joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov eax, 4
push 1
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edi, eax
mov eax, dword [ebp + 0x10]
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push edi
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x1004c4f4
mov eax, dword [ebp + 0x10]
push eax
push ebx
push 0x100792ac
push str._s:_A_Windows_registry_operation_failed:_Failed_to_open_key._key_path:__s__value_name:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1004c557
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 4
je 0x1004c53b
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push 0x100792ac
push str._s:_A_Windows_registry_operation_failed:_registry_value_TYPE_not_REG_DWORD._key_path:__s__value_name:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1004c557
test esi, esi
je 0x1004c557
mov edx, dword [ebp + 0x10]
push edx
push ebx
push esi
push 0x100792ac
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s__value_name:__s_n_n
call sym.vmtools.dll_Log
add esp, 0x14
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
mov eax, dword [ebp - 0xc]
push eax
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004c580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ecx, dword [ebp + 0x10]
push 1
push ecx
mov edi, eax
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 0x10
push 0
lea edx, [ebp - 4]
push edx
push 0
push 2
push 0
push 0
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1004c5e9
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push eax
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1004c608
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
push esi
push 0x10079318
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s__value_name:__s__value:__d_n_n
call sym.vmtools.dll_Log
add esp, 0x18
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
push ebx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004c6c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
xor edi, edi
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x800
call fcn.1004c1a0
add esp, 0x14
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1004c708
mov edx, dword [ebp + 0x18]
mov ebx, dword [ebp - 4]
mov dword [edx], edi
jmp 0x1004c799
cmp byte [ebp + 0x14], 0
mov eax, dword [ebp - 0x14]
je 0x1004c77c
test eax, eax
je 0x1004c77c
cmp dword [ebp - 0xc], 2
jne 0x1004c77c
push 0x1000
push 0
call sym.vmtools.dll_UtilSafeRealloc0
mov ebx, dword [ebp - 4]
add esp, 8
push 0x800
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004c768
cmp esi, dword [ebp - 8]
jbe 0x1004c785
lea eax, [esi + esi]
push eax
push edi
mov dword [ebp - 8], esi
call sym.vmtools.dll_UtilSafeRealloc0
add esp, 8
push esi
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1004c742
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
jmp 0x1004c799
mov edi, dword [ebp - 4]
shr eax, 1
mov esi, eax
xor ebx, ebx
push 1
lea edx, [esi + esi]
push edx
push edi
call sym.vmtools.dll_Unicode_AllocWithLength
mov ecx, dword [ebp + 0x18]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1004c7a5
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov esi, dword [sym.imp.MSVCR90.dll_free]
push ebx
call esi
push edi
call esi
mov eax, dword [ebp - 0x10]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004c7c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ecx, dword [ebp + 0x10]
mov esi, eax
push 1
push ecx
mov dword [ebp - 8], esi
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 0x10
push 0
lea edx, [ebp - 4]
push edx
push 0
push 2
push 0
push 0
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1004c854
mov ecx, dword [ebp + 0x14]
push 1
push ecx
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edi, eax
push edi
call sym.vmtools.dll_Unicode_UTF16Strlen
mov ecx, dword [ebp - 4]
add esp, 0xc
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x18]
push edx
push edi
push eax
push esi
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
add esp, 4
test esi, esi
je 0x1004c879
jmp 0x1004c85a
mov edi, dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push esi
push 0x10079410
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s__value_name:__s__value:__s_n
call sym.vmtools.dll_Log
add esp, 0x18
mov eax, dword [ebp - 8]
push eax
call edi
push ebx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004c8b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edx, dword [ebp + 8]
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 2
push 0
mov ebx, eax
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1004c91a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1004c93a
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
mov edi, eax
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
pop edi
test esi, esi
je 0x1004c93a
cmp esi, 2
je 0x1004c93a
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
push 0x100794ac
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s__value_name:__s_n
call sym.vmtools.dll_Log
add esp, 0x14
push ebx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004cbf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x802c
call fcn.1004e500
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x8024], eax
xor eax, eax
push 1
push ebx
mov dword [ebp - 0x8020], edi
mov dword [ebp - 0x802c], ecx
mov dword [ebp - 0x801c], eax
mov byte [ebp - 0x8005], al
mov dword [ebp - 0x8014], eax
mov byte [ebp - 0x8006], 1
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
lea edx, [ebp - 0x8010]
push edx
push 1
push 0
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test edi, edi
je 0x1004cc9a
push ebx
push edi
push 0x100794d8
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x8010]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test edi, edi
je 0x1004cce1
push ebx
push edi
push 0x100794d8
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1004ce06
cmp dword [ebp - 0x8014], 0
mov dword [ebp - 0x800c], 0
jbe 0x1004ce06
xor edx, edx
push 0x7ffc
push edx
lea eax, [ebp - 0x8002]
push eax
mov word [ebp - 0x8004], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x8018]
push ecx
mov ecx, dword [ebp - 0x800c]
push 0
lea edx, [ebp - 0x8028]
push edx
mov edx, dword [ebp - 0x8010]
lea eax, [ebp - 0x8004]
push eax
push ecx
push edx
mov dword [ebp - 0x8028], 0x3fff
mov dword [ebp - 0x8018], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x1004cde3
push 1
lea eax, [ebp - 0x8004]
push 0xffffffffffffffff
push eax
call sym.vmtools.dll_Unicode_AllocWithLength
mov edx, dword [ebp - 0x802c]
lea ecx, [ebp - 0x8006]
push ecx
mov ecx, dword [ebp - 0x8020]
push edx
mov esi, eax
mov eax, dword [ebp - 0x8018]
push eax
push esi
push ebx
push ecx
call dword [ebp - 0x8024]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x28
cmp byte [ebp - 0x8006], 0
je 0x1004cdf7
cmp byte [ebp - 0x8005], 0
jne 0x1004cdc8
test edi, edi
je 0x1004cdc8
mov dword [ebp - 0x801c], edi
mov byte [ebp - 0x8005], 1
mov eax, dword [ebp - 0x800c]
inc eax
mov dword [ebp - 0x800c], eax
cmp eax, dword [ebp - 0x8014]
jb 0x1004ccf8
jmp 0x1004cdf7
push ebx
push edi
push 0x100794d8
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
cmp byte [ebp - 0x8005], 0
je 0x1004ce06
mov edi, dword [ebp - 0x801c]
mov edx, dword [ebp - 0x8010]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
Function at 0x1004d840
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jne 0x1004d874
push str.nameSpace
push str.WMI_ConnectToWMI:__s_failed
push 1
call fcn.1004cf70
add esp, 0xc
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1004d882
push str.servicesResult
jmp 0x1004d85f
push esi
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push 0x1007a620
push 1
push 0
push 0x1007a6f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x1004d8c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.WMI_ConnectToWMI:_Could_not_create_namespace_locator:_0x_08x_0x_08x
push 1
call fcn.1004cf70
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
push str.WMI_ConnectToWMI:_created_namespace_locator
push 0x10
call fcn.1004cf70
xor edi, edi
push edi
call sym.vmtools.dll_Hostinfo_OSVersion
add esp, 0xc
cmp eax, 5
jne 0x1004d8f1
push 1
call sym.vmtools.dll_Hostinfo_OSVersion
add esp, 4
cmp eax, 1
jge 0x1004d900
push 0
call sym.vmtools.dll_Hostinfo_OSVersion
add esp, 4
cmp eax, 5
jle 0x1004d905
mov edi, 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x1004d937
push str.WMI_ConnectToWMI:_Failed_to_allocate_string_for_namespace
push 1
call fcn.1004cf70
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add esp, 8
push eax
mov eax, dword [edx + 8]
call eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push str.WMI_ConnectToWMI:_Connecting_to_WMI_server
push 0x20
call fcn.1004cf70
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add esp, 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push edi
push 0
push 0
push 0
push esi
push eax
mov eax, dword [ecx + 0xc]
call eax
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0
test edi, edi
jge 0x1004d9be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x8004100e
jne 0x1004d9a5
push str.WMI_ConnectToWMI:_Failed_to_connect_since_namespace_doesnt_exist
push 4
call fcn.1004cf70
add esp, 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push eax
push edi
push str.WMI_ConnectToWMI:_Failed_to_connect_to_namespace_server:_0x_08x_0x_08x
push 1
call fcn.1004cf70
add esp, 0x10
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push str.WMI_ConnectToWMI:_Connected_to_WMI_server
push 0x20
call fcn.1004cf70
mov edi, dword [ebp - 8]
add esp, 8
call fcn.1004cfd0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004e3f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008c224]
jne 0x1004e3fc
repz ret
jmp fcn.1004ed07
Function at 0x1004f3c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
call fcn.1004f330
mov eax, dword [0x1008c250]
cmp eax, 0xffffffff
jne 0x1004f3dc
call fcn.1004f330
mov eax, dword [0x1008c250]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
jne 0x1004f434
mov esi, dword [ebp + 8]
mov eax, dword [0x1008c250]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push eax
call edi
test al, al
je 0x1004f417
mov eax, dword [esi]
mov ecx, dword [0x1008c254]
inc eax
push eax
push ecx
call edi
test al, al
je 0x1004f417
mov al, 1
jmp 0x1004f419
xor al, al
mov bl, 1
pop edi
test al, al
jne 0x1004f471
push 0x271
push str.d:_build_ob_bora_4448491_bora_lib_misc_vthreadBase.c
push str.VERIFY__s:_d_n
call sym.vmtools.dll_Panic
mov eax, dword [0x1008c250]
xor bl, bl
cmp eax, 0xffffffff
jne 0x1004f44a
call fcn.1004f330
mov eax, dword [0x1008c250]
push eax
call esi
mov ecx, dword [ebp + 8]
lea edx, [ecx + 4]
mov ecx, dword [ecx]
push edx
push ecx
lea edx, [eax + 4]
mov eax, dword [eax]
push edx
push eax
push str.VThreadBase_reinitialization__old:__d__s__new:__d__s._n
call sym.vmtools.dll_Log
add esp, 0x14
pop esi
mov al, bl
pop ebx
pop ebp
ret
mov eax, 0x1008c25c
mov ecx, 1
lock xadd dword [eax], ecx
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x1004f6a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1008c250]
cmp eax, 0xffffffff
jne 0x1004f6b4
call fcn.1004f330
mov eax, dword [0x1008c250]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1004f6e6
cmp dword [0x1008f7fc], eax
jne 0x1004f6ea
mov eax, 0x1008f7fc
mov ecx, 1
lock xadd dword [eax], ecx
call fcn.1004f5c0
mov edx, 0x1008f7fc
or ecx, 0xffffffff
lock xadd dword [edx], ecx
add eax, 4
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.host__Iu
push 0x2f
push 0x1008f800
call dword [sym.imp.MSVCR90.dll__snprintf]
add esp, 0x10
mov eax, 0x1008f800
ret

Function at 0x10050160
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret
Function at 0x10051f50
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ecx + 0x10]
mov eax, esi
ror eax, 0xb
mov ebx, esi
rol ebx, 7
xor eax, ebx
mov ebx, esi
ror ebx, 6
xor eax, ebx
mov ebx, dword [ecx + 0x14]
push edi
mov edi, dword [ecx + 0x18]
xor ebx, edi
and ebx, esi
mov esi, dword [ecx]
xor ebx, edi
add eax, ebx
add eax, dword [edx*4 + 0x1007b008]
mov edi, esi
add eax, dword [ecx + 0x1c]
ror edi, 0xd
mov ebx, esi
rol ebx, 0xa
xor edi, ebx
mov ebx, esi
ror ebx, 2
xor edi, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 8], edi
mov edi, dword [ecx + 8]
or ebx, edi
and ebx, esi
mov esi, dword [ecx + 4]
and esi, edi
or ebx, esi
mov esi, dword [ebp - 8]
add esi, ebx
cmp edx, 0x10
mov dword [ebp - 0xc], esi
jge 0x10051ff1
mov esi, dword [ebp + 8]
mov edi, dword [esi + edx*4]
mov esi, edi
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and ebx, 0xff00
shl edi, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shr esi, 8
shl ebx, 8
or esi, ebx
mov dword [edi + edx*4], esi
add eax, esi
jmp 0x1005204f
mov edi, dword [ebp + 8]
lea esi, [edx - 2]
and esi, 0xf
mov esi, dword [edi + esi*4]
mov dword [ebp - 4], esi
lea esi, [edx + 1]
and esi, 0xf
mov esi, dword [edi + esi*4]
mov ebx, edx
and ebx, 0xf
lea edi, [edi + ebx*4]
mov dword [ebp - 8], edi
mov edi, esi
rol edi, 0xe
mov ebx, esi
ror ebx, 7
xor edi, ebx
shr esi, 3
xor edi, esi
mov esi, dword [ebp - 4]
mov ebx, esi
rol ebx, 0xf
rol esi, 0xd
xor ebx, esi
mov esi, dword [ebp - 4]
shr esi, 0xa
xor ebx, esi
mov esi, dword [ebp + 8]
add edx, 0xfffffff9
and edx, 0xf
add edi, ebx
add edi, dword [esi + edx*4]
mov edx, dword [ebp - 8]
add dword [edx], edi
add eax, dword [edx]
mov edx, 7
sub edx, 1
mov esi, dword [ecx + edx*4]
mov dword [ecx + edx*4 + 4], esi
jne 0x10052054
mov edx, dword [ebp - 0xc]
add dword [ecx + 0x10], eax
pop edi
add edx, eax
pop esi
mov dword [ecx], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10052100
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
pop ebp
ret
Function at 0x10052a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10052a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str.Unable_to_open_process__d__err_u_n
call sym.vmtools.dll_Warning
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor al, al
pop esi
pop ebp
ret
push edi
push str.Killing_tools_sub_process__d_n
call sym.vmtools.dll_Warning
add esp, 8
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
pop edi
setne al
pop esi
pop ebp
ret

Function at 0x10052e10
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
or esi, 0xffffffff
mov dword [ebp - 0xc], 8
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x10052eba
push edi
mov edi, dword [ebp - 0x10]
add edi, esi
js 0x10052eb1
mov esi, dword [ebp + 0xc]
mov edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x10052e9e
mov eax, dword [ebp - 4]
mov cl, byte [eax]
cmp byte [esi], cl
jne 0x10052e99
mov dl, byte [esi + 1]
cmp dl, byte [eax + 1]
jne 0x10052e99
mov dx, word [esi + 2]
cmp dx, word [eax + 2]
jne 0x10052e99
test cl, cl
jne 0x10052e99
mov ecx, dword [esi + 4]
cmp ecx, dword [eax + 4]
jne 0x10052e99
lea edx, [esi + 8]
push edx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10052ea8
sub edi, 1
jns 0x10052e50
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054d60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x105
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x105
lea ecx, [ebp - 0x214]
push ecx
xor ebx, ebx
push esi
mov dword [ebp - 0x218], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10054dd3
push esi
push str.Could_not_determine_file_system_type_on_volume__s._n
call sym.vmtools.dll_Debug
add esp, 8
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
push esi
push str.File_system_type_on_volume__s_is__s._n
call sym.vmtools.dll_Debug
add esp, 0xc
mov ecx, 0x10061974
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10054e13
cmp dl, bl
je 0x10054e0f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10054e13
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10054df3
xor eax, eax
jmp 0x10054e18
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10054e8d
mov ecx, str.FAT32
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10054e47
cmp dl, bl
je 0x10054e43
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10054e47
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10054e27
xor eax, eax
jmp 0x10054e4c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10054e8d
mov ecx, str.NTFS
lea eax, [ebp - 0x10c]
jmp 0x10054e60
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10054e80
cmp dl, bl
je 0x10054e7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10054e80
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10054e60
xor eax, eax
jmp 0x10054e85
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10054dc2
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
Function at 0x10054f60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0xd4], 0x5c3a61
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
test ebx, ebx
jne 0x10054faf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SyncDriverEnumerateRemovableVolumes:_GetLogicalDrives_error__d_n
call sym.vmtools.dll_Debug
add esp, 8
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, 0x1008f8e0
call fcn.10054ad0
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [ebp - 0xcd], 0x61
jmp 0x10054fd0
test bl, 1
je 0x10055077
mov al, byte [ebp - 0xcd]
lea ecx, [ebp - 0xd4]
push ecx
mov byte [ebp - 0xd4], al
call esi
test eax, eax
je 0x10055006
cmp eax, 2
je 0x10055006
cmp eax, 5
je 0x10055006
cmp eax, 4
je 0x10055006
cmp eax, 6
jne 0x10055077
lea edx, [ebp - 0xd4]
push edx
mov edi, 0x1008f8e0
call fcn.10054a60
lea eax, [ebp - 0xd4]
push eax
push str.Trying_to_get_volume_for__s_n
call sym.vmtools.dll_Debug
add esp, 0xc
push 0xc8
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0xd4]
push edx
call dword [0x1008f914]
test eax, eax
je 0x10055063
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.MSVCR90.dll__strlwr]
lea ecx, [ebp - 0xcc]
push ecx
call fcn.10054a60
jmp 0x10055074
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SyncDriverEnumerateRemovableVolumes:_Error__d_getting_volume_n
call sym.vmtools.dll_Debug
add esp, 8
inc byte [ebp - 0xcd]
shr ebx, 1
test ebx, ebx
jne 0x10054fd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret