joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61019f24
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x6103f6e5
call fcn.6102b2d6
mov edi, ecx
mov dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 4], esi
push 0x20019
call fcn.61018fac
test eax, eax
jne 0x61019f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
xor eax, eax
call fcn.6102b3c2
ret 8
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push dword [edi + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, esi
je 0x61019fac
cmp eax, 2
je 0x61019fa7
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
jmp 0x61019f63
xor esi, esi
inc esi
jmp 0x61019f97
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov dword [ebp - 0x14], eax
call fcn.6102c0d4
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x61019f8c
push dword [ebp - 0x14]
push esi
push ebx
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push ebx
push esi
push esi
push dword [ebp + 8]
push dword [eax + 0x18]
call edi
push ebx
test eax, eax
je 0x61019fee
call fcn.6102b403
pop ecx
jmp 0x61019f8c
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.61019ecc
push ebx
call fcn.6102b403
pop ecx
cmp dword [edi + 8], esi
jne 0x61019fa7
jmp 0x61019f8c
Function at 0x6102b224
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x6102b25f
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6102b246
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x6102b257
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x6102b261
inc edi
add eax, 0x28
invalid

Function at 0x6102b3db
Capabilities:
Enumerate pe sections

Disassembly:
test ch, bh
add eax, 0x788b0000
cmp al, 3
clc
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
invalid
invalid

Function at 0x6102b403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.6102b1e4
loopne 0x6102b48f
xchg dword [ecx], ebp
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x6102b43e
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x6102b438
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x6102b429
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.6102b1e4
stosb byte es:[edi], al
and eax, 0x458d49e7
test al, 0x50
push eax
call fcn.6102b1f4
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x6102b4d2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
invalid
inc ebp
invalid
Function at 0x6102b555
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.6102b1e4
dec edx
movsb byte es:[edi], byte [esi]
and esi, 0xffffff88
popfd
jl 0x6102b669
invalid
invalid
Function at 0x6102b570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.6102b1f4
push eax
push esi
push dword [ebp + 8]
call fcn.6102b1a9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.6102b1e4
dec edx
movsb byte es:[edi], byte [esi]
and esi, 0xffffff88
popfd
jl 0x6102b669
invalid
invalid

Function at 0x6102b7e8
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x6102b789
cmp dword [eax + 0xc], ebx
je 0x6102b82c
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.6102b1e4
xor dword [edi + 0x5d399769], eax
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x6102b81a
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x6102b7f5
and eax, 0xffff
push eax
jmp 0x6102b7f9
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6102b1a9
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x6102b9d3
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x6102b7da
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x6102b77b
call fcn.6102b1e4
salc
inc esi
outsd dx, dword [esi]
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6102b8b7
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6102b8bb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax - 0x15], ah
push ds
add byte [eax - 0x15], ah
push ds
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54
invalid

Function at 0x6102ba84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6102b1a9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
test dword [eax + 0x4fffff9], edx
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
invalid
movsd dword es:[edi], dword [esi]
invalid
cld

Function at 0x6102bacc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6102b1a9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
test dword [eax + 0x4fffff9], edx
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
invalid
movsd dword es:[edi], dword [esi]
invalid
cld

Function at 0x6102c129
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
invalid
invalid
cmpsb byte [esi], byte es:[edi]
cld
Function at 0x6103bdbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x6103bf9c
test eax, eax
jne 0x6103be09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6103bf9f
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x6103bf9c
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x6103bf9c
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x6103be3c
cmp ax, 0x5a
jbe 0x6103be45
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x6103be69
cmp word [ebp - 0x20e], 0x3a
jne 0x6103be69
cmp word [ebp - 0x20c], 0x5c
jne 0x6103bf9c
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x6103beab
cmp word [ebp - 0x20e], di
jne 0x6103beab
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.6102c413
pop ecx
pop ecx
test eax, eax
je 0x6103bf9c
add eax, 2
push edi
push eax
call fcn.6102c413
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x6103bf9c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6103bed5
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x6103bf9f
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x6103bee9
mov esi, eax
jmp 0x6103beec
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x6103bf9c
cmp word [esi], di
jne 0x6103bf9c
cmp esi, dword [ebp - 0x214]
jbe 0x6103bf9c
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call fcn.6102c80f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x6103bf9c
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x6103bf64
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x6103bf0d
cmp esi, dword [ebp - 0x214]
jbe 0x6103bf9c
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x6103bf85
test al, 0x10
jne 0x6103bf52
mov eax, 0x10b
jmp 0x6103bf9f
cmp word [esi + 2], bx
je 0x6103bf98
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x6103bf6f
jmp 0x6103bdfe
xor eax, eax
jmp 0x6103bf9f
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6102b2c1
leave
ret 4
Function at 0x5da22b26
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x5da22b80
push eax
push 0x5da2168a
call fcn.5da22bbe
push 7
push 0x5dc910bc
push dword [eax + 0x30]
call fcn.5da22f17
cmp eax, 0
jne 0x5da22b5a
inc eax
jmp 0x5da22b82
push 0x5da216a2
call fcn.5da22bbe
push 7
push 0x5dc910bc
push dword [eax + 0x30]
call fcn.5da22f17
cmp eax, 0
jne 0x5da22b7b
inc eax
jmp 0x5da22b82
pop eax
mov eax, dword [eax]
jmp 0x5da22b34
xor eax, eax
ret

Function at 0x5da22b98
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x5da22bac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x5da22bbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5dc910bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xe9
stosw word es:[edi], ax
cmp ax, 0
jne 0x5da22bcc
pop edi
pop esi
leave
ret 4

Function at 0x5da22be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5dc910bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xe9
stosb byte es:[edi], al
cmp al, 0
jne 0x5da22bee
pop edi
pop esi
leave
ret 4

Function at 0x5da22e22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x5da22e73
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x5da22e73
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x5da22e7a
add edx, 4
loop 0x5da22e3a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x5da22e81
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x5da22ecd
cmp dx, 0x41
jb 0x5da22eb2
cmp dx, 0x5a
jbe 0x5da22eb8
cmp dx, 0x61
jb 0x5da22ec4
cmp dx, 0x7a
ja 0x5da22ec4
xor dx, 0x20
jmp 0x5da22ec6
jmp 0x5da22ee0
cmp dx, word [edi]
je 0x5da22ecd
jmp 0x5da22ee0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x5da22e9e
mov eax, dword [eax + 0x18]
jmp 0x5da22ee8
mov eax, dword [eax]
cmp ebp, eax
jne 0x5da22e93
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x5dc8c480
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
push 0x1f4
mov dword [0x5dc91200], eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
mov esi, dword [0x5dc91200]
mov dword [0x5dc91204], eax
sub eax, esi
xor ecx, ecx
cmp eax, 0x1f4
pop esi
setge cl
dec ecx
mov eax, ecx
ret
Function at 0x401000
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push str..SMARTVSD
mov byte [esp + 0x2f], bl
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x4010bb
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, 0x104
push esi
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push esi
push 8
mov ebp, eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
cmp ebp, ebx
mov dword [esp + 0x24], eax
je 0x4010a0
cmp eax, ebx
je 0x401095
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push esi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.SMARTVSD.VXD
push ebp
call esi
push str.IOSUBSYSSMARTVSD.VXD
push dword [esp + 0x28]
call esi
push ebx
push dword [esp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push ebp
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp dword [esp + 0x24], ebx
je 0x4010b4
push dword [esp + 0x24]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
xor al, al
jmp 0x4011e7
push 0x21
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
call edi
mov ebp, 0x210
mov esi, eax
push ebp
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call edi
cmp esi, ebx
mov edi, eax
je 0x4011c6
cmp edi, ebx
je 0x4011b7
mov dword [esp + 0x14], ebx
cmp byte [esp + 0x13], bl
jne 0x4011b7
push 0x21
push ebx
push esi
call sub.MSVCRT.dll_memset
push ebp
push ebx
push edi
mov dword [esp + 0x34], ebx
call sub.MSVCRT.dll_memset
mov al, byte [esp + 0x2c]
add esp, 0x18
mov byte [esi + 0xc], al
lea eax, [esp + 0x1c]
push ebx
push eax
push ebp
push edi
push 0x20
push esi
push 0x7c088
mov dword [esi], 0x200
push dword [esp + 0x34]
mov byte [esi + 4], bl
mov byte [esi + 5], 1
mov byte [esi + 6], 1
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov byte [esi + 9], 0xa0
mov byte [esi + 0xa], 0xec
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4011a8
lea eax, [edi + 0x24]
push 0x14
push eax
call fcn.004011ef
push dword [esp + 0x30]
push ebx
push dword [esp + 0x34]
call sub.MSVCRT.dll_memset
lea eax, [edi + 0x24]
push 0x14
push eax
push dword [esp + 0x40]
call dword [sym.imp.MSVCRT.dll_memmove]
push dword [esp + 0x44]
call fcn.004017e8
mov eax, dword [esp + 0x48]
add esp, 0x24
mov al, byte [eax]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
je 0x4011a8
mov byte [esp + 0x13], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jl 0x4010f7
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp edi, ebx
je 0x4011d9
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x401368
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
push ebx
xor ebx, ebx
push esi
push edi
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov esi, 0x2710
cmp byte [ebp - 1], bl
jne 0x40150a
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
mov byte [ebp - 0x504], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf9
xor eax, eax
lea edi, [ebp - 0x503]
push dword [ebp - 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x11c]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4014fd
push esi
push 8
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x4014f4
push 0xc
lea eax, [ebp - 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push ebx
push eax
push esi
push edi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x401477
mov eax, dword [edi + 0x18]
cmp eax, ebx
je 0x401477
lea ecx, [ebp - 0x504]
add eax, edi
push ecx
push eax
call fcn.0040166e
lea eax, [ebp - 0x504]
push eax
call fcn.004017e8
add esp, 0xc
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x4014cb
push esi
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push esi
push edi
push ebx
push ebx
push 0x2d0c10
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4014e5
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x504]
push eax
call fcn.004017e8
pop ecx
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
je 0x4014e5
push dword [ebp + 0xc]
lea eax, [ebp - 0x504]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov byte [ebp - 1], 1
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jl 0x401381
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret