joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbae0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov esi, 0xd591a0
mov dl, byte [edi + 0x54f160]
mov al, dl
mov cl, dl
and al, 2
mov bl, dl
neg al
sbb al, al
and cl, 1
and eax, 0xb4
mov byte [esp + 0xd], cl
neg cl
sbb cl, cl
and ecx, 0x5a
shr bl, 2
xor bl, cl
mov byte [esp + 0xe], cl
xor bl, al
mov cl, dl
xor bl, dl
shr cl, 1
mov byte [esp + 0x10], bl
mov bl, byte [esp + 0xd]
xor cl, dl
shr cl, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor cl, bl
mov bl, byte [esp + 0xe]
xor cl, bl
mov bl, byte [edi + 0x54f260]
xor cl, al
mov al, bl
and al, 2
xor cl, dl
neg al
sbb al, al
and eax, 0xb4
mov byte [esp + 0xd], al
mov al, bl
and al, 1
mov byte [esp + 0xe], al
neg al
sbb al, al
and eax, 0x5a
shr bl, 2
mov byte [esp + 0xf], al
xor bl, al
mov al, byte [esp + 0xd]
xor bl, al
mov al, byte [edi + 0x54f260]
xor bl, al
mov byte [esp + 0x13], al
mov byte [esp + 0x11], bl
mov bl, byte [esp + 0x13]
shr al, 1
xor al, bl
mov bl, byte [esp + 0xe]
shr al, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor al, bl
mov bl, byte [esp + 0xf]
xor al, bl
mov bl, byte [esp + 0xd]
xor al, bl
mov bl, byte [edi + 0x54f260]
xor al, bl
mov byte [esp + 0x14], bl
mov bl, byte [esp + 0x11]
mov byte [esp + 0x16], al
mov byte [esp + 0x15], bl
mov byte [esp + 0x17], al
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x14], cl
mov dword [esi - 0x400], ebx
mov bl, byte [esp + 0x10]
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], dl
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x15], al
mov dword [esi], ebx
mov bl, byte [esp + 0x11]
mov byte [esp + 0x14], bl
mov bl, byte [edi + 0x54f260]
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x15], dl
mov dword [esi + 0x400], eax
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], al
add esi, 4
mov ecx, dword [esp + 0x14]
inc edi
mov dword [esi + 0x7fc], ecx
cmp esi, 0xd595a0
jl 0x4dbaed
pop edi
pop esi
mov dword [0x54f360], 0
pop ebx
add esp, 0xc
ret
Function at 0x4e8d03
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e8d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e3e0d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4e8d46
test byte [esp + 8], 2
je 0x4e8d46
call fcn.004e3e80
mov dword [eax], 0xd
call fcn.004e3e89
mov dword [eax], 5
jmp 0x4e8d1f
xor eax, eax
ret
Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10013434
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064064
call fcn.10063688
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x7b48
cmp dword [ebp - 0x18], 0x7cc8
push edi
mov dword [ebp - 0x10], esp
jle 0x100134ae
push 0
push 0
push 0x941
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x10654198
xor eax, esi
cdq
push edx
push eax
call fcn.1001398d
inc esi
cmp esi, 0x2f72
jl 0x1001347c
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x1390
jl 0x1001346f
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x526a
jl 0x1001346d
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x79d1
jge 0x100134ca
mov edx, 0x100083b8
mov ecx, 0x10654198
call fcn.10011df5
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100135c6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064078
call fcn.10063688
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x7bc7
cmp dword [ebp - 0x14], 0x7e85
push edi
mov dword [ebp - 0x10], esp
jle 0x1001361a
push 0x6c0
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10654198
xor eax, esi
cdq
push edx
push eax
call fcn.1001398d
inc edi
cmp edi, 0x4a59
jl 0x100135f7
inc esi
cmp esi, 0x1295
jl 0x100135f5
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x793c
jge 0x10013636
mov edx, 0x10008468
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013663
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064082
call fcn.10063688
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x7f95
cmp dword [ebp - 0x18], 0x7fb0
push edi
mov dword [ebp - 0x10], esp
jle 0x100136ca
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, 0x10654198
xor eax, esi
cdq
push edx
push eax
call fcn.1001398d
inc esi
cmp esi, 0x43df
jl 0x10013698
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x7265
jl 0x1001368d
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x66b3
jl 0x1001368b
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7ec8
jge 0x100136e6
mov edx, 0x100084d8
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013b5d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0x8cff0ea7
push ebx
mov dword [ebp - 0xc], 0x121a
xor ebx, ebx
mov dword [ebp - 0x10], 0x2a831d26
push esi
mov byte [ebp - 1], bl
mov esi, ecx
push edi
mov edi, edx
cmp byte [ebp - 1], bl
je 0x10013b90
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 8], 0xffffffe2
jmp 0x10013bd0
mov dword [ebp - 0x10], 0x13281d21
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10013bae
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jg 0x10013bbf
cmp dword [ebp - 0x10], ebx
jne 0x10013bbf
mov eax, ebx
jmp 0x10013bc2
xor eax, eax
inc eax
cmp eax, 0xa9ef72d4
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10013b99
mov dword [ebp - 0xc], 0xd6f2ee76
mov dword [ebp - 8], 0xf3de0369
mov dword [ebp - 8], 0xfffffffa
cmp dword [ebp - 0xc], ebx
je 0x10013c7c
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10013c0f
push 0x222e
push 0x2064
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 0xd
je 0x10013cb1
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
jmp 0x10013c3f
cmp dword [ebp - 0x10], ebx
jne 0x10013c45
mov dword [ebp - 8], 0x23e86f8c
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
jle 0x10013c30
mov dword [ebp - 8], 0xfffffffb
cmp dword [ebp - 8], 0xfffffff1
jne 0x10013c71
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10013c65
push 0xd76
call dword [sym.imp.USER32.dll_GetParent]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff1
je 0x10013c52
push 0xfffffffffffffffe
pop eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xd
jne 0x10013c1f
jmp 0x10013cb1
mov dword [ebp - 0xc], 1
xor ecx, ecx
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x1e525036
mov eax, dword [ebp - 0x10]
cmp eax, 1
setge cl
cmp ecx, dword [ebp - 0xc]
jle 0x10013cab
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov dword [esi], ebx
jmp 0x10013cbe
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], ebx
inc dword [esi]
cmp dword [esi], 1
jl 0x10013cb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ef2e
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001efaf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ef62
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001efad
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001ef90
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001efad
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000d926
mov dword [eax], 0xffff
jmp 0x1001ef85
jmp 0x1001efd1
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001efc7
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1001efd1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esp, ebp
pop ebp
ret

Function at 0x1001f261
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f285
push 0x7c3f
push 0x32d5
push 0
call fcn.10020a34
add esp, 0xc
jmp 0x1001f2f8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001f2b0
push 0
push 0x1b5e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1001f2f8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f2de
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001f2f8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000d926
and dword [eax], 0
jmp 0x1001f2d3
mov esp, ebp
pop ebp
ret
Function at 0x1002d056
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d0a0
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002d081
push 0xb18
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x1002d09e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d09e
push 0xe51
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1002d0c6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x3b11
push 0x3d90
push dword [ebp - 0x10]
push 1
call fcn.10018fcc
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1002d552
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002d5b6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002d58b
push 0
push 0x1b5e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1002d5b4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
jmp 0x1002d5db
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
call fcn.10024c66
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1002d5f7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002d66d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002d629
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1002d66b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002d657
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x16
je 0x1002d66b
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x1002d669
jmp 0x1002d66b
jmp 0x1002d64c
jmp 0x1002d690
push 0x3e2
push 0x476
push 0x55d7
push 0x212a
push 0x3e2b
push 1
call fcn.1002d0ca
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1002fa41
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002fa9b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002fa8f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002fa99
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1002fad2
push 0x7a1
push 0x10e0
push 0
push 0x2ae
push 0x5aad
push 0x7405
push 0x1015
push 0xcc2
push 0x2f13
push 0x316d
call fcn.10020fbb
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x100311ea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10031202
push 1
call fcn.10031275
pop ecx
jmp 0x10031271
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003126b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003124c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10031269
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000d926
mov dword [eax], 0x831e42a4
jmp 0x10031241
jmp 0x10031271
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x10032845
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003286c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x66bc
call fcn.1003289b
add esp, 0xc
jmp 0x10032897
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003288d
push 0
push 0
push 0x1950
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x10032897
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret
Function at 0x1003ef83
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100644cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x19ab
cmp dword [ebp - 0x38], 0x459
jge 0x1003f0c1
lea ecx, [ebp - 0x50]
call fcn.10018269
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x10654250
call fcn.10017fa7
mov ecx, eax
call fcn.10017fa7
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 4]
call fcn.10018fc1
movzx eax, al
test eax, eax
je 0x1003f0b5
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x50]
call fcn.10037ab0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x50]
call fcn.10018276
and dword [ebp - 0x1c], 0
jmp 0x1003f02b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jge 0x1003f04b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x50]
call fcn.1000d926
push eax
mov ecx, 0x10654250
call fcn.10017fa7
jmp 0x1003f024
and dword [ebp - 0x14], 0
jmp 0x1003f058
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x50]
call fcn.1001856a
cmp dword [ebp - 0x14], eax
jae 0x1003f097
push dword [ebp - 0x14]
lea ecx, [ebp - 0x50]
call fcn.1000d926
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
jl 0x1003f093
push dword [ebp - 0x14]
lea ecx, [ebp - 0x50]
call fcn.1000d926
mov ecx, dword [ebp - 0x20]
sub ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1003f095
jmp 0x1003f097
jmp 0x1003f051
push fcn.10011fcc
push dword [ebp - 0x24]
mov ecx, 0x10654198
call fcn.100180e7
mov ecx, eax
call fcn.1000d598
jmp 0x1003efd0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1000d921
mov eax, dword [ebp - 0x18]
mov dword [eax], 0xffffffe2
jmp 0x1003f0d7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 3
jge 0x1003f137
mov dword [ebp - 0x40], 0x13281d21
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1003f0f8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x1003f110
cmp dword [ebp - 0x40], 0
jne 0x1003f110
and dword [ebp - 0x30], 0
jmp 0x1003f117
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0xa9ef72d4
jb 0x1003f129
mov dword [ebp - 0x34], 1
jmp 0x1003f12d
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1003f0cc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret