joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa28176
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x160], esi
push edi
mov edi, edx
test ecx, ecx
jne 0xa34be0
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemTime]
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
cmp edi, 1
jne 0xa342c1
movzx eax, word [ebp - 0x14a]
push 0xa
pop ecx
cdq
idiv ecx
mov ecx, 0xa45560
push eax
movzx eax, word [ebp - 0x14c]
push 0xa45580
push eax
movzx eax, word [ebp - 0x14e]
push ecx
push eax
movzx eax, word [ebp - 0x150]
push ecx
push eax
push 0xa2826c
test esi, esi
je 0xa3775d
push dword [ebp + 0xc]
push esi
call fcn.00a227c1
add esp, 0x28
lea edx, [esi + 2]
xor ecx, ecx
push 2
pop ebx
mov ax, word [esi]
add esi, ebx
cmp ax, cx
jne 0xa28246
sub esi, edx
sar esi, 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret 8
push 2
xor edi, edi
cmp byte [0xa45044], 0
pop ebx
je 0xa3779a
lea edi, [ebx + 0x7e]
push edi
lea eax, [ebp - 0x148]
push eax
push 0x1003
call fcn.00a2bcae
push eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetLocaleInfoW]
test eax, eax
je 0xa3776a
cmp word [ebp - 0x148], 0
lea edi, [ebp - 0x148]
je 0xa3439e
xor edx, edx
mov esi, edx
jmp 0xa3434d
mov ax, word [ecx]
add ecx, ebx
cmp ax, dx
jne 0xa34311
sub ecx, dword [ebp - 0x15c]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 2]
push edi
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x164]
add esp, 0xc
mov word [edi], ax
xor edx, edx
add edi, ebx
add edi, ebx
cmp word [edi], dx
je 0xa34398
movzx eax, word [edi]
mov dword [ebp - 0x164], eax
cmp eax, 0x27
je 0xa37781
test esi, esi
jne 0xa34344
cmp eax, 0x68
je 0xa34372
cmp eax, 0x6d
je 0xa34372
cmp eax, 0x48
jne 0xa34346
mov ecx, edx
add edi, ebx
inc ecx
cmp word [edi], ax
je 0xa34374
mov eax, ecx
neg eax
lea edi, [edi + eax*2]
cmp ecx, 1
jne 0xa34344
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x15c], eax
jmp 0xa34311
mov esi, dword [ebp - 0x160]
push 0x20
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x158]
push eax
push ebx
call fcn.00a2bcae
push eax
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetTimeFormatW]
test eax, eax
je 0xa3778f
xor edi, edi
test esi, esi
je 0xa377f4
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.00a21417
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, ebx
cmp ax, di
jne 0xa343e2
sub esi, ecx
jmp 0xa28252
lea edx, [ebp - 0x16c]
call fcn.00a34bf5
jmp 0xa281c2
Function at 0xa28ef8
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [0xa45214]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0xa3cd5d
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x26c]
push eax
push 0x208
call fcn.00a221d7
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFullPathNameW]
mov ebx, eax
test ebx, ebx
je 0xa28fc3
push 4
lea eax, [esp + 0x26c]
push 0xa28fdc
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0xa3cd64
mov eax, dword [esp + 0x10]
test eax, eax
je 0xa3cde2
cmp word [eax], 0
je 0xa3cde2
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x37
pop edx
lea ecx, [esp + 0x270]
call fcn.00a28db9
mov ecx, dword [esp + 0x14]
movzx ebx, al
call fcn.00a22be7
test ebx, ebx
jne 0xa28fc3
push 0x5c
pop eax
cmp word [esp + 0x26a], ax
je 0xa34d9e
cmp word [esp + 0x26e], bx
je 0xa3cdc0
mov eax, ebx
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 1
jbe 0xa28fc3
jmp 0xa36323
xor ebx, ebx
inc ebx
jmp 0xa28fc3
xor eax, eax
jmp 0xa28fc5
lea eax, [esp + 0x270]
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0xa3cdab
cmp eax, edi
jbe 0xa3cdab
movzx esi, word [eax]
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
mov edx, eax
lea eax, [edx + 1]
mov word [ecx], si
neg eax
sbb eax, eax
and eax, edx
jmp 0xa28fc5
push edi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and eax, ecx
jmp 0xa28fc5
cmp word [esp + 0x26a], 0x3a
jne 0xa28fc3
cmp word [esp + 0x26c], ax
je 0xa34d9e
jmp 0xa28fc3
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0xa28fc3
Function at 0xa2af1c
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x21c]
push esi
xor eax, eax
mov dword [ebp - 0x224], ebx
push edi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], eax
call fcn.00a2b0ac
test eax, eax
js 0xa3e71b
mov eax, dword [ebp - 0x21c]
cmp eax, 3
jae 0xa2b062
test eax, eax
jne 0xa3e729
inc eax
mov edi, eax
mov dword [ebp - 0x220], eax
push 0x40002748
mov dword [ebp - 0x228], edi
call fcn.00a2b075
mov dword [ebp - 0x218], eax
pop ecx
test eax, eax
je 0xa3e768
mov ebx, eax
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xa2afa4
sub ebx, ecx
sar ebx, 1
cmp ebx, 0x104
jae 0xa2b034
mov ecx, 0x208
call fcn.00a213cb
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
je 0xa2b034
push dword [ebp - 0x218]
mov edx, 0x104
mov ecx, esi
call fcn.00a21417
mov eax, dword [ebp - 0x224]
test eax, eax
je 0xa3e779
cmp dword [eax + 0x3c], 0
je 0xa2b06a
push dword [eax + 0x3c]
mov edx, 0x104
mov ecx, esi
call fcn.00a22c30
test eax, eax
jne 0xa2b029
xor ebx, ebx
test esi, esi
je 0xa2b01d
push esi
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleTitleW]
mov byte [0xa45045], bl
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x220], eax
je 0xa2b034
test esi, esi
je 0xa2b034
mov ecx, esi
call fcn.00a2107b
mov eax, dword [ebp - 0x218]
test eax, eax
je 0xa2b045
push eax
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
test edi, edi
jne 0xa3e768
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret 4
add eax, 0xfffffff0
jmp 0xa2af6d
xor ecx, ecx
mov edi, ecx
jmp 0xa2b029
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
test ebx, ebx
je 0xa3e801
mov ecx, dword [ebx + 0x3c]
call fcn.00a2221b
mov esi, eax
test esi, esi
je 0xa2b01d
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xa3e74a
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0xa2b00c
xor edi, edi
inc edi
xor eax, eax
push eax
push 8
call fcn.00a2e452
pop ecx
pop ecx
jmp 0xa2b04d
lea eax, [ebp - 0x214]
push 0x104
push eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleTitleW]
test eax, eax
je 0xa2b029
push dword [ebp - 0x218]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0xa3e7e2
mov edi, dword [ebp - 0x218]
lea esi, [ebp - 0x214]
add ebx, ebx
add esi, ebx
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0xa3e7c0
mov edi, dword [ebp - 0x228]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x22c]
push dword [ebp - 0x21c]
mov edx, 0x104
mov ecx, esi
call fcn.00a22c30
test eax, eax
je 0xa2b00a
jmp 0xa2b029
xor ebx, ebx
mov esi, ebx
jmp 0xa2b00c
Function at 0xa2ca81
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push esi
mov ecx, 0x208
call fcn.00a213cb
mov esi, eax
test esi, esi
je 0xa36251
push ebx
push edi
mov ebx, 0x104
xor eax, eax
push ebx
push esi
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov edi, 0xa245fc
mov ecx, edi
call fcn.00a21d1b
test eax, eax
je 0xa36259
mov edi, 0xa22ce0
mov ecx, edi
call fcn.00a21d1b
test eax, eax
je 0xa3626a
mov edi, 0xa2bce8
mov ecx, edi
call fcn.00a21d1b
test eax, eax
je 0xa34cbd
mov ecx, 0xa2bcf8
call fcn.00a21d1b
test eax, eax
je 0xa37823
mov ecx, 0xa2101c
call fcn.00a21d1b
xor esi, esi
inc esi
pop edi
pop ebx
test eax, eax
jne 0xa3788d
mov edx, esi
mov ecx, 0xa45a20
pop esi
jmp fcn.00a2577b
mov edx, 0xa34cd0
mov ecx, edi
call fcn.00a2269e
jmp 0xa2cae6
xor ecx, ecx
inc ecx
call fcn.00a2bc91
mov edx, 0xa22214
mov ecx, edi
call fcn.00a2269e
jmp 0xa2cabe
mov edx, 0xa38628
mov ecx, edi
call fcn.00a2269e
jmp 0xa2cad2

Function at 0xa2cc27
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0xa2cc88
call fcn.00a2cca4
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0xa2cc7c
cmp eax, 0xffffffff
je 0xa2cc7c
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0xa2cc75
mov edx, dword [eax + 0x3c]
test edx, edx
js 0xa2cc75
cmp edx, 0x10000000
jae 0xa2cc75
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00a227a8
ret 4
Function at 0xa2d341
Capabilities:
Check if file exists
Get file attributes

Disassembly:
xor eax, eax
inc eax
jmp 0xa2d479
add esi, 2
jmp 0xa2d42c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0xa450e4], eax
jmp 0xa2d451
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x24
mov esi, ecx
pop ecx
call fcn.00a24697
mov edi, eax
mov ecx, edi
mov dword [edi], esi
call fcn.00a2d18f
mov eax, dword [edi + 0x18]
mov ecx, 0x208
mov ebx, dword [edi]
mov esi, dword [edi + 0xc]
mov dword [ebp - 0x214], eax
call fcn.00a24697
xor ecx, ecx
mov dword [0xa450e0], eax
push ecx
mov edx, 0x104
mov ecx, eax
call fcn.00a2557c
push ebx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00a22e4b
test eax, eax
jne 0xa2bb07
push 0x5c
pop eax
mov edx, eax
lea ecx, [ebp - 0x210]
call fcn.00a22aea
xor ecx, ecx
mov edx, 0x104
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0xa45a20
call fcn.00a21417
test esi, esi
je 0xa2d467
movzx eax, word [esi]
push 0x3a
pop ecx
cmp ax, cx
je 0xa2d467
push 0x5c
pop edx
cmp ax, dx
jne 0xa2d42c
cmp esi, ebx
je 0xa2bb0f
mov eax, ebx
xor ecx, ecx
cmp word [eax], cx
je 0xa2d414
mov ecx, eax
add eax, 2
cmp eax, esi
jne 0xa2d404
movzx eax, word [ecx]
push 0x3a
pop ecx
cmp ax, cx
je 0xa2bb0f
cmp ax, dx
je 0xa2bb0f
movzx eax, word [esi]
mov dword [ebp - 0x218], eax
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0xa2bb17
and dword [0xa450e4], 0
mov eax, dword [ebp - 0x218]
mov word [esi], ax
cmp dword [0xa450e4], 0
jne 0xa2bb07
mov ecx, edi
call fcn.00a2d18f
mov eax, dword [ebp - 0x214]
mov dword [edi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
Function at 0xa2e96b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28c
mov eax, dword [0xa45214]
xor eax, esp
mov dword [esp + 0x288], eax
xor eax, eax
lea edx, [esp + 4]
push ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
push esi
push edi
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x74]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [0xa450bc]
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x6c], ebx
call fcn.00a2eb91
cmp eax, 1
je 0xa3d64b
lea eax, [esp + 0x80]
push eax
push 0x106
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCurrentDirectoryW]
cmp dword [esp + 0x58], ebx
je 0xa3d63e
or dword [esp + 0x10], 0x10000
lea ecx, [esp + 0x10]
call fcn.00a2ea7f
mov esi, eax
mov edx, 0x104
lea eax, [esp + 0x80]
mov ecx, 0xa45a20
push eax
call fcn.00a21417
mov ecx, edi
call fcn.00a25353
mov eax, esi
mov ecx, dword [esp + 0x294]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
Function at 0xa3448e
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 0x104
push edx
mov edx, ebx
lea ecx, [ebp - 0x420]
call fcn.00a21417
lea edx, [ebp - 0x420]
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0xa344c6
sub edx, ecx
lea eax, [ebp - 0x218]
push ecx
sar edx, 1
lea ecx, [ebp - 0x420]
push eax
inc edx
call fcn.00a2d8f9
test al, al
je 0xa3661c
push 0xa22ef8
mov edx, 0x106
lea ecx, [ebp - 0x218]
call fcn.00a22c30
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x838]
push eax
push ebx
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeInformationW]
test eax, eax
je 0xa36623
cmp word [ebp - 0x218], 0x5c
je 0xa36645
xor eax, eax
mov word [ebp - 0x216], ax
cmp word [ebp - 0x630], di
je 0xa3665a
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
push 0x235f
push esi
call fcn.00a345da
add esp, 0x14
test eax, eax
jne 0xa345ba
mov ecx, dword [ebp - 0x838]
test ecx, ecx
je 0xa345cb
movzx eax, cx
push eax
movzx eax, word [ebp - 0x836]
push eax
push 0xa33fc0
lea eax, [ebp - 0x830]
push 0x100
push eax
call fcn.00a227c1
add esp, 0x14
lea eax, [ebp - 0x830]
push eax
push 1
push 0x235b
push esi
call fcn.00a345da
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x834], edi
jne 0xa3457e
jmp 0xa345ba
xor eax, eax
jmp 0xa345ba
mov esi, dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
call esi
cmp eax, 0x90
je 0xa3661c
push edi
call esi
push eax
call fcn.00a2e452
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0xa345ba
lea ecx, [ebp - 0x218]
call fcn.00a22b0f
xor ecx, ecx
mov word [eax], cx
jmp 0xa34545
lea eax, [ebp - 0x218]
push eax
push 1
push 0x235e
push esi
call fcn.00a345da
add esp, 0x10
jmp 0xa34570
Function at 0xa349b1
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00a30aea
push esi
mov esi, 0x106
lea ecx, [ebp - 0x218]
mov edx, esi
call fcn.00a21417
cmp word [ebp - 0x214], 0
je 0xa365e9
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x228]
and dword [ebp - 0x220], 0
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDiskFreeSpaceExW]
push 6
pop edx
mov ecx, edi
call fcn.00a34730
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push esi
push eax
push 0xe
lea edx, [ebp - 0x220]
call fcn.00a34115
lea eax, [ebp - 0x218]
mov edx, ebx
push eax
mov ecx, 0xa34a80
call fcn.00a2e662
push eax
push 2
push 0x2379
push edi
call fcn.00a345da
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret 8
cmp word [ebp - 0x218], 0
je 0xa349f6
cmp word [ebp - 0x216], 0x3a
jne 0xa349f6
push 0xa22ef8
mov edx, esi
lea ecx, [ebp - 0x218]
call fcn.00a22c30
jmp 0xa349f6
Function at 0xa38a0f
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0xa38a4d
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0xa38a45
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0xa38a4f
inc edx
add eax, 0x28
cmp edx, ebx
jb 0xa38a35
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xa38b39
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0xa38b4f
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0xa38b6a
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0xa400a0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, edx
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0xa400bc
call fcn.00a2221b
movzx eax, word [eax]
jmp 0xa400be
mov eax, ebx
test ax, ax
je 0xa400c9
cmp ax, 0xa
jne 0xa400f3
mov ecx, dword [edi + 0x3c]
push 0x3b
pop edx
call fcn.00a22200
test eax, eax
je 0xa400f3
mov ecx, 0xa245fc
test esi, esi
jne 0xa400e6
mov ecx, 0xa214b4
mov edx, 0xa22214
pop edi
pop esi
pop ebx
jmp fcn.00a2269e
mov ecx, dword [edi + 0x3c]
mov edx, 0xa22efc
push 5
call fcn.00a21e6a
cmp word [eax], bx
je 0xa40119
mov ecx, 0xa245fc
test esi, esi
jne 0xa40115
mov ecx, 0xa214b4
mov edx, eax
jmp 0xa400eb
mov edi, 0xa245fc
mov eax, 0xa214b4
mov ecx, edi
test esi, esi
jne 0xa4012d
mov ecx, eax
mov edi, eax
call fcn.00a21d1b
push eax
push edi
push 0xa3868c
call fcn.00a26570
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0xa40349
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x210], esi
push edi
test edx, edx
jne 0xa40450
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x214], edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0xa4043d
cmp word [ebp - 0x20c], 0x2e
jne 0xa40404
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.00a40dc7
mov ebx, eax
test ebx, ebx
je 0xa40426
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0xa403cf
sub ecx, edx
sar ecx, 1
je 0xa403f7
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0xa3868c
call fcn.00a26570
add esp, 0xc
mov esi, eax
mov ecx, ebx
call fcn.00a2107b
mov ebx, dword [ebp - 0x214]
cmp dword [0xa45164], edi
jne 0xa40435
inc ebx
mov dword [ebp - 0x214], ebx
test esi, esi
jne 0xa404d8
mov esi, dword [ebp - 0x210]
jmp 0xa4037b
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push eax
call fcn.00a2e452
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0xa404da
cmp esi, 0x103
jne 0xa404d8
mov esi, edi
jmp 0xa404d8
mov ecx, edx
call fcn.00a2221b
mov ecx, eax
call fcn.00a22258
mov ebx, eax
test ebx, ebx
je 0xa40435
push 0x20
pop edx
mov ecx, ebx
call fcn.00a22aea
test eax, eax
je 0xa40477
xor ecx, ecx
mov word [eax], cx
mov edx, ebx
mov ecx, esi
call fcn.00a40dc7
mov edx, eax
mov dword [ebp - 0x210], edx
test edx, edx
je 0xa404b4
mov ecx, edx
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0xa40493
sub ecx, esi
sar ecx, 1
je 0xa404b4
push edx
push ebx
push 0xa3868c
call fcn.00a26570
mov esi, eax
jmp 0xa404c3
xor esi, esi
push ebx
inc esi
push esi
push 0x400023a3
call fcn.00a2e452
mov ecx, dword [ebp - 0x210]
add esp, 0xc
call fcn.00a2107b
mov ecx, ebx
call fcn.00a2107b
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
Function at 0xa40caf
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, edi
test ecx, ecx
jne 0xa40cd3
xor eax, eax
jmp 0xa40db1
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0xa40dae
push 0x40
lea edx, [ebp - 0x48]
mov ecx, esi
call fcn.00a40ef4
test eax, eax
je 0xa40da7
mov eax, 0x5a4d
cmp ax, word [ebp - 0x48]
jne 0xa40da7
push edi
push edi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xa40da7
push 4
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.00a40ef4
test eax, eax
je 0xa40da7
cmp dword [ebp - 0x60], 0x4550
jne 0xa40da7
push 0x14
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.00a40ef4
test eax, eax
je 0xa40da7
mov ax, word [ebp - 0x4c]
test ax, ax
je 0xa40da7
movzx eax, ax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xa40da7
movzx eax, word [ebp - 0x4c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a40ef4
test eax, eax
je 0xa40d97
mov ecx, dword [ebp - 0x5c]
mov edx, edi
call fcn.00a40ec9
test eax, eax
je 0xa40d97
movzx ebx, word [eax]
push edi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
Function at 0xa40dc7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
push 0xa40ea8
call fcn.00a2cca4
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
test edx, edx
je 0xa40e07
cmp word [edx], bx
je 0xa40e07
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
push edx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xa40e07
push eax
jmp 0xa40e71
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov ebx, dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
call ebx
cmp eax, 2
jne 0xa40e33
mov ecx, 0xa22214
call fcn.00a22258
mov esi, eax
mov dword [ebp - 0x20], esi
jmp 0xa40e77
test eax, eax
jne 0xa40e04
mov ecx, dword [ebp - 0x24]
call fcn.00a213cb
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0xa40e6f
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push dword [ebp - 0x1c]
call ebx
mov ebx, eax
test ebx, ebx
je 0xa40e77
mov ecx, esi
call fcn.00a2107b
xor esi, esi
mov dword [ebp - 0x20], esi
push ebx
jmp 0xa40e71
push 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.00a40e96
mov eax, esi
call fcn.00a227a8
ret