joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005add0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1028adc8], 0
je 0x1005afd9
push edi
mov edi, 0x936aac
call edi
mov edx, 0x4e245f
mov ecx, dword [eax + 0x124]
call edx
test al, al
jne 0x1005afd8
push esi
call edi
mov esi, 0x927c78
mov ecx, dword [eax + 0x94]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0xb8]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0xec]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x12c]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x100]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0xdc]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x19c]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x18c]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x9c]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x180]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x17c]
call esi
test al, al
jne 0x1005afd7
call edi
mov ecx, dword [eax + 0x16c]
call esi
test al, al
jne 0x1005afd7
push ebx
push 0x39
mov esi, 0x7fc95b
call esi
mov ebx, 0x7fb628
mov ecx, eax
call ebx
test al, al
jne 0x1005afd6
push 1
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005afd6
push 0x41
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005afd6
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1023d7f8]
cmp eax, 0x5dc
jb 0x1005afd6
call esi
cmp byte [0x1023d7fd], 1
mov dword [0x1023d7f8], eax
jne 0x1005af5a
pop ebx
pop esi
mov byte [0x1023d7fd], 0
mov dword [0x11c4454], 0
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, 0x1023cd58
call fcn.10062ff0
xorps xmm0, xmm0
mov dword [0x10832eac], 0
movups xmmword [0x10832e9c], xmm0
mov eax, 0x32
mov ecx, 0xffff
mov word [0x10832f04], cx
mov word [0x108341c4], cx
sub eax, 1
jne 0x1005af82
mov dword [ebp - 7], eax
lea edx, [eax + 5]
mov byte [0x1023d7fd], 1
lea ecx, [ebp - 8]
mov dword [0x11c4454], 1
mov dword [ebp - 8], 0xe8f305c1
mov byte [ebp - 4], 3
call fcn.10084a30
call edi
mov eax, dword [eax + 0x94]
mov esi, dword [eax]
call edi
mov ecx, dword [eax + 0x94]
mov eax, dword [esi + 0x3c]
call eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1005cff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1023d7fd], 0
je 0x1005d1b3
movss xmm1, dword [0x11b3794]
xor eax, eax
movss xmm0, dword [0x100bc6ac]
xorps xmm4, xmm4
comiss xmm0, xmm1
setae al
movd xmm5, eax
cvtdq2ps xmm5, xmm5
ucomiss xmm5, xmm4
lahf
test ah, 0x44
jnp 0x1005d031
movaps xmm2, xmm1
jmp 0x1005d039
movss xmm2, dword [0x11b3798]
mulss xmm2, dword [0x100bcc7c]
movaps xmm3, xmm1
mulss xmm3, dword [0x100bcc7c]
ucomiss xmm5, xmm4
subss xmm3, xmm2
lahf
test ah, 0x44
jnp 0x1005d05e
movaps xmm2, xmm1
jmp 0x1005d066
movss xmm2, dword [0x11b3798]
mulss xmm2, dword [0x100bcb6c]
ucomiss xmm5, xmm4
addss xmm2, xmm3
lahf
test ah, 0x44
jnp 0x1005d080
movaps xmm0, xmm1
jmp 0x1005d088
movss xmm0, dword [0x11b3798]
ucomiss xmm5, xmm4
mulss xmm0, xmm4
lahf
addss xmm0, xmm2
divss xmm0, xmm1
test ah, 0x44
jnp 0x1005d0a2
movaps xmm3, xmm1
jmp 0x1005d0aa
movss xmm3, dword [0x11b3798]
movss xmm6, dword [0x100bcba8]
mulss xmm3, xmm6
ucomiss xmm5, xmm4
addss xmm3, xmm2
lahf
divss xmm3, xmm1
movss dword [ebp - 4], xmm3
test ah, 0x44
jnp 0x1005d0d1
movaps xmm2, xmm1
jmp 0x1005d0d9
movss xmm2, dword [0x11b3798]
mulss xmm2, xmm6
push ebx
push esi
push edi
divss xmm2, xmm1
push 0xd2
cvttss2si eax, xmm0
cvttss2si ebx, xmm2
push ebx
push 0x50
push eax
mov eax, 0x799756
call eax
mov edi, dword [ebp + 8]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 1
jne 0x1005d150
cmp word [edi + 0x16], 0
jle 0x1005d12c
call esi
sub eax, dword [0x10832ebc]
cmp eax, 0x32
jbe 0x1005d150
mov eax, dword [0x10832ea8]
test eax, eax
jle 0x1005d150
dec eax
jmp 0x1005d144
call esi
sub eax, dword [0x10832ebc]
cmp eax, 0x32
jbe 0x1005d150
mov eax, dword [0x10832ea8]
cmp eax, 0xc
jge 0x1005d150
inc eax
mov dword [0x10832ea8], eax
call esi
mov dword [0x10832ebc], eax
cvttss2si eax, dword [ebp - 4]
push 0xd2
push ebx
push 0x50
push eax
mov eax, 0x799756
call eax
add esp, 0x10
cmp al, 1
jne 0x1005d1b0
cmp word [edi + 0x16], 0
jle 0x1005d18c
call esi
sub eax, dword [0x10832ebc]
cmp eax, 0x32
jbe 0x1005d1b0
mov eax, dword [0x10832eac]
test eax, eax
jle 0x1005d1b0
dec eax
jmp 0x1005d1a4
call esi
sub eax, dword [0x10832ebc]
cmp eax, 0x32
jbe 0x1005d1b0
mov eax, dword [0x10832eac]
cmp eax, 0xc
jge 0x1005d1b0
inc eax
mov dword [0x10832eac], eax
call esi
mov dword [0x10832ebc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100645c0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x100c6040]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
mov dword [0x10835498], 0x100bb37c
mov ecx, 0x2000
mov eax, 0x108354a0
xor edx, edx
mov byte [eax - 4], 0
mov word [eax - 2], dx
lea eax, [eax + 0x10]
mov byte [eax - 0x10], dl
mov word [eax - 0xe], dx
mov byte [eax - 0xc], dl
mov dword [eax - 8], edx
sub ecx, 1
jne 0x100645f1
xor eax, eax
mov byte [0x1085549c], dl
push str.DataLocalItemAddOption.bmd
lea ecx, [esp + 0x14]
mov word [0x1085549e], ax
mov byte [0x108554a0], al
mov word [0x108554a2], ax
mov byte [0x108554a4], al
mov dword [0x108554a8], eax
call fcn.10064fd0
cmp dword [esp + 0x24], 0xf
lea eax, [esp + 0x10]
push 0x100b8174
cmova eax, dword [esp + 0x14]
push eax
call fcn.1008f91a
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1006471d
push ebx
push 1
push 0x20000
push 0x1083549c
call fcn.1008fd98
add esp, 0x10
mov word [esp + 0xc], 0xcffc
xor esi, esi
mov byte [esp + 0xe], 0xab
lea edi, [esi + 2]
nop dword [eax]
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xc]
lea ecx, [edi - 1]
xor byte [esi + 0x1083549c], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xd]
mov ecx, esi
xor byte [esi + 0x1083549d], al
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xe]
lea ecx, [edi + 1]
xor byte [esi + 0x1083549e], al
add edi, 4
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [esp + ecx + 0xf]
xor byte [esi + 0x1083549f], al
add esi, 4
cmp edi, 0x20002
jl 0x10064690
push ebx
call fcn.1008fb8f
add esp, 4
mov bl, 1
jmp 0x1006471f
xor bl, bl
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x10064751
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10064747
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100647c1
push ecx
push edx
call fcn.1008c47b
add esp, 8
test bl, bl
jne 0x100647a7
push 0xff
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.1008e1e0
add esp, 0xc
lea eax, [esp + 0x28]
push str.DataLocalItemAddOption.bmd
push str._s___File_not_exist.
push eax
call fcn.10011430
add esp, 0xc
lea eax, [esp + 0x28]
push 0
push 0
push eax
push dword [0x11c3e7c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
push dword [0x11c3e7c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x12c]
mov eax, 0x10835498
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008c0ce
mov esp, ebp
pop ebp
ret
call fcn.10095410
int3
Function at 0x100807a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100c6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1f8], 0
je 0x10080805
lea ecx, [ebp - 0x408]
call fcn.10004990
push ecx
lea eax, [ebp - 0x40c]
push eax
lea eax, [esi + 0x1bb]
push eax
lea ecx, [ebp - 0x408]
call fcn.10004ac0
test al, al
je 0x10080814
mov eax, dword [esi + 0x1f8]
cmp eax, dword [ebp - 0x40c]
jne 0x10080814
push ecx
mov ecx, esi
call fcn.10080840
mov ecx, esi
call fcn.10080b00
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008c0ce
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push str.CheckSumFile_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10080b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x100c6040]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x20e0d4]
cmp esi, dword [edi + 0x20e0d8]
je 0x10080b99
lea ebx, [edi + 0x20e0e0]
lea ecx, [esp + 0x18]
call fcn.10004990
push esi
push str.CheckSum_Error__file:__s_
push ebx
call fcn.1006b080
add esp, 0xc
lea eax, [esp + 0x10]
push 0x100babb8
push esi
push eax
call fcn.1008f931
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x10080bae
push eax
call fcn.1008fb8f
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.10004ac0
test al, al
je 0x10080bae
mov eax, dword [esi + 0x80]
cmp eax, dword [esp + 0x14]
jne 0x10080bae
add esi, 0x84
cmp esi, dword [edi + 0x20e0d8]
jne 0x10080b33
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008c0ce
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10084690
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x105e4dd8], 3
push ebx
push esi
push edi
mov edi, ecx
jne 0x100846c5
cmp dword [0x105e4dc0], 0
je 0x100846c5
mov edx, 5
mov dword [ebp - 8], 0x51bf05c1
lea ecx, [ebp - 8]
mov byte [ebp - 4], 0
call fcn.10084a30
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x105e4ddc], 0
mov dword [0x105e4dd8], 0
call esi
mov dword [0x105e4dd4], eax
call esi
mov dword [0x105e4dd0], eax
xor ecx, ecx
mov eax, dword [edi + 0x48]
mov dword [0x105e2d10], eax
mov eax, dword [edi + 0x4c]
mov dword [0x105e2d0c], eax
mov eax, dword [edi + 0x50]
mov dword [0x105e2d08], eax
mov eax, dword [edi + 0x54]
mov dword [0x105e4db4], eax
mov eax, dword [edi + 0x58]
mov dword [0x105e4db0], eax
mov eax, dword [edi + 0x5c]
mov dword [0x105e4dac], eax
mov eax, dword [edi + 0x60]
mov dword [0x105e4da8], eax
mov eax, dword [edi + 0x64]
mov dword [0x105e4da4], eax
mov eax, dword [edi + 0x68]
mov dword [0x105e4da0], eax
mov eax, dword [edi + 0x6c]
mov dword [0x105e4d9c], eax
mov eax, dword [edi + 0x70]
mov dword [0x105e4d98], eax
mov eax, dword [edi + 0x74]
mov dword [0x105e4d94], eax
mov eax, dword [edi + 0x78]
mov dword [0x105e4d60], eax
mov eax, dword [edi + 0x7c]
mov dword [0x105e4d5c], eax
mov eax, dword [edi + 0x80]
mov dword [0x105e4d58], eax
mov eax, dword [edi + 0x84]
mov dword [0x105e4d54], eax
mov eax, dword [edi + 0x88]
mov dword [0x105e4d50], eax
mov eax, dword [0x7f05cac]
mov dword [0x105e4dcc], 0
mov dword [0x105e4dc8], 0
mov dword [0x105e4dc4], 0
mov word [eax + 0x7e], cx
mov eax, dword [0x7f05cac]
mov dword [0x105e4dc0], 0
mov byte [eax + 0x328], cl
mov eax, dword [0x8499dcc]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x100847d1
jmp dword [eax*4 + 0x100848d4]
cmp dword [0x1028abf4], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x55b6a2
add bl, 2
call esi
mov byte [0x55b6a2], bl
jmp 0x10084853
cmp dword [0x1028abfc], 0xffff
jmp 0x100847e2
cmp dword [0x1028ac00], 0xffff
jmp 0x100847e2
cmp dword [0x1028ac04], 0xffff
jmp 0x100847e2
cmp dword [0x1028ac08], 0xffff
jmp 0x100847e2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x55b6a2
call esi
mov byte [0x55b6a2], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x55b6a2
call esi
mov eax, dword [edi + 0x90]
mov edx, 4
mov ecx, dword [edi + 0x94]
mov dword [0x105e4c6c], ecx
mov dword [0x105e4c68], eax
mov eax, dword [edi + 0x98]
mov ecx, dword [edi + 0x9c]
mov dword [0x105e4c74], ecx
mov dword [0x105e4c70], eax
mov ecx, dword [edi + 0xa4]
mov eax, dword [edi + 0xa0]
mov dword [0x105e2d1c], ecx
lea ecx, [ebp - 8]
mov dword [0x105e2d18], eax
mov dword [ebp - 8], 0xf7f304c1
call fcn.10084a30
push dword [0x1049b0bc]
call fcn.10036610
call fcn.100522c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100852b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100c6040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x118d320], 5
jne 0x10085431
cmp dword [0x105e4ddc], 2
je 0x10085431
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [0x1028ac10]
mov dword [0x105e4ddc], 1
mov dword [0x105e4dd8], 0
call esi
mov dword [0x105e4dd4], eax
call esi
mov dword [0x105e4dd0], eax
xor esi, esi
mov eax, dword [0x11c4494]
mov ecx, 0x43734e
mov dword [0x105e4dcc], 0x7530
mov dword [0x105e4dc8], edi
mov dword [0x105e4dc4], 0
movzx eax, byte [eax + 8]
mov dword [0x105e4dc0], eax
nop dword [eax]
xor al, al
mov edi, 6
mov byte [ebp - 0x105], al
mov ebx, 4
lea eax, [ebp - 0x100]
sub edi, eax
nop word [eax + eax]
push esi
call ecx
mov ecx, eax
mov eax, 0x9265d0
call eax
test eax, eax
je 0x100853b7
cmp byte [eax + 0x328], 0
je 0x100853b7
movzx ecx, word [eax + 0x7e]
mov eax, ecx
mov byte [ebp - 0x10b], cl
shr eax, 8
mov byte [ebp - 0x10c], al
lea eax, [edi + ebx]
lea eax, [ebp + eax - 0x104]
cmp eax, 0x100
ja 0x100853c5
mov ax, word [ebp - 0x10c]
mov word [ebp + ebx - 0x104], ax
add ebx, 2
inc byte [ebp - 0x105]
inc esi
mov ecx, 0x43734e
cmp esi, 0x190
jb 0x10085360
mov al, byte [ebp - 0x105]
push 0xffffffffffffffff
mov byte [ebp - 0x101], al
lea eax, [ebp - 0x104]
push ebx
push eax
push 0x14
mov byte [ebp - 0x104], 0xc1
mov byte [ebp - 0x103], bl
mov byte [ebp - 0x102], 0x14
call int.10080df0
add esp, 0x10
mov ecx, 0x43734e
cmp esi, 0x190
jb 0x10085340
mov ecx, dword [0x8499dcc]
pop edi
pop esi
pop ebx
movq xmm0, qword [ecx]
movq qword [0x105e4df0], xmm0
mov ax, word [ecx + 8]
mov word [0x105e4df8], ax
mov al, byte [ecx + 0xa]
mov byte [0x105e4dfa], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c0ce
mov esp, ebp
pop ebp
ret

Function at 0x10085b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10085ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x10085bc0
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10085be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.1008dc60
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10085d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100c6040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1008e1e0
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
call fcn.10064330
add esp, 0x10
lea eax, [ebp - 0x104]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10085ea0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c32c8
push 0x1008da90
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x100c6040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x148], edx
push ecx
push str..PhysicalDrive_d
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x14c], esi
cmp esi, 0xffffffff
je 0x10086047
mov dword [ebp - 0x130], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x140], xmm0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
push 0
lea eax, [ebp - 0x144]
push eax
push 8
lea eax, [ebp - 0x140]
push eax
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10085f7f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10086047
push dword [ebp - 0x13c]
call fcn.1008c832
mov edi, eax
mov dword [ebp - 0x150], edi
push dword [ebp - 0x13c]
push 0
push edi
call fcn.1008e1e0
add esp, 0x10
push 0
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x13c]
push edi
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10086037
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10086037
mov dword [ebp - 4], 0
add eax, edi
push eax
push 0x100
push dword [ebp - 0x148]
call fcn.10095482
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1008c83b
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x10086049
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1008c83b
add esp, 4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1008c0ce
mov esp, ebp
pop ebp
ret
Function at 0x1008aa30
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
mov ecx, 0x78
push edi
call fcn.1008a980
mov esi, dword [esp + 0x1c]
mov ebp, eax
xor edx, edx
nop dword [eax + eax]
movzx ecx, byte [edx + str.91__]
dec ecx
mov eax, ecx
and ecx, 7
sar eax, 3
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100b845c], al
movzx ecx, byte [edx + 0x100b84bd]
setne al
dec ecx
mov byte [edx + ebp], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100b845c], al
movzx ecx, byte [edx + 0x100b84be]
setne al
dec ecx
mov byte [edx + ebp + 1], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100b845c], al
movzx ecx, byte [edx + 0x100b84bf]
setne al
dec ecx
mov byte [edx + ebp + 2], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x100b845c], al
setne al
mov byte [edx + ebp + 3], al
add edx, 4
cmp edx, 0x38
jl 0x1008aa50
xor ebx, ebx
nop word [eax + eax]
movzx esi, byte [ebx + 0x100b84ac]
xorps xmm0, xmm0
movq qword [ebp + 0x70], xmm0
xor edx, edx
lea edi, [esi - 0x1c]
cmp edx, 0x1c
mov ecx, esi
sbb eax, eax
and eax, 0xffffffe4
add eax, 0x38
cmp esi, eax
cmovge ecx, edi
inc esi
inc edi
mov al, byte [ecx + ebp]
mov byte [edx + ebp + 0x38], al
inc edx
cmp edx, 0x38
jl 0x1008ab04
xor ecx, ecx
nop word [eax + eax]
movzx eax, byte [ecx + 0x100b847c]
cmp byte [eax + ebp + 0x37], 0
je 0x1008ab61
mov eax, 0xaaaaaaab
mul ecx
mov eax, ecx
shr edx, 2
lea esi, [edx + ebp]
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
mov eax, dword [eax*4 + 0x100b845c]
sar eax, 2
or byte [esi + 0x70], al
inc ecx
cmp ecx, 0x30
jl 0x1008ab30
movzx ecx, byte [ebp + 0x70]
movzx eax, byte [ebp + 0x72]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x74]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x76]
shl ecx, 8
or ecx, eax
mov eax, dword [edx + 0x8c]
mov dword [eax + ebx*8], ecx
movzx ecx, byte [ebp + 0x71]
movzx eax, byte [ebp + 0x73]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x75]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 0x77]
shl ecx, 8
or ecx, eax
mov eax, dword [edx + 0x8c]
mov dword [eax + ebx*8 + 4], ecx
inc ebx
cmp ebx, 0x10
jl 0x1008aaf0
cmp dword [esp + 0x18], 1
jne 0x1008ac15
xor ebx, ebx
mov edi, 0x7c
mov eax, dword [edx + 0x8c]
mov ecx, dword [eax + ebx]
lea edx, [eax + ebx]
lea esi, [eax + edi]
mov eax, dword [esi - 4]
mov dword [edx], eax
mov dword [esi - 4], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x8c]
mov ecx, dword [eax + ebx + 4]
lea edx, [eax + ebx]
lea esi, [eax + edi]
sub edi, 8
mov eax, dword [esi]
lea ebx, [ebx + 8]
mov dword [edx + 4], eax
mov edx, dword [esp + 0x10]
mov dword [esi], ecx
cmp edi, 0x3c
jg 0x1008abd4
xor al, al
mov edi, ebp
mov ecx, 0x78
rep stosb byte es:[edi], al
push ebp
call fcn.1008fed3
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x1008b680
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
mov ecx, esi
push 8
push dword [edi + 0x20]
call fcn.1008a600
mov ecx, dword [edi + 0x3c]
add esp, 8
add ecx, 4
push esi
push dword [esp + 0x14]
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
mov edx, dword [edi + 0x38]
mov ecx, 2
sub edx, esi
mov eax, dword [edx + esi]
lea esi, [esi + 4]
xor dword [esi - 4], eax
sub ecx, 1
jne 0x1008b6b6
pop edi
pop esi
ret 0xc

Function at 0x1009c4f3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1009c532
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009c532
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009c532
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1009c532
cmp dword [ecx + 0x74], 0xe
jbe 0x1009c532
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret