joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e022b47
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0x698
push 0x1e002978
call fcn.1e0171b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, 0xffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ebx
push 0x20a
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1e022cfd
push ebx
push 0x1e002970
lea eax, [ebp - 0x234]
push eax
push ebx
call fcn.1e01a5cb
add esp, 0x10
mov edi, eax
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1e022b9e
sub eax, esi
lea eax, [eax + eax + 6]
push eax
push ebx
call fcn.1e017d5b
mov esi, eax
push ebx
push edi
push esi
call fcn.1e01c17e
push 0x1e00296c
push esi
call fcn.1e018149
push edi
push ebx
call fcn.1e018041
push ebx
push 0x1e002660
push esi
call fcn.1e01c35e
mov dword [ebp - 0x238], eax
push esi
push ebx
call fcn.1e017da8
push ebx
push ebx
push 0xffffffffffffffff
xor esi, esi
inc esi
push esi
push esi
push esi
push esi
push 0x7c
push dword [ebp - 0x238]
lea eax, [ebp - 0x49c]
push eax
call fcn.1e025421
test eax, eax
je 0x1e022cf2
mov edi, 0x1e002964
test byte [ebp - 0x284], 0x10
jne 0x1e022cde
push dword [ebp - 0x498]
push 0x1e00295c
call fcn.1e0183c4
test eax, eax
jne 0x1e022c4c
push dword [ebp - 0x498]
push 0x1e002954
call fcn.1e0183c4
test eax, eax
je 0x1e022cde
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x498]
push 0x1e00295c
call fcn.1e0183c4
mov esi, eax
neg esi
sbb esi, esi
inc esi
inc esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x490]
push eax
push 0x20a
lea eax, [ebp - 0x6a8]
push eax
push 0x1e00259c
push 0x1e002948
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x6a8], bl
je 0x1e022cd2
lea eax, [ebp - 0x490]
push eax
push 0xffff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x20], eax
cmp eax, 0xffff
jne 0x1e022cbc
cmp esi, 1
je 0x1e022cd2
lea eax, [ebp - 0x490]
push eax
call fcn.1e0227ea
mov dword [ebp - 0x24], eax
cmp eax, 0xffff
jne 0x1e022cd5
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
call fcn.1e022d0d
lea eax, [ebp - 0x49c]
push eax
call fcn.1e024d4f
test eax, eax
jne 0x1e022c13
push dword [ebp - 0x238]
call fcn.1e01bc81
call fcn.1e0171ed
ret
Function at 0x1e022f19
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1e02d360]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, eax
jb 0x1e022f3c
cmp esi, dword [0x1e02d358]
jae 0x1e022f3c
mov ecx, dword [0x1e02d368]
jmp 0x1e022fcb
mov eax, dword [0x1e02d35c]
cmp esi, eax
mov ecx, dword [0x1e02d354]
jb 0x1e022f4f
cmp esi, ecx
jb 0x1e022fc5
mov dword [0x1e02d358], ecx
mov ecx, dword [0x1e02d364]
mov dword [0x1e02d360], eax
mov eax, dword [0x1e02d368]
mov dword [0x1e02d368], ecx
mov dword [0x1e02d364], eax
push 0
mov ecx, esi
and ecx, 0xff
mov eax, esi
sub eax, ecx
push 0
push eax
push dword [ebp + 8]
mov dword [0x1e02d35c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 0xc]
push eax
push 0x8000
push dword [0x1e02d364]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1e022fd3
mov eax, dword [0x1e02d35c]
mov ecx, dword [ebp + 0xc]
add ecx, eax
cmp esi, eax
mov dword [0x1e02d354], ecx
jb 0x1e022fd3
cmp esi, ecx
jae 0x1e022fd3
mov ecx, dword [0x1e02d364]
sub ecx, eax
movzx eax, byte [ecx + esi]
jmp 0x1e022fd6
or eax, 0xffffffff
pop esi
pop ebp
ret 8

Function at 0x1e023036
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.1e022f19
mov esi, eax
cmp esi, 0xffffffff
je 0x1e0230b1
cmp esi, 0x1a
je 0x1e0230b6
push esi
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x1e02307e
inc ebx
push ebx
push edi
call fcn.1e022f19
mov esi, eax
cmp esi, 0xffffffff
je 0x1e0230c1
cmp esi, 0x1a
je 0x1e0230b6
inc dword [ebp - 4]
jmp 0x1e023088
cmp esi, 0xd
je 0x1e02309c
cmp esi, 0xa
je 0x1e02309c
inc ebx
inc dword [ebp - 4]
push ebx
push edi
call fcn.1e022f19
mov esi, eax
cmp esi, 0xffffffff
jne 0x1e023055
jmp 0x1e0230c1
inc ebx
cmp esi, 0xd
jne 0x1e0230b1
push ebx
push edi
call fcn.1e022f19
mov esi, eax
cmp esi, 0xa
jne 0x1e0230b1
inc ebx
cmp esi, 0x1a
jne 0x1e0230c1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
and dword [eax + 8], 0
add ecx, 2
push ecx
push eax
call fcn.1e01b25b
mov edi, eax
test edi, edi
je 0x1e0230f4
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1e0230e4
mov dword [eax], ebx
cmp dword [ebp - 4], 0
jne 0x1e0230f8
cmp esi, 0xd
je 0x1e0230f8
cmp esi, 0xa
je 0x1e0230f8
xor eax, eax
jmp 0x1e023122
xor esi, esi
cmp dword [ebp - 4], esi
jbe 0x1e023116
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1e022f19
inc dword [ebp + 0xc]
mov byte [esi + edi], al
inc esi
cmp esi, dword [ebp - 4]
jb 0x1e0230ff
lea eax, [esi + edi]
and byte [eax], 0
and byte [eax + 1], 0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1e023129
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
call fcn.1e022fdb
cmp dword [ebp - 8], 0
mov esi, eax
jne 0x1e023197
push 2
pop edi
cmp si, 0xd
je 0x1e023178
cmp si, 0xa
je 0x1e023178
add dword [ebp - 4], edi
lea eax, [ebp - 8]
push eax
add ebx, edi
push ebx
push dword [ebp + 8]
call fcn.1e022fdb
cmp dword [ebp - 8], 0
mov esi, eax
je 0x1e023150
jmp 0x1e023197
add ebx, edi
cmp si, 0xd
jne 0x1e023197
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
call fcn.1e022fdb
mov esi, eax
cmp si, 0xa
jne 0x1e023197
add ebx, edi
cmp si, 0x1a
jne 0x1e0231aa
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
and dword [eax + 8], 0
add ecx, 2
push ecx
push eax
call fcn.1e01b25b
mov edi, eax
test edi, edi
je 0x1e0231df
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1e0231cd
mov dword [ecx], ebx
cmp dword [ebp - 4], 0
jne 0x1e0231e3
cmp si, 0xd
je 0x1e0231e3
cmp si, 0xa
je 0x1e0231e3
xor eax, eax
jmp 0x1e023216
xor esi, esi
cmp dword [ebp - 4], esi
jbe 0x1e023204
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1e022f19
inc dword [ebp + 0xc]
mov byte [esi + edi], al
inc esi
cmp esi, dword [ebp - 4]
jb 0x1e0231ea
mov ecx, dword [ebp + 0x10]
lea eax, [esi + edi]
and byte [eax], 0
and byte [eax + 1], 0
test ecx, ecx
je 0x1e023214
mov dword [ecx], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1e023805
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], 1
lea esi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1e023820
sub eax, esi
push eax
push dword [ebp + 8]
call fcn.1e01a679
push 0x1e002ad4
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.1e01c17e
push ebx
mov esi, 0x1e002660
push esi
push edi
push ebx
call fcn.1e01a5cb
add esp, 0x10
push edi
push ebx
mov dword [ebp - 8], eax
call fcn.1e018041
push ebx
push esi
push dword [ebp - 8]
call fcn.1e01c35e
push ebx
push ebx
push 0xffffffffffffffff
push 1
push ebx
push ebx
push 1
mov esi, eax
push ebx
push esi
lea eax, [ebp - 0x26c]
push eax
call fcn.1e025421
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
je 0x1e0238d9
test byte [ebp - 0x54], 0x10
lea eax, [ebp - 0x260]
je 0x1e02389c
push eax
call edi
jmp 0x1e0238b5
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
lea eax, [ebp - 0x26c]
push eax
je 0x1e0238cf
call fcn.1e024d4f
test eax, eax
jne 0x1e02388b
jmp 0x1e0238d4
call fcn.1e0241e4
cmp dword [ebp - 4], ebx
je 0x1e0238e6
cmp dword [ebp + 0xc], ebx
je 0x1e0238e6
push dword [ebp + 8]
call edi
mov dword [ebp - 4], eax
push esi
call fcn.1e01bc81
push dword [ebp - 8]
push ebx
call fcn.1e018041
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1e0238ff
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], 1
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push dword [ebp + 8]
call fcn.1e01800d
push 0x1e002ad8
push dword [ebp + 8]
mov ebx, eax
push ebx
call fcn.1e01bc9a
xor esi, esi
push esi
mov edi, 0x1e00147c
push edi
push ebx
push esi
call fcn.1e01a608
add esp, 0x10
push ebx
push esi
mov dword [ebp - 8], eax
call fcn.1e018041
push esi
push edi
push dword [ebp - 8]
call fcn.1e01beb3
push esi
push esi
push 0xffffffffffffffff
push 1
push esi
push esi
push 1
mov ebx, eax
push esi
push ebx
lea eax, [ebp - 0x26c]
push eax
call fcn.1e0254a0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
je 0x1e0239ce
test byte [ebp - 0x54], 0x10
lea eax, [ebp - 0x260]
je 0x1e023991
push eax
call edi
jmp 0x1e0239aa
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
lea eax, [ebp - 0x26c]
push eax
je 0x1e0239c4
call fcn.1e024f43
test eax, eax
jne 0x1e023980
jmp 0x1e0239c9
call fcn.1e024246
cmp dword [ebp - 4], esi
je 0x1e0239db
cmp dword [ebp + 0xc], esi
je 0x1e0239db
push dword [ebp + 8]
call edi
mov dword [ebp - 4], eax
push ebx
call fcn.1e01bc81
push dword [ebp - 8]
push esi
call fcn.1e018041
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1e023e37
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x224]
test byte [eax + 0x20], 0x10
push esi
push edi
je 0x1e023e5f
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov edi, dword [eax + 4]
jmp 0x1e023e64
mov edi, 0x1e002660
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 0x20c]
push eax
call fcn.1e01a329
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017ea0
push eax
call fcn.1e01a329
lea edi, [esi + 0x10]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x1e023ec8
jmp 0x1e023eb1
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1e023ebb
test byte [edi], 0x10
jne 0x1e023ea3
xor eax, eax
inc eax
jmp 0x1e023eca
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x1e023ed0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x224]
test byte [eax + 0x20], 0x10
push esi
push edi
je 0x1e023ef8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov edi, dword [eax + 4]
jmp 0x1e023efd
mov edi, 0x1e00147c
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017cc5
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017ecc
push eax
call fcn.1e017cc5
lea edi, [esi + 0x10]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x1e023f61
jmp 0x1e023f4a
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1e023f54
test byte [edi], 0x10
jne 0x1e023f3c
xor eax, eax
inc eax
jmp 0x1e023f63
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x1e024048
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
lea eax, [ebp - 0x20c]
push eax
call fcn.1e01a329
push 0x1e002660
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017ea0
push eax
call fcn.1e01a329
lea edi, [esi + 0x10]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x1e0240c1
test byte [edi], 0x10
je 0x1e0240a6
lea eax, [esi + 0x3c]
push eax
call fcn.1e023f69
test eax, eax
je 0x1e0240c9
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1e024094
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
leave
ret 4
xor eax, eax
inc eax
jmp 0x1e0240c3
Function at 0x1e0240ce
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017cc5
push 0x1e00147c
lea eax, [ebp - 0x20c]
push eax
call fcn.1e017ecc
push eax
call fcn.1e017cc5
lea edi, [esi + 0x10]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x1e024147
test byte [edi], 0x10
je 0x1e02412c
lea eax, [esi + 0x3c]
push eax
call fcn.1e023f8e
test eax, eax
je 0x1e02414f
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1e02411a
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
leave
ret 4
xor eax, eax
inc eax
jmp 0x1e024149

Function at 0x1e0242a8
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
inc edi
mov eax, dword [esi]
test eax, eax
jne 0x1e0242bc
mov eax, dword [esi + 8]
jmp 0x1e0242c8
push 0
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
inc eax
mov dword [esi], eax
cmp byte [eax], 0
je 0x1e024338
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esi + 4], eax
sub eax, 0
je 0x1e024326
dec eax
je 0x1e02431d
dec eax
je 0x1e024314
dec eax
je 0x1e02430b
dec eax
je 0x1e024302
dec eax
je 0x1e0242f9
dec eax
jne 0x1e024326
mov dword [esi + 4], 0x40
jmp 0x1e024329
mov dword [esi + 4], 0x20
jmp 0x1e024329
mov dword [esi + 4], 0x10
jmp 0x1e024329
mov dword [esi + 4], 8
jmp 0x1e024329
mov dword [esi + 4], 4
jmp 0x1e024329
mov dword [esi + 4], 2
jmp 0x1e024329
mov dword [esi + 4], edi
mov eax, dword [esi + 0xc]
test dword [esi + 4], eax
je 0x1e0242b1
mov eax, edi
pop edi
pop esi
ret 4
push esi
call fcn.1e023a3a
xor eax, eax
jmp 0x1e024333

Function at 0x1e024342
Capabilities:
Get disk information

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
inc ebx
mov eax, dword [esi]
test eax, eax
jne 0x1e024356
mov eax, dword [esi + 8]
jmp 0x1e024363
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
inc eax
pop ecx
inc eax
mov dword [esi], eax
cmp word [eax], 0
je 0x1e0243d8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 4], eax
sub eax, 0
je 0x1e0243c2
dec eax
je 0x1e0243b9
dec eax
je 0x1e0243b0
dec eax
je 0x1e0243a7
dec eax
je 0x1e02439e
dec eax
je 0x1e024395
dec eax
jne 0x1e0243c2
mov dword [esi + 4], 0x40
jmp 0x1e0243c5
mov dword [esi + 4], 0x20
jmp 0x1e0243c5
mov dword [esi + 4], 0x10
jmp 0x1e0243c5
mov dword [esi + 4], 8
jmp 0x1e0243c5
mov dword [esi + 4], 4
jmp 0x1e0243c5
mov dword [esi + 4], 2
jmp 0x1e0243c5
mov dword [esi + 4], ebx
mov eax, dword [esi + 0xc]
test dword [esi + 4], eax
je 0x1e02434b
mov eax, ebx
pop esi
pop ebx
ret 4
push esi
call fcn.1e023a3a
xor eax, eax
jmp 0x1e0243d3
Function at 0x1e0243e2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [ebp - 4], esi
push esi
je 0x1e024416
push esi
push dword [ebp + 0xc]
push dword [0x1e02f460]
call fcn.1e01a3c6
push 0x5c
push eax
mov dword [ebp + 8], eax
call fcn.1e01996f
mov edi, dword [ebp + 0x10]
jmp 0x1e02448a
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
lea ecx, [eax + 0x3c]
push ecx
push dword [eax]
push dword [0x1e02f460]
call fcn.1e01a5cb
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x224]
mov eax, dword [eax]
add esp, 0x10
cmp eax, esi
je 0x1e0245bc
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 4]
cmp dword [esi], 1
jne 0x1e024488
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
add eax, ecx
push eax
push ecx
call fcn.1e023da3
push eax
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll__mbsnicmp]
add esp, 0xc
test eax, eax
je 0x1e024488
push dword [ebp + 8]
push dword [0x1e02f460]
call fcn.1e017da8
mov eax, dword [ebp + 0x14]
test eax, eax
jmp 0x1e0245cf
xor esi, esi
test byte [ebx + 0x228], 8
je 0x1e0244ae
mov eax, dword [ebx + 0x224]
push dword [eax + 0x10]
push dword [ebp + 8]
push 2
call fcn.1e01d14e
test eax, eax
jne 0x1e0245bc
cmp edi, esi
je 0x1e0244bd
mov eax, dword [edi]
sub eax, dword [ebx + 0x238]
mov dword [ebp - 4], eax
lea eax, [ebx + 0x238]
push 0x15c
push eax
call fcn.1e01b25b
mov esi, eax
test esi, esi
jne 0x1e02450a
push dword [ebp + 8]
push dword [0x1e02f460]
call fcn.1e017da8
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1e0245d7
mov ebx, dword [ebx + 0x234]
test ebx, ebx
je 0x1e024502
push 0
call ebx
mov dword [esi], eax
jmp 0x1e0245d7
and dword [esi], 0
jmp 0x1e0245d7
test edi, edi
je 0x1e024523
mov eax, dword [ebx + 0x238]
mov edx, dword [edi]
mov ecx, dword [ebp - 4]
sub edx, eax
cmp ecx, edx
je 0x1e024523
add eax, ecx
mov dword [edi], eax
push 0x57
xor eax, eax
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [esi], eax
je 0x1e024561
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x224]
cmp dword [eax + 0x10], edi
jne 0x1e024573
cmp dword [eax + 8], edi
je 0x1e024573
push dword [eax]
call fcn.1e018efd
test eax, eax
jne 0x1e024573
jmp 0x1e02456c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [esi + 4], eax
or dword [esi + 0x154], 1
mov dword [esi + 0x150], edi
mov ebx, dword [ebx + 0x224]
test byte [ebx + 0x20], 3
jne 0x1e024593
push dword [ebp + 8]
push dword [ebx]
call fcn.1e01b21d
test eax, eax
je 0x1e02459a
or dword [esi + 0x154], 2
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x1e0245b2
mov eax, dword [eax]
mov eax, dword [eax + 0x158]
inc eax
mov dword [esi + 0x158], eax
jmp 0x1e0245b8
mov dword [esi + 0x158], edi
mov eax, esi
jmp 0x1e0245d9
push dword [ebp + 8]
push dword [0x1e02f460]
call fcn.1e017da8
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x1e0245d7
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1e0245e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [ebp - 4], esi
push esi
je 0x1e024614
push esi
push dword [ebp + 0xc]
push dword [0x1e02f460]
call fcn.1e017dc9
push 0x5c
push eax
mov dword [ebp + 8], eax
call fcn.1e0199aa
mov edi, dword [ebp + 0x10]
jmp 0x1e024668
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
lea ecx, [eax + 0x3c]
push ecx
push dword [eax]
push dword [0x1e02f460]
call fcn.1e01a608
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x224]
mov eax, dword [eax]
add esp, 0x10
cmp eax, esi
je 0x1e02479c
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
cmp dword [eax], 1
jne 0x1e024668
mov ecx, dword [eax + 8]
shr ecx, 1
push ecx
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1e02479c
test byte [ebx + 0x228], 8
je 0x1e02468c
mov eax, dword [ebx + 0x224]
push dword [eax + 0x10]
push dword [ebp + 8]
push 2
call fcn.1e01d284
test eax, eax
jne 0x1e02479c
cmp edi, esi
je 0x1e02469b
mov eax, dword [edi]
sub eax, dword [ebx + 0x238]
mov dword [ebp - 4], eax
lea eax, [ebx + 0x238]
push 0x26c
push eax
call fcn.1e01b25b
mov esi, eax
test esi, esi
jne 0x1e0246e8
push dword [ebp + 8]
push dword [0x1e02f460]
call fcn.1e017da8
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1e0247b7
mov ebx, dword [ebx + 0x234]
test ebx, ebx
je 0x1e0246e0
push 0
call ebx
mov dword [esi], eax
jmp 0x1e0247b7
and dword [esi], 0
jmp 0x1e0247b7
test edi, edi
je 0x1e024701
mov eax, dword [ebx + 0x238]
mov edx, dword [edi]
mov ecx, dword [ebp - 4]
sub edx, eax
cmp ecx, edx
je 0x1e024701
add eax, ecx
mov dword [edi], eax
xor eax, eax
mov ecx, 0x9b
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [esi], eax
je 0x1e024741
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x224]
cmp dword [eax + 0x10], edi
jne 0x1e024753
cmp dword [eax + 8], edi
je 0x1e024753
push dword [eax]
call fcn.1e018efd
test eax, eax
jne 0x1e024753
jmp 0x1e02474c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [esi + 4], eax
or dword [esi + 0x264], 1
mov dword [esi + 0x260], edi
mov ebx, dword [ebx + 0x224]
test byte [ebx + 0x20], 3
jne 0x1e024773
push dword [ebp + 8]
push dword [ebx]
call fcn.1e01b23c
test eax, eax
je 0x1e02477a
or dword [esi + 0x264], 2
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x1e024792
mov eax, dword [eax]
mov eax, dword [eax + 0x268]
inc eax
mov dword [esi + 0x268], eax
jmp 0x1e024798
mov dword [esi + 0x268], edi
mov eax, esi
jmp 0x1e0247b9
push dword [ebp + 8]
push dword [0x1e02f460]
call fcn.1e017da8
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x1e0247b7
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1e02513b
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor esi, esi
push esi
push esi
call edi
mov ebx, eax
cmp ebx, esi
je 0x1e025181
push esi
lea eax, [ebx + 1]
push eax
push dword [0x1e02f460]
call fcn.1e01b681
test eax, eax
mov esi, dword [esp + 0x10]
mov dword [esi + 8], eax
je 0x1e025181
push eax
push ebx
call edi
mov eax, dword [esp + 0x14]
and dword [esi], 0
push esi
mov dword [esi + 0xc], eax
call fcn.1e0242a8
jmp 0x1e025183
xor eax, eax
pop edi
pop esi
pop ebx
ret 8

Function at 0x1e025189
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor esi, esi
push esi
push esi
call edi
mov ebx, eax
cmp ebx, esi
je 0x1e0251d0
push esi
lea eax, [ebx + ebx + 2]
push eax
push dword [0x1e02f460]
call fcn.1e01b681
test eax, eax
mov esi, dword [esp + 0x10]
mov dword [esi + 8], eax
je 0x1e0251d0
push eax
push ebx
call edi
mov eax, dword [esp + 0x14]
and dword [esi], 0
push esi
mov dword [esi + 0xc], eax
call fcn.1e024342
jmp 0x1e0251d2
xor eax, eax
pop edi
pop esi
pop ebx
ret 8

Function at 0x1e025562
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x1e02558b
push eax
jmp 0x1e0255f1
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jbe 0x1e0255bb
cmp eax, 2
jbe 0x1e0255ad
cmp eax, 3
jbe 0x1e0255bb
cmp eax, 5
ja 0x1e0255bb
cmp dword [ebp - 4], 4
je 0x1e0255c0
cmp dword [ebp - 4], 5
jmp 0x1e0255b7
cmp dword [ebp - 4], 1
je 0x1e0255c0
cmp dword [ebp - 4], 2
je 0x1e0255c0
jmp 0x1e0255f7
cmp dword [ebp - 4], eax
jne 0x1e0255f7
mov eax, dword [ebp - 8]
add eax, 2
push eax
call dword [ebp + 0x14]
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, ebx
jne 0x1e0255ec
mov eax, dword [ebp - 8]
mov word [edi + eax], bx
mov eax, edi
jmp 0x1e0255f9
push edi
call dword [ebp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14