joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c0d4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1028], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c2cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x47c2aa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47c12e
mov byte [ebp - 5], 0
jmp 0x47c27b
mov dword [ebp - 0x14], 0x800
mov dword [ebp - 0x18], 0x40
jmp 0x47c257
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jb 0x47c250
inc eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
and eax, 2
cmp eax, 2
jne 0x47c243
xor edx, edx
push ebp
push 0x47c23c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff4
push eax
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47c1a1
mov byte [ebp - 5], 0
call fcn.00403e38
jmp 0x47c250
mov dword [ebp - 0x14], 0x800
mov dword [ebp - 0x1c], 0x40
jmp 0x47c209
mov esi, dword [ebp - 0x1c]
dec esi
test esi, esi
jb 0x47c202
inc esi
lea ebx, [ebp - 0x1010]
lea eax, [ebp - 0x1028]
mov edx, dword [ebx]
call fcn.004045bc
mov edx, dword [ebp - 0x1028]
mov eax, 0x47c2e8
call fcn.004049c0
test eax, eax
jne 0x47c1fc
lea eax, [ebp - 0x102c]
mov edx, dword [ebx]
call fcn.004045bc
mov edx, dword [ebp - 0x102c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x20
dec esi
jne 0x47c1c0
mov dword [ebp - 0x1c], 0x40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x47c1b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c243
mov eax, dword [ebp - 0x10]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
add dword [ebp - 0x24], 0x20
dec dword [ebp - 0x20]
jne 0x47c15a
mov dword [ebp - 0x18], 0x40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x47c141
mov byte [ebp - 5], 1
cmp byte [ebp - 5], 0
jne 0x47c293
mov ecx, 0x80000000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0047bfd8
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c2b1
mov eax, dword [ebp - 0xc]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
Function at 0x47c243
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1028], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c2cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x47c2aa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47c12e
mov byte [ebp - 5], 0
jmp 0x47c27b
mov dword [ebp - 0x14], 0x800
mov dword [ebp - 0x18], 0x40
jmp 0x47c257
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jb 0x47c250
inc eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
and eax, 2
cmp eax, 2
jne 0x47c243
xor edx, edx
push ebp
push 0x47c23c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff4
push eax
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47c1a1
mov byte [ebp - 5], 0
call fcn.00403e38
jmp 0x47c250
mov dword [ebp - 0x14], 0x800
mov dword [ebp - 0x1c], 0x40
jmp 0x47c209
mov esi, dword [ebp - 0x1c]
dec esi
test esi, esi
jb 0x47c202
inc esi
lea ebx, [ebp - 0x1010]
lea eax, [ebp - 0x1028]
mov edx, dword [ebx]
call fcn.004045bc
mov edx, dword [ebp - 0x1028]
mov eax, 0x47c2e8
call fcn.004049c0
test eax, eax
jne 0x47c1fc
lea eax, [ebp - 0x102c]
mov edx, dword [ebx]
call fcn.004045bc
mov edx, dword [ebp - 0x102c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x20
dec esi
jne 0x47c1c0
mov dword [ebp - 0x1c], 0x40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x47c1b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c243
mov eax, dword [ebp - 0x10]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
add dword [ebp - 0x24], 0x20
dec dword [ebp - 0x20]
jne 0x47c15a
mov dword [ebp - 0x18], 0x40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x47c141
mov byte [ebp - 5], 1
cmp byte [ebp - 5], 0
jne 0x47c293
mov ecx, 0x80000000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0047bfd8
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c2b1
mov eax, dword [ebp - 0xc]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
Function at 0x47c340
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c400
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x800
lea eax, [ebp - 0xc]
push eax
push 2
push 1
push 0
call sub.netapi32.dll_NetUserEnum
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47c396
cmp dword [ebp - 0x1c], 0xea
jne 0x47c3dd
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x47c3d4
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [ebp - 0xc]
cmp dword [eax + edi*8 + 0xc], 0
jbe 0x47c3d0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + edi*8]
call fcn.004045ec
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edi*8 + 0xc]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x3c]
inc ebx
dec esi
jne 0x47c3a1
mov eax, dword [ebp - 0xc]
push eax
call sub.netapi32.dll_NetApiBufferFree
cmp dword [ebp - 0x1c], 0xea
je 0x47c364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c407
lea eax, [ebp - 0x20]
call fcn.004043cc
ret

Function at 0x47dff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.004555bc
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x4897f8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x489826
mov eax, ebx
call fcn.0048a2b0
cmp dword [ebx + 0x3c], 0
je 0x48981f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x489897
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x489889
cmp dword [ebx + 8], 0
je 0x489848
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x48985a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x489889
cmp dword [ebx + 8], 0
je 0x48983b
cmp eax, 3
je 0x48986d
dec eax
jne 0x48983b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48983b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x48983b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4898b5
cmp dword [ebx + 0x10], 0xcc
je 0x4898b5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004898c0
pop ebx
ret
Function at 0x49a748
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x49a7d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040881c
mov eax, dword [ebp - 8]
call fcn.00404684
test eax, eax
jle 0x49a7b7
push 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408d58
mov eax, dword [ebp - 0xc]
call fcn.0040487c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040487c
push eax
push 0x49a7e0
mov eax, dword [0x4a0098]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a7d9
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043f0
ret

Function at 0x2755000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x275500a
jmp 0x275700f
jmp fcn.02450108
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x20777052
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4dbc3b0a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100014fc
cmp byte [esi + 0x3d], 0
je 0x100014fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100014ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100014b1
sub eax, 1
je 0x100014b5
sub eax, 2
jne 0x100014ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100014d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100014ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10001f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10001f6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10001f94
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10001f9a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10002024
jg 0x10001fb1
test esi, esi
je 0x10002024
test ecx, ecx
jl 0x10002007
jg 0x10001fbb
test eax, eax
je 0x10002007
cmp edi, ecx
jg 0x10001fcf
jl 0x10001fc5
cmp esi, eax
jae 0x10001fcf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10002024
jg 0x1000200a
test esi, esi
je 0x10002024
jmp 0x1000200a
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10002024
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000206c
jl 0x10002060
test ecx, ecx
jne 0x1000206c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10002085
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100020d3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x100020d9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x100020d9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10002146
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10002102
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10002134
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10002146
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10002110
test edi, edi
je 0x10002146
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100024c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100024f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000252c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000252c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10002603
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10002554
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10002560
movsx eax, bl
jmp 0x10002598
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100025c2
sub eax, 1
je 0x100025c2
sub eax, 2
jne 0x10002603
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100025e0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10002603
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029901
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029901
mov esp, ebp
pop ebp
ret 4
Function at 0x10003130
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c8
call fcn.1002aa40
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx]
lea eax, [ebp - 0x108]
xor esi, esi
push str..PhysicalDrive_d
push eax
call fcn.10003a80
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10003353
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], esi
push esi
push eax
mov dword [ebp - 0x37c0], esi
mov dword [ebp - 0x37c8], esi
mov dword [ebp - 0x37c4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push esi
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10003346
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x8d8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10002f90
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0xcc0]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10002f90
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10002f90
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.10002f90
add esp, 0x20
cmp byte [0x1003d448], 0
jne 0x10003309
movsx eax, byte [ebp - 0x4f0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
jne 0x10003282
movsx eax, byte [ebp - 0x4dd]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x10003309
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x8d8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x1003d047], al
test al, al
jne 0x10003290
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xcc0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x1003c847], al
test al, al
jne 0x100032b0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x4f0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x1003d447], al
test al, al
jne 0x100032d0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x10a8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x1003cc47], al
test al, al
jne 0x100032f0
mov esi, 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1000334c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10004350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1003c130], 0xf
mov eax, 0x1003c11c
push ebx
push dword [0x1003c12c]
cmova eax, dword [0x1003c11c]
mov ecx, 0x1003c104
push eax
call fcn.10002920
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, eax
mov dword [0x1003c0f4], edx
sub ecx, dword [0x1003c0f0]
mov dword [0x1003c0f8], ecx
cmp ecx, 0x200
jb 0x100043c0
cmp byte [0x1003c100], 0
mov dword [0x1003c0f0], edx
sete al
mov byte [0x1003c100], al
jmp 0x100043c5
mov al, byte [0x1003c100]
test al, al
je 0x10004417
mov edx, dword [0x1003c130]
mov eax, edx
mov ecx, dword [0x1003c12c]
sub eax, ecx
cmp eax, 1
jb 0x100043fd
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [0x1003c12c], eax
mov eax, 0x1003c11c
cmova eax, dword [0x1003c11c]
mov word [eax + ecx], 0x7c
jmp 0x10004417
push 1
push 0x1002ed0c
mov byte [ebp - 0x20], 0
mov ecx, 0x1003c11c
push dword [ebp - 0x20]
push 1
call fcn.10002c80
mov eax, dword [0x1003c12c]
test eax, eax
je 0x10004495
cmp eax, 0x10
jae 0x10004498
cmp dword [0x1003c130], 0xf
mov bl, 0x6f
mov edx, 0x1003c11c
mov byte [ebp - 0x1d], 0
cmova edx, dword [0x1003c11c]
mov al, 0x4a
xor al, bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], al
mov cl, 0x1c
push edx
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x1d], 0
push eax
xor cl, bl
push 0x1004175c
mov byte [ebp - 0x1e], cl
call fcn.10001380
mov eax, dword [0x1003c138]
add esp, 0xc
add eax, 0xe6
push 0x1004175c
push 1
push dword [0x1004135c]
push 0xffe580ff
push dword [0x1003c13c]
push eax
call fcn.10003b70
mov eax, dword [0x1003c12c]
add esp, 0x18
cmp eax, 0x10
jbe 0x10004514
movaps xmm0, xmmword [0x10032d30]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x6f603c2b
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x100044b2
lea eax, [ebp - 0x1b]
mov byte [ebp - 8], 0
push eax
push 0x10041724
call fcn.10001380
mov ecx, dword [0x1003c13c]
add esp, 8
mov eax, dword [0x1003c138]
add eax, 0xe6
push ecx
push eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x1004135c]
lea edx, [ebp - 0x18]
push 0xffff0000
push 0x100
push edx
mov ecx, dword [eax]
push 0xffffffffffffffff
push 0x10041724
push 0
push eax
call dword [ecx + 0x38]
cmp dword [0x1003c118], 0xf
mov eax, 0x1003c104
push dword [0x1003c114]
cmova eax, dword [0x1003c104]
mov ecx, 0x1003c11c
push eax
call fcn.10002920
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10029901
mov esp, ebp
pop ebp
ret