joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440980
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x348]
sub esp, 0x348
push 0xffffffffffffffff
push 0x45fee0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x46d008]
xor eax, ebp
mov dword [ebp + 0x344], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0x114
movzx eax, byte [0x46e541]
test eax, eax
jne 0x440a51
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x115
jae 0x4409e2
jmp 0x4409e7
call fcn.004202fc
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax + 0x22c], 0
lea ecx, [ebp + 0x22c]
push ecx
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x22c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.0043cef0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
push edx
mov ecx, dword [ebp + 0x350]
call fcn.0043e610
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00420009
add esp, 4
jmp 0x440a97
mov edx, 2
imul eax, edx, 0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x22a
jae 0x440a67
jmp 0x440a6c
call fcn.004202fc
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov word [ebp + edx], cx
lea eax, [ebp]
push eax
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp]
push ecx
mov ecx, dword [ebp + 0x350]
call fcn.0043e550
mov edx, dword [ebp + 0x350]
push edx
call fcn.00444340
cmp dword [ebp - 0x10], 0
je 0x440abb
cmp dword [ebp - 0x10], 0x114
jae 0x440abb
mov dword [ebp - 0x1c], 1
jmp 0x440ac2
mov dword [ebp - 0x1c], 0
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0041fff8
add ebp, 0x348
mov esp, ebp
pop ebp
ret 4
Function at 0x440e70
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [0x46e541]
test eax, eax
jne 0x440edb
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0043cf40
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x440eb5
mov dword [ebp - 8], 1
jmp 0x440ebc
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00420009
add esp, 4
mov al, byte [ebp - 1]
jmp 0x440f01
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x440ef7
mov dword [ebp - 0xc], 1
jmp 0x440efe
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x441260
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.00442be0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4412a3
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x4412a3
mov edx, dword [ebp - 4]
and edx, 1
je 0x4412a3
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004418e0
movzx edx, al
test edx, edx
jne 0x4412a3
xor al, al
jmp 0x441305
movzx eax, byte [0x46e541]
test eax, eax
jne 0x4412f1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0043cf40
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00420009
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x4412ef
mov al, 1
jmp 0x441305
jmp 0x441303
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x441303
mov al, 1
jmp 0x441305
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x4416b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ffb6
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x46e541]
test eax, eax
jne 0x441728
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0043cf40
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00420009
add esp, 4
cmp dword [ebp - 0x24], 0
je 0x441726
mov al, 1
jmp 0x4417db
jmp 0x44173f
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44173f
mov al, 1
jmp 0x4417db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x441753
xor al, al
jmp 0x4417db
lea ecx, [ebp - 0x70]
call fcn.00442c50
lea ecx, [ebp - 0x48]
call fcn.0043e6d0
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x70]
call fcn.00442250
movzx ecx, al
test ecx, ecx
jne 0x4417a1
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.00420009
add esp, 4
mov al, byte [ebp - 0xd]
jmp 0x4417db
mov ecx, dword [ebp - 0x50]
and ecx, 0x10
je 0x4417b2
mov dword [ebp - 0x14], 1
jmp 0x4417b9
mov dword [ebp - 0x14], 0
mov dl, byte [ebp - 0x14]
mov byte [ebp - 0xe], dl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00420009
add esp, 4
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4417f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [0x46e541]
test eax, eax
jne 0x441846
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.0043cf40
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00420009
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x441844
mov al, 1
jmp 0x44185c
jmp 0x44185a
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44185a
mov al, 1
jmp 0x44185c
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x441870
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [0x46e541]
test eax, eax
jne 0x4418c4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.0043cf40
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00420009
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x4418c2
mov al, 1
jmp 0x4418d8
jmp 0x4418d6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4418d6
mov al, 1
jmp 0x4418d8
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x4418e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [0x46e541]
test eax, eax
jne 0x441938
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.0043cf40
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00420009
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x441936
mov al, 1
jmp 0x441950
jmp 0x44194e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x44194e
mov al, 1
jmp 0x441950
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x442be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [0x46e541]
test eax, eax
jne 0x442c2f
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0043cf40
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00420009
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x442c4a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x442c47
mov eax, dword [ebp - 4]
jmp 0x442c4a
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 4

Function at 0x442de0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x442e07
mov dword [ebp - 4], 1
jmp 0x442e0e
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x442e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0xc], 0x400000
jbe 0x442ea9
mov dword [ebp + 0xc], 0x400000
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x442edc
mov dword [ebp - 8], 1
jmp 0x442ee3
mov dword [ebp - 8], 0
mov dl, byte [ebp - 8]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4430d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44310c
mov dword [ebp - 8], 1
jmp 0x443113
mov dword [ebp - 8], 0
mov dl, byte [ebp - 8]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x443360
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x443397
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443397
xor al, al
jmp 0x4433b4
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.0042d1a0
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x444da0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x46d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], SysReAllocStringLen
mov dword [eax + 4], 0
mov dword [ebp - 0x64], 0x40
push str.GlobalMemoryStatusEx
push 0x467348
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x444e30
lea ecx, [ebp - 0x64]
push ecx
call dword [ebp - 0x68]
test eax, eax
je 0x444e30
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x58]
ja 0x444e12
jb 0x444e04
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x5c]
jae 0x444e12
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x70], edx
jmp 0x444e1e
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x74]
mov dword [edx], eax
mov ecx, dword [ebp - 0x70]
mov dword [edx + 4], ecx
mov al, 1
jmp 0x444e66
mov dword [ebp - 0x24], 0x20
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0x444e51
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x6c], ecx
jmp 0x444e57
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fff8
mov esp, ebp
pop ebp
ret 4
Function at 0x45e280
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45e2b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45e2b2
xor al, al
jmp 0x45e2cf
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.0042d1a0
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5c5732d7
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7f1a3a60
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10033d9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x1036a44]
push esi
push edi
push 0xffffffffffffffff
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov edi, ecx
mov esi, edx
push 0x100153c
mov dword [ebp - 4], eax
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x810], esi
mov byte [ebp - 0x805], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x80c], eax
je 0x1003539
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
push esi
call ebx
push edi
mov edi, dword [sym.imp.msvcrt.dll_swprintf]
mov esi, eax
lea eax, [ebp - 0x804]
push 0x100151c
push eax
call edi
lea eax, [ebp - 0x804]
push eax
call ebx
mov dword [ebp - 0x818], eax
movzx eax, ax
add eax, esi
lea eax, [eax + eax + 8]
add esp, 0x14
push eax
mov dword [ebp - 0x81c], eax
call fcn.01003305
mov ebx, eax
test ebx, ebx
jne 0x100348c
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003538
mov eax, dword [ebp - 0x818]
add eax, eax
mov word [ebx + 2], ax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebx + 8]
push 0x1001514
push eax
mov word [ebx], 8
call edi
mov ax, word [ebx]
add ax, word [ebx + 2]
lea ecx, [esi + esi]
mov esi, dword [ebp - 0x810]
mov word [ebx + 6], cx
movzx ecx, cx
mov word [ebx + 4], ax
movzx edi, ax
mov eax, ecx
shr ecx, 2
add edi, ebx
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov ecx, eax
and ecx, 3
xor eax, eax
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x820]
push ecx
push eax
push eax
push dword [ebp - 0x81c]
push ebx
push 0x6dc000
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
mov byte [ebp - 0x805], al
call fcn.01003336
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x805], 0
je 0x1003538
test byte [ebp + 8], 1
je 0x1003538
push 1
push dword [ebp - 0x814]
call fcn.01003374
pop ebx
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
call fcn.0102e95a
leave
ret 4
Function at 0x1003da8
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x141c
call fcn.0102ec00
mov eax, dword [0x1036a44]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x140c], eax
lea eax, [ebp - 0x1404]
push 0x1001568
push eax
mov byte [ebp - 0x1405], 0
call esi
add esp, 0xc
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1003c54
cmp eax, 5
je 0x1003c54
cmp eax, 2
je 0x1003c54
xor al, al
jmp 0x1003e43
push edi
push 0xffffffffffffffff
push 0x80
push 3
xor edi, edi
push edi
push 3
push 0xc0000000
push 0x100153c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1418], eax
jne 0x1003c85
xor al, al
jmp 0x1003e42
push ebx
lea eax, [ebp - 0x1404]
push 0x100151c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 0xc04]
push eax
push dword [ebp - 0x140c]
mov dword [ebp - 0x1410], 0x400
push dword [ebp - 0x1418]
call fcn.01003839
cmp al, 1
jne 0x1003e30
movzx esi, word [ebp - 0x1410]
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x140c], eax
call fcn.01003305
mov ebx, eax
cmp ebx, edi
je 0x1003e30
push 0x2000
call fcn.01003305
cmp eax, edi
mov dword [ebp - 0x1414], eax
je 0x1003e2a
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov dword [ebx], edi
mov word [ebx + 4], di
mov dword [ebx + 0x10], edi
mov word [ebx + 0x14], di
mov dword [ebx + 8], 0x18
lea esi, [ebp - 0xc04]
lea edi, [ebx + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cx, word [ebp - 0x1410]
push 0
mov word [ebx + 0xc], cx
lea ecx, [ebp - 0x141c]
push ecx
push 0x2000
push eax
push dword [ebp - 0x140c]
push ebx
push 0x6d0008
push dword [ebp - 0x1418]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test al, al
mov byte [ebp - 0x1405], al
je 0x1003e1f
mov edx, dword [ebp - 0x1414]
mov eax, dword [edx + 4]
cmp eax, 1
jb 0x1003e1f
and dword [ebp - 0x140c], 0
test eax, eax
mov byte [ebp - 0x1405], 0
jbe 0x1003e1f
add edx, 0xc
mov dword [ebp - 0x1410], edx
jmp 0x1003da6
mov edx, dword [ebp - 0x1410]
mov esi, dword [edx - 4]
add esi, dword [ebp - 0x1414]
xor eax, eax
mov ecx, 0x100
lea edi, [ebp - 0x804]
rep stosd dword es:[edi], eax
movzx ecx, word [edx]
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x804]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, word [edx]
shr eax, 1
and word [ebp + eax*2 - 0x804], 0
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.0101e05d
test eax, eax
jne 0x1003e01
mov byte [ebp - 0x1405], 1
inc dword [ebp - 0x140c]
mov eax, dword [ebp - 0x1414]
mov ecx, dword [ebp - 0x140c]
add dword [ebp - 0x1410], 0x18
cmp ecx, dword [eax + 4]
jb 0x1003da0
push dword [ebp - 0x1414]
call fcn.01003336
push ebx
call fcn.01003336
push dword [ebp - 0x1418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x1405]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0102e95a
leave
ret 8
Function at 0x100abfd
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0xc], esi
mov byte [eax], 0
call fcn.0101df49
test al, al
je 0x100ab0f
mov al, 1
jmp 0x100ac65
mov eax, dword [esi + 0x94]
mov ecx, dword [eax + 4]
and dword [ebp - 8], 0
test ecx, ecx
push ebx
push edi
jle 0x100ab61
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx]
cmp dword [ebx + 0x30], 3
jne 0x100ab49
push 4
pop ecx
mov edi, 0x100190c
lea esi, [ebx + 0xa0]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x100ab5a
mov esi, dword [ebp - 0xc]
inc dword [ebp - 8]
mov ecx, dword [eax + 4]
add dword [ebp - 4], 4
cmp dword [ebp - 8], ecx
jl 0x100ab27
jmp 0x100ab64
mov al, 1
jmp 0x100ac63
mov ebx, dword [ebp + 8]
test ecx, ecx
jle 0x100ac30
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [esi + 0x94]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov eax, dword [eax + edx*4 - 4]
mov esi, dword [eax + 0x20]
sub esi, dword [ecx + 0x18]
mov edi, dword [eax + 0x24]
mov edx, edi
sbb edx, dword [ecx + 0x1c]
add esi, dword [eax + 0x18]
adc edx, dword [eax + 0x1c]
cmp edx, 4
jl 0x100aba5
jg 0x100ab9e
test esi, esi
jb 0x100aba5
mov edx, 0x8000000
jmp 0x100abaa
mov edx, 0x2000000
xor esi, esi
cmp dword [ecx + 0x30], 1
jne 0x100abce
cmp esi, dword [ecx + 0x24]
jg 0x100abce
jl 0x100abbe
cmp edx, dword [ecx + 0x20]
ja 0x100abce
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], esi
mov ebx, ecx
jmp 0x100abfd
cmp dword [eax + 0x30], 1
jne 0x100abfd
cmp esi, edi
jg 0x100abfd
jl 0x100abdf
cmp edx, dword [eax + 0x20]
ja 0x100abfd
mov ecx, dword [ebp + 8]
mov byte [ecx], 1
mov ecx, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
sub ecx, edx
sbb edi, esi
add dword [eax + 0x18], ecx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], esi
adc dword [eax + 0x1c], edi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100ac30
mov dword [ebx + 0x30], 3
mov byte [ebx + 0x34], 1
lea edi, [ebx + 0xa0]
mov esi, 0x100190c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0xb0]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x100ac34
xor al, al
jmp 0x100ac63
and dword [ebx + 0xc0], 0
and dword [ebx + 0xc4], 0
push 0x10019c8
add ebx, 0xc8
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
call fcn.0100a973
test eax, eax
setge al
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1010527
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov byte [ebp - 1], 0
call fcn.010103bb
mov ebx, eax
test ebx, ebx
jne 0x10104fc
push dword [ebp + 0x10]
call fcn.010103ef
mov ebx, eax
test ebx, ebx
je 0x101054b
mov byte [ebp - 1], 1
jmp 0x1010531
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x1010531
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
push dword [ebp + 0xc]
lea eax, [esi + 0x21a]
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x101052a
push dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1010562
mov esi, dword [esi + 8]
test esi, esi
jne 0x1010509
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.01010455
test eax, eax
jne 0x101054f
cmp byte [ebp - 1], al
je 0x101054b
push ebx
call fcn.01003336
xor al, al
jmp 0x1010564
push eax
push ebx
call fcn.010104ad
cmp byte [ebp - 1], 0
je 0x1010562
push ebx
call fcn.01010434
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc