 0x1001b5c7
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x2c]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10009ff0
lea eax, [ebp - 0x48]
push eax
call fcn.1001b030
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x1001b625
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1001b65b
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1001b636
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1001b65b
cmp dword [ebp - 0x18], esi
jb 0x1001b657
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1001b66e
cmp dword [ebp - 0x18], esi
jb 0x1001b66c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1001bf50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b061
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 0x1c]
push ecx
lea edx, [ebp - 0x9c]
xor ebx, ebx
push edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], ebx
call fcn.1000b1b0
mov edi, eax
lea eax, [esi + 0x54]
push eax
lea ecx, [ebp - 0xb8]
push ecx
mov dword [ebp - 4], ebx
call fcn.1000b1b0
mov dword [ebp - 0x144], eax
lea edx, [ebp - 0xd4]
push esi
push edx
mov byte [ebp - 4], 1
call fcn.1000b1b0
mov dword [ebp - 0x14c], eax
add esi, 0x38
lea eax, [ebp - 0x64]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.1000b1b0
mov ecx, dword [ebp - 0x14c]
push ecx
push eax
lea edx, [ebp - 0x48]
push edx
mov byte [ebp - 4], 3
call fcn.1001c190
mov ecx, dword [ebp - 0x144]
push ecx
push eax
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 4
call fcn.1001c190
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 5
call fcn.1001c190
add esp, 0x44
mov edi, 0x10
cmp dword [ebp - 0x6c], edi
jb 0x1001c036
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.10065453
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
cmp dword [ebp - 0x34], edi
jb 0x1001c055
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
cmp dword [ebp - 0x50], edi
jb 0x1001c06f
mov eax, dword [ebp - 0x64]
push eax
call fcn.10065453
add esp, 4
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
cmp dword [ebp - 0xc0], edi
jb 0x1001c08f
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.10065453
add esp, 4
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 0xd4], bl
cmp dword [ebp - 0xa4], edi
jb 0x1001c0b8
mov edx, dword [ebp - 0xb8]
push edx
call fcn.10065453
add esp, 4
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xb8], bl
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x88], edi
jb 0x1001c0e5
mov eax, dword [ebp - 0x9c]
push eax
call fcn.10065453
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
mov byte [ebp - 0xd8], bl
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x140], 0x67452301
mov dword [ebp - 0x13c], 0xefcdab89
mov dword [ebp - 0x138], 0x98badcfe
mov dword [ebp - 0x134], 0x10325476
cmp dword [ebp - 0x18], edi
jae 0x1001c13c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x140]
call fcn.10012b50
mov esi, dword [ebp - 0x148]
push esi
lea ecx, [ebp - 0x140]
call fcn.100135e0
cmp dword [ebp - 0x18], edi
jb 0x1001c16e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 4
Function at 0x100306b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100306c8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100306fa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x100306f6
cmp esi, eax
jae 0x100306fa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100306e8
cmp esi, eax
jb 0x10030700
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10030bb0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37d4
call fcn.10066d70
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x37d0], edi
mov dword [ebp - 0x37c8], edi
push edi
push str..PhysicalDrive_d
lea edx, [ebp - 0x108]
call fcn.10031220
add esp, 8
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10030d9c
xor eax, eax
push 0x2710
push eax
lea ecx, [ebp - 0x2fe8]
mov dword [ebp - 0x37c4], eax
mov dword [ebp - 0x37c0], eax
push ecx
mov dword [ebp - 0x37cc], eax
mov dword [ebp - 0x37bc], eax
mov dword [ebp - 0x37c4], eax
mov dword [ebp - 0x37c0], eax
call fcn.10066620
add esp, 0xc
push 0
lea edx, [ebp - 0x37cc]
push edx
push 0x2710
lea eax, [ebp - 0x2fe8]
push eax
push 0xc
lea ecx, [ebp - 0x37c4]
push ecx
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x10030d8f
mov eax, dword [ebp - 0x2fdc]
push 0
lea edi, [ebp - 0x33d0]
lea ecx, [ebp - 0x2fe8]
call fcn.10030a40
mov eax, dword [ebp - 0x2fd8]
push 0
lea edi, [ebp - 0x8d8]
lea ecx, [ebp - 0x2fe8]
call fcn.10030a40
mov eax, dword [ebp - 0x2fd4]
push 0
lea edi, [ebp - 0x37b8]
lea ecx, [ebp - 0x2fe8]
call fcn.10030a40
mov eax, dword [ebp - 0x2fd0]
push 1
lea edi, [ebp - 0x4f0]
lea ecx, [ebp - 0x2fe8]
call fcn.10030a40
add esp, 0x10
cmp byte [0x1013ba58], 0
jne 0x10030d50
movzx edx, byte [ebp - 0x4f0]
push edx
call fcn.10068b3c
add esp, 4
test eax, eax
jne 0x10030d17
movzx eax, byte [ebp - 0x4dd]
push eax
call fcn.10068b3c
add esp, 4
test eax, eax
je 0x10030d50
lea ecx, [ebp - 0x4f0]
push ecx
push 0x400
push 0x1013ba58
call fcn.10069f99
lea edx, [ebp - 0x8d8]
push edx
push 0x400
push 0x1013be58
call fcn.10069f99
add esp, 0x18
mov dword [ebp - 0x37d0], 1
push 0x2710
lea eax, [ebp - 0x2fe8]
push 0
push eax
call fcn.10066620
add esp, 0xc
push 0
lea ecx, [ebp - 0x37cc]
push ecx
push 0x2710
lea edx, [ebp - 0x2fe8]
push edx
push 0
push 0
push 0x700a0
push esi
call ebx
mov edi, dword [ebp - 0x37c8]
jmp 0x10030d95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [ebp - 0x37c8], edi
cmp edi, 0x10
jl 0x10030bde
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10031020
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1012307e
push 0x400
push 0x1013ba58
xor esi, esi
call fcn.10069f99
add esp, 0xc
push 0x114
lea eax, [ebp - 0x120]
push esi
push eax
call fcn.10066620
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x100310a5
call fcn.10030730
test eax, eax
jne 0x100310c1
call fcn.10030ec0
test eax, eax
jne 0x100310c1
call fcn.10030bb0
test eax, eax
jne 0x100310c1
call fcn.10030900
jmp 0x100310c1
xor edi, edi
test esi, esi
jne 0x100310c1
cmp byte [0x1013ba58], 0
jne 0x100310c1
call fcn.10030dd0
inc edi
mov esi, eax
cmp edi, 0xa
jl 0x100310a7
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x1013ba58
pop esi
call fcn.1006656c
mov esp, ebp
pop ebp
ret

Function at 0x10031ae0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0x1013c258
push 0x10121334
push 1
push 0
push 0x10121404
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0x1013c258], 0
jne 0x10031b2f
mov eax, 0xfffffffe
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
mov edi, str.ROOTCIMV2
call fcn.100312f0
mov eax, dword [eax]
pop edi
test eax, eax
je 0x10031b49
mov ecx, dword [eax]
jmp 0x10031b4b
xor ecx, ecx
mov eax, dword [0x1013c258]
mov edx, dword [eax]
push esi
push 0x1013c25c
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x10031baa
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x10031baa
test esi, esi
je 0x10031baa
mov eax, dword [esi]
test eax, eax
je 0x10031b91
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x10031ba1
push eax
call fcn.100654af
add esp, 4
push esi
call fcn.10065453
add esp, 4
mov eax, dword [0x1013c25c]
pop esi
test eax, eax
je 0x10031b26
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003ba20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109f45
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x68], esi
mov edi, dword [0x1013ba54]
mov dword [ebp - 0x6c], eax
cmp edi, esi
jne 0x1003ba91
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x1003ba80
mov esi, eax
call fcn.10011610
jmp 0x1003ba82
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x48]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10009ff0
lea esi, [ebp - 0x2c]
call fcn.1004ce80
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.1000a320
mov edi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], edi
jb 0x1003bae2
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.1004d030
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.1000a320
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], edi
jb 0x1003bb0f
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x38], ebx
je 0x1003bb5b
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x1003bb1f
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1003bb5b
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x48]
xor eax, eax
push ecx
mov edi, 7
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
lea ebx, [edi - 6]
jmp 0x1003bb89
push ebx
xor edx, edx
mov edi, 7
push 0x101134e8
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], dx
call fcn.1000abb0
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 5
mov ebx, 2
mov esi, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov word [esi], cx
push eax
mov ecx, esi
mov dword [ebp - 0x68], ebx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x1003bbd3
and ebx, 0xfffffffd
cmp dword [ebp - 0x50], 8
jb 0x1003bbc3
mov edx, dword [ebp - 0x64]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], 0
mov word [ebp - 0x64], ax
test bl, 1
je 0x1003bbfa
cmp dword [ebp - 0x18], 8
jb 0x1003bbea
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x34], 8
jb 0x1003bc0c
mov eax, dword [ebp - 0x48]
push eax
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 4