joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003a28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x754]
add edx, 1
mov dword [ebp - 0x754], edx
mov eax, dword [ebp - 0x6d0]
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [eax + 0x18]
jae 0x10003b9c
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x1c30]
mov ecx, dword [ebp - 0x368]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x758], ecx
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x1c34]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1c38]
mov eax, dword [ebp - 0x368]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c3c], eax
mov dword [ebp - 0x15c], 0
jmp 0x10003a00
mov ecx, dword [ebp - 0x15c]
add ecx, 1
mov dword [ebp - 0x15c], ecx
invalid
mov edx, dword [ebp - 0x758]
add edx, dword [ebp - 0x15c]
movsx eax, byte [edx]
test eax, eax
je 0x10003ab2
mov ecx, dword [ebp - 0x15c]
movsx edx, byte [ebp + ecx - 0x85c]
test edx, edx
je 0x10003ab2
invalid
test dword [eax], eax
add byte [eax], al
test byte [ebp + 0x53000000], al
push ebx
push ebx
add esp, 4
add ebx, 0x4cd0
and ebx, 0x6cdb
xor ebx, 0xc4ca
jmp 0x10003a4b
pop ebx
push ecx
xor ecx, 0x1312a
jmp 0x10003a58
or ecx, 0x137b6
pop ecx
mov eax, dword [ebp - 0x758]
add eax, dword [ebp - 0x15c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x15c]
movsx eax, byte [ebp + edx - 0x85c]
cmp ecx, eax
je 0x10003aa4
mov ecx, dword [ebp - 0x758]
add ecx, dword [ebp - 0x15c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x15c]
movsx ecx, byte [ebp + eax - 0x85c]
cmp edx, ecx
jne 0x10003aab
jmp 0x100039f1
jmp 0x10003ab2
push ecx
or ecx, 0x4ae2
and ecx, 0x16283
xor ecx, 0x10fb6
pop ecx
push edi
push ecx
add esp, 4
or edi, 0x138d
add edi, 0x4737
and edi, 0x473d
sub edi, 0x21d1
pop edi
mov edx, dword [ebp - 0x758]
add edx, dword [ebp - 0x15c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x15c]
movsx edx, byte [ebp + ecx - 0x85c]
cmp eax, edx
jne 0x10003b11
mov dword [ebp - 0xc58], 0
jmp 0x10003b80
push eax
push edi
add esp, 4
or eax, 0x4168
and eax, 0x13784
pop eax
push edi
add edi, 0x5b02
xor edi, 0x156e0
and edi, 0xb76a
pop edi
push ebx
push ecx
add esp, 4
jmp 0x10003b42
pop ebx
mov eax, dword [ebp - 0x758]
add eax, dword [ebp - 0x15c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x15c]
movsx eax, byte [ebp + edx - 0x85c]
or eax, 0x20
cmp ecx, eax
jge 0x10003b76
mov dword [ebp - 0xc58], 0xffffffff
jmp 0x10003b80
mov dword [ebp - 0xc58], 1
cmp dword [ebp - 0xc58], 0
jne 0x10003b97
mov ecx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x37c], ecx
jmp 0x10003ba8
jmp 0x10003981
mov edx, dword [ebp - 0x75c]
mov dword [ebp - 0x37c], edx

Function at 0x10003f79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esi
dec esi
push eax
xor eax, 0xe6813748
mov ebx, dword [edi]
add dword [eax], eax
pop esi
push edi
add edi, 0xcdf4
jmp 0x10003f96
pop edi
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [ebp - 0xc64]
je 0x10003fc3
mov edx, dword [ebp - 0x4d4]
cmp dword [edx + 0x30], 0
jne 0x10003d8e
mov dword [ebp - 0x2a0], 0
Function at 0x100211d4
Capabilities:
Check os version

Disassembly:
push 0x11c
mov eax, 0x10110c44
call fcn.1006051e
mov esi, ecx
mov dword [ebp - 0x128], esi
xor eax, eax
mov dword [ebp - 0x128], esi
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
push 0x58
push eax
lea edi, [esi + 0x20]
push edi
call fcn.1003e610
xor eax, eax
mov dword [ebp - 0x124], 0x114
xor ecx, ecx
lea ebx, [esi + 0x27c]
mov word [ebx], ax
lea eax, [ebp - 0x120]
push 0x110
push ecx
mov word [esi + 0x7c], cx
push eax
mov dword [esi + 0x78], 1
mov dword [edi], 0x58
call fcn.1003e610
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10021274
cmp dword [ebp - 0x120], 5
jae 0x1002127a
cmp dword [ebp - 0x120], 4
jne 0x10021274
cmp dword [ebp - 0x11c], 0x5a
jae 0x1002127a
mov dword [edi], 0x4c
and dword [esi + 0x5c], 0
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x980026
mov dword [esi + 0x2c], str.All_Files__._.
mov ecx, dword [0x10190234]
and dword [esi + 0x24], 0
mov dword [esi + 0x28], ecx
mov dword [esi + 0x64], 0x100018b7
call fcn.100604c8
ret 0x18

Function at 0x10022439
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push eax
push eax
push esi
push 0x1002246c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x5c], eax
pop esi
ret

Function at 0x1002514b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [ebp - 0x10], eax
push 1
mov ecx, esi
mov dword [ebp - 8], edi
call fcn.100225e0
push 0xfb
call dword [sym.imp.KERNEL32.dll_Sleep]
fild dword [ebp - 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x101624a8]
fdiv qword [0x101624c8]
fldz
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x1002519b
fstp st(1)
jmp 0x1002519d
fstp st(0)
fld qword [0x101624a0]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x100251b0
fstp st(1)
jmp 0x100251b2
fstp st(0)
push ecx
push ecx
mov ecx, esi
fstp qword [esp]
call fcn.1002203c
add edi, 0xfb
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x139d
jbe 0x1002516c
fldz
push ecx
push ecx
mov ecx, esi
fstp qword [esp]
call fcn.1002203c
push 0
mov ecx, esi
call fcn.100225e0
pop edi
pop esi
leave
ret 4
Function at 0x10025498
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x100254f8
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100254a9
sub esi, ecx
sar esi, 1
cmp esi, 0x40
jle 0x100254c0
push 0x40
pop esi
push 1
mov edx, str.eqesjwfs_ne6
lea ecx, [ebp - 4]
call fcn.100671e3
pop ecx
lea eax, [esi + esi]
push eax
push dword [ebp + 8]
push 1
push dword [ebp - 4]
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.10002a86
pop esi
leave
ret 4

Function at 0x100272f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
pop esi
jmp fcn.10002a86

Function at 0x1002876d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi + 4]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi]
sub ecx, 0x10
pop esi
jmp fcn.10002a86
Function at 0x1002c5ed
Capabilities:
Modify service
Pause service
Persist via windows service
Query or enumerate registry value
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 4
push eax
lea eax, [ebp - 0x24]
mov esi, ecx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push eax
push str.LFlags
push str.SOFTWARE360Safe360krnlsvc
xor ebx, ebx
and dword [ebp - 0x28], ebx
and dword [ebp - 0x24], ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002c642
cmp dword [ebp - 0x24], ebx
mov byte [ebp - 0x24], 1
jne 0x1002c645
mov byte [ebp - 0x24], bl
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Start360KrnlService::OpenSCManager_Handle:_x_Error:_d_r_n
push dword [ebp - 0x24]
push esi
call fcn.1002c802
add esp, 0x14
test edi, edi
je 0x1002c777
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 1
push eax
push 4
push str.RFlags
push str.SOFTWARE360Safe360krnlsvc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x30130
push str.ZhuDongFangYu
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Start360KrnlService::OpenService_Handle:_x_Error:_d_r_n
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call fcn.1002c802
add esp, 0x14
test esi, esi
je 0x1002c770
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x28]
push 4
push eax
push 4
push str.CFlags
push str.SOFTWARE360Safe360krnlsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], 1
call ebx
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 2
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesZhuDongFangYu
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Start360KrnlService::StartService___Ret:_d_Error:_d
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call fcn.1002c802
add esp, 0x14
test ebx, ebx
je 0x1002c769
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea eax, [ebp - 0x20]
push eax
push 0x8c
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038cf9
leave
ret
Function at 0x1002c8c5
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002c9b7
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1002c9b0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 8], ebx
cmp dword [ebp - 8], ebx
jl 0x1002c935
jg 0x1002c925
cmp dword [ebp - 0xc], 0x100000
jbe 0x1002c935
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 2
lea eax, [ebp + 8]
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
mov dword [ebp + 8], ebx
call edi
cmp eax, 0xffffffff
je 0x1002c9af
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x1002c9af
lea ecx, [ebx + 1]
push ecx
call fcn.100390c2
mov edi, eax
pop ecx
test edi, edi
je 0x1002c9af
xor eax, eax
push eax
push eax
push ebx
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, edi
mov byte [eax + edi], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c98d
push 0
sub ecx, edx
lea eax, [ebp - 4]
push eax
lea eax, [ecx + 1]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.10038d3b
pop ecx
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret 8

Function at 0x1002d928
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
push 0x10
pop edi
mov ecx, dword [esi + 0x2c]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x28]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x24]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x20]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x1c]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x18]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x14]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x10]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0xc]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 8]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 4]
sub ecx, edi
pop edi
pop esi
jmp fcn.10002a86

Function at 0x1002f8df
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x44]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi + 4]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi]
sub ecx, 0x10
pop esi
jmp fcn.10002a86
Function at 0x1002ffa6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
push 0x10
pop edi
mov ecx, dword [esi + 0x18]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x14]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0x10]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 0xc]
sub ecx, edi
call fcn.10002a86
mov ecx, dword [esi + 8]
sub ecx, edi
pop edi
pop esi
jmp fcn.10002a86

Function at 0x1002ffe1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.100303b5
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi + 4]
sub ecx, 0x10
call fcn.10002a86
mov ecx, dword [esi]
sub ecx, 0x10
pop esi
jmp fcn.10002a86

Function at 0x10032db1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
push eax
push 0x20119
xor edi, edi
mov ebx, ecx
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10032ef4
mov edi, dword [ebp + 8]
push 9
pop ecx
rep stosd dword es:[edi], eax
mov eax, 0x400
xor edi, edi
mov esi, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push str.Operator
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032e2d
cmp dword [ebp - 8], 1
jne 0x10032eeb
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
lea ebx, [eax + ebx]
sub esi, eax
je 0x10032eeb
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push str.IssueDate
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032e68
cmp dword [ebp - 8], 1
jne 0x10032eeb
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
add ebx, dword [ebp - 4]
sub esi, dword [ebp - 4]
je 0x10032eeb
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push str.ExpirationDate
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032e9b
cmp dword [ebp - 8], 1
jne 0x10032eeb
mov eax, dword [ebp + 8]
mov dword [eax + 8], ebx
add ebx, dword [ebp - 4]
sub esi, dword [ebp - 4]
je 0x10032eeb
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push str.SignData
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032eeb
cmp dword [ebp - 8], 3
jne 0x10032eeb
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], ebx
sub esi, eax
je 0x10032eeb
add ecx, 0xc
call fcn.10032cee
test eax, eax
je 0x10032eeb
mov eax, dword [ebp + 0xc]
mov ecx, 0x400
sub ecx, esi
xor edi, edi
inc edi
mov dword [eax], ecx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100338cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
xor edi, edi
push edi
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100338fc
mov eax, 0x1013270c
push eax
push eax
push edi
push edi
call fcn.10035bc2
jmp 0x1003390f
cmp esi, dword [ebp - 4]
je 0x10033916
push 0x1013270c
push 1
push edi
push edi
call fcn.10035bd4
add esp, 0x10
xor eax, eax
jmp 0x10033919
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x1003391d
Capabilities:
Get file size

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1003393f
mov eax, 0x1013270c
push eax
push eax
push 0
push 0
call fcn.10035bc2
add esp, 0x10
xor eax, eax
ret
xor eax, eax
inc eax
ret
Function at 0x1003513d
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x10035dbf
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret

Function at 0x10036351
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ecx
and dword [ebp - 0x18], ebx
mov eax, edx
mov dword [ebp - 0x1c], eax
push esi
test ecx, ecx
je 0x10036447
test eax, eax
je 0x10036447
mov ecx, 0x2800
call fcn.10036642
mov esi, eax
test esi, esi
je 0x10036447
push edi
xor edi, edi
push edi
push str..PhysicalDrive_d
push 0x2800
push esi
call fcn.10034d77
add esp, 0x10
xor eax, eax
push eax
push 0x80
push 3
push eax
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x10036431
xor eax, eax
push 0x2800
push eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x18]
push 0
push eax
push 0x2800
push esi
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10036424
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10036424
mov edx, dword [ebp - 0x20]
add eax, esi
push eax
push dword [ebp - 0x1c]
mov ecx, str.DISKID:
call fcn.1003616f
pop ecx
pop ecx
mov ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1003643b
inc edi
cmp edi, 0x10
jl 0x10036397
push esi
call fcn.10041699
pop ecx
mov eax, ebx
pop edi
jmp 0x1003644a
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10038cf9
leave
ret
Function at 0x100364ec
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x18], edx
xor esi, esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], esi
mov ebx, esi
push edi
test eax, eax
je 0x1003663a
test edx, edx
je 0x1003663a
mov ecx, 0x200
call fcn.10036642
mov edi, eax
test edi, edi
je 0x1003663a
lea eax, [ebp - 8]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003662f
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x14], esi
push eax
push edi
push esi
jmp 0x100365d0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
mov edx, edi
call fcn.10034eb6
pop ecx
test eax, eax
je 0x100365bf
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [edi + 4]
mov dword [ebp - 4], 0x200
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push str.ServiceName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100365b6
mov ecx, edi
mov dword [edi], 0x5c2e5c5c
call fcn.10036458
cmp edx, dword [ebp - 0xc]
jb 0x100365b6
ja 0x100365b1
cmp eax, ebx
jbe 0x100365b6
mov ebx, eax
mov dword [ebp - 0xc], edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 4]
push esi
push esi
push esi
push esi
push ecx
inc eax
push edi
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10036559
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
cmp eax, esi
ja 0x100365fc
cmp ebx, esi
jbe 0x1003662f
push eax
push ebx
push str._012I64X
push 0x200
push edi
call fcn.10034d77
add esp, 0x14
test eax, eax
jne 0x1003661a
or esi, 0xffffffff
jmp 0x1003662f
mov edx, dword [ebp - 0x20]
mov ecx, str.MAC:
push edi
push dword [ebp - 0x18]
call fcn.1003616f
pop ecx
pop ecx
mov esi, eax
push edi
call fcn.10041699
pop ecx
mov eax, esi
jmp 0x1003663d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003737b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x10112561
call fcn.10060555
mov eax, dword [0x1019360c]
test eax, eax
je 0x10037447
mov ecx, dword [eax + 4]
cmp ecx, 0xffffffff
jne 0x100373a2
and dword [ebp - 0x14], 0
jmp 0x100373b9
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10037449
mov eax, dword [0x1019360c]
cmp dword [eax], 0
je 0x10037447
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10037447
and dword [ebp - 4], eax
mov ecx, 0x1019360c
call fcn.10037465
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1003744f
mov eax, dword [0x1019360c]
cmp dword [eax + 4], 0xffffffff
je 0x10037405
push esi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10037405
or dword [ebp - 4], 0xffffffff
jmp 0x10037431
mov dword [ebp - 0x1c], 4
push 0x10170340
lea eax, [ebp - 0x1c]
jmp 0x1003745e
mov eax, dword [0x1019360c]
cmp dword [eax], 0
je 0x10037443
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
jmp 0x10037449
xor eax, eax
call fcn.100604b3
ret
mov dword [ebp - 0x18], 1
push 0x10170340
lea eax, [ebp - 0x18]
push eax
call fcn.1003fbb5
int3

Function at 0x10037465
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebx]
mov ecx, eax
add edx, 8
mov dword [ebp - 4], ecx
mov esi, dword [edx + 0x5a8]
mov dword [edx + 0x5b0], esi
cmp esi, edx
je 0x10037505
mov eax, dword [esi + 0x5a8]
mov dword [edx + 0x5b0], eax
test esi, esi
je 0x10037505
cmp ecx, dword [esi]
jne 0x100374a8
mov edi, esi
jmp 0x100374df
push dword [esi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x100374d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100374cb
push esi
call fcn.10037670
jmp 0x100374df
push 0x101623cc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x100374df
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
mov esi, dword [ecx + 0x5b0]
cmp esi, ecx
je 0x10037501
mov eax, dword [esi + 0x5a8]
mov dword [ecx + 0x5b0], eax
mov ecx, dword [ebp - 4]
test esi, esi
jne 0x100374a0
test edi, edi
jne 0x1003751a
mov ecx, dword [ebx]
add ecx, 8
call fcn.100376b4
mov edi, eax
test edi, edi
je 0x1003751a
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret