joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b431bd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x75b43311
xor eax, eax
push esi
push edi
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
stosw word es:[edi], ax
push 5
lea eax, [ebp - 0x1c]
push eax
push 0xe
mov edi, 0x400
push edi
call esi
push 5
lea eax, [ebp - 0x28]
push eax
push 0xf
push edi
call esi
push 6
lea eax, [ebp - 0x10]
push eax
push 0x10
push edi
call esi
push 2
lea eax, [ebp - 0x2c]
push eax
push 0x1010
push edi
call esi
and dword [ebx], 0
and dword [ebx + 4], 0
push 0xa
call fcn.759c6f57
pop ecx
pop edi
mov dword [ebx + 0xc], eax
pop esi
test eax, eax
je 0x75b43275
lea ecx, [ebp - 0x1c]
push ecx
push 5
push eax
call fcn.759b3cf5
test eax, eax
jge 0x75b43275
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov word [eax], cx
push 0xa
call fcn.759c6f57
pop ecx
mov dword [ebx + 0x10], eax
test eax, eax
je 0x75b4329c
lea ecx, [ebp - 0x28]
push ecx
push 5
push eax
call fcn.759b3cf5
test eax, eax
jge 0x75b4329c
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov word [eax], cx
movzx eax, word [ebp - 0x2c]
add eax, 0xffffffd0
mov dword [ebx + 0x14], eax
cmp eax, 4
jbe 0x75b432b2
mov dword [ebx + 0x14], 1
mov ecx, 0x75b43320
lea eax, [ebp - 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x75b432e0
test dx, dx
je 0x75b432dc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x75b432e0
add eax, 4
add ecx, 4
test dx, dx
jne 0x75b432ba
xor eax, eax
jmp 0x75b432e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x75b432f2
mov dword [ebx + 8], 0x20
jmp 0x75b43311
movzx eax, word [ebp - 0x10]
lea ecx, [eax - 0x30]
test ecx, ecx
jl 0x75b4330a
cmp ecx, 9
jg 0x75b4330a
add eax, 0xffffffd0
mov dword [ebx + 8], eax
jmp 0x75b43311
mov dword [ebx + 8], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
Function at 0x75b48c10
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and dword [ebp - 4], 0
push esi
push edi
push eax
call dword [ecx + 0x24]
mov esi, eax
mov edi, dword [esi]
lea ecx, [ebp - 4]
call fcn.759c6f3c
push eax
push 1
push 0x75b48d08
push esi
call dword [edi + 0x10]
mov edi, eax
test edi, edi
je 0x75b48c5d
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x75b48c56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x75b48d00
push ebx
push 1
call fcn.759c9083
pop ecx
push dword [ebp + 0xc]
mov edi, eax
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
mov ebx, eax
test ebx, ebx
je 0x75b48ca0
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x75b48c9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x75b48cff
mov ebx, dword [ebp + 0x10]
and dword [ebp + 8], 0
mov byte [ebx], 0
jmp 0x75b48cbb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x1c]
test al, 8
je 0x75b48cd4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
push eax
lea ecx, [ebp + 8]
call fcn.759cbe5f
cmp dword [eax], 0
je 0x75b48cd7
jmp 0x75b48cac
mov byte [ebx], 1
mov eax, dword [ebp + 8]
test eax, eax
je 0x75b48ce4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x75b48cfd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x75b58310
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x44], eax
call fcn.759b3c2d
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20]
cmp byte [ebp + 0x1c], bl
jne 0x75b58359
push eax
push ebx
push 0x759b4a30
push esi
push dword [ebp + 8]
call fcn.759b4577
add esp, 0x18
jmp 0x75b58373
push dword [ebp + 8]
push dword [0x75bc8b74]
push ebx
push eax
push 0x759b4a30
push ebx
push esi
call fcn.759b4b06
add esp, 0x20
cmp eax, ebx
je 0x75b5839d
mov esi, 0x103
lea ecx, [ebp - 0x20]
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
cmp edi, ebx
je 0x75b58407
cmp dword [ebp + 0x18], ebx
je 0x75b583af
mov dword [ebp - 0x40], 0x103
jmp 0x75b58428
lea ecx, [ebp - 0x3c]
call fcn.759b3c2d
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x3c]
call fcn.759b3e2d
push eax
push dword [0x75bc8b74]
push ebx
push edi
push esi
call fcn.759b3f15
add esp, 0x14
mov dword [ebp - 0x40], eax
cmp eax, ebx
je 0x75b583e9
cmp eax, 2
jne 0x75b583f5
mov dword [ebp - 0x40], 0x103
jmp 0x75b583f5
mov esi, edi
mov edi, dword [ebp - 0x44]
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x3c]
call fcn.759b3c00
lea ecx, [ebp - 0x34]
call fcn.759b1681
jmp 0x75b58428
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x44]
mov dword [ebp - 0x40], 0x21
push dword [ebp + 0x18]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x40]
jmp 0x75b5837c
Function at 0x75b5869f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 0x20]
call fcn.759b3c2d
lea ecx, [ebp - 0x20]
call fcn.759b3e2d
push eax
push dword [0x75bc8b74]
xor edi, edi
push edi
push ebx
push 0x80000002
call fcn.759b3f15
add esp, 0x14
cmp eax, edi
je 0x75b58713
cmp eax, 2
jne 0x75b586f0
mov eax, 0x103
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call ebx
cmp eax, 0xea
jne 0x75b586f0
inc dword [ebp - 0x24]
push edi
push dword [ebp - 0x24]
mov ecx, esi
call fcn.759b593b
test al, al
jne 0x75b58750
push 0x7a
pop eax
jmp 0x75b586f0
mov esi, dword [esi]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call ebx
jmp 0x75b586f0

Function at 0x75b5a44e
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0xeb], bl
mov ecx, dword [eax + 0xc4]
push edi
mov dword [ebp - 4], ecx
mov edi, dword [eax + 0xc0]
mov dword [ebp - 8], edi
cmp byte [esi + 0xe9], bl
jne 0x75b5a4ea
cmp dword [esi + 4], ebx
jne 0x75b5a4e3
mov dword [esi + 4], 1
mov edi, dword [esi + 0xb0]
lea ecx, [esi + 0xcc]
call fcn.759b3e2d
push eax
push 0x20019
push ebx
push dword [ebp - 8]
push edi
call fcn.759b3f15
add esp, 0x14
test eax, eax
jne 0x75b5a4bd
mov byte [esi + 0xeb], 1
mov eax, dword [esi + 0xc]
mov esi, dword [eax + 0xc0]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax]
call fcn.759b3e2d
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x103
jmp 0x75b5a4dc
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc4]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 1]
lea edx, [ebp - 4]
push edx
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
je 0x75b5a553
cmp eax, ebx
jne 0x75b5a4dc
push edi
push 0x75a0db44
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x75b5a540
cmp dword [esi + 0xac], 2
je 0x75b5a48e
jmp 0x75b5a4ea
mov eax, dword [esi + 0xac]
cmp eax, ebx
je 0x75b5a48e
cmp eax, 1
jmp 0x75b5a538
mov eax, dword [esi + 0xc]
mov dword [eax + 0x360], 0xfffffffa
mov eax, 0x64a
jmp 0x75b5a4dc
Function at 0x75b5aca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
lea eax, [ebp - 0x70]
xor ebx, ebx
mov dword [ebp - 0x78], 0x27
mov dword [ebp - 0x7c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x7d], bl
call dword [eax + 0x1c]
test al, al
je 0x75b5ad9f
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x8c], eax
call fcn.759b3c2d
mov eax, dword [esi]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x8c]
push ecx
push dword [ebp - 0x7c]
push dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x88]
mov dword [ebp - 0x84], eax
cmp eax, ebx
jne 0x75b5ad6e
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
mov eax, dword [edi + 0x38]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x90], eax
call fcn.759b3e2d
push eax
push 0x20019
push ebx
push dword [ebp - 0x84]
push dword [ebp - 0x90]
call fcn.759b3f15
add esp, 0x14
test eax, eax
jne 0x75b5ad62
cmp dword [ebp + 0xc], 1
jmp 0x75b5ad66
cmp dword [ebp + 0xc], 2
je 0x75b5ad8b
mov dword [ebp - 0x84], ebx
lea ecx, [ebp - 0x20]
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
cmp dword [ebp - 0x84], ebx
jne 0x75b5ad9f
jmp 0x75b5ace5
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x7d], 1
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
lea ecx, [ebp - 0x7c]
call fcn.759b499d
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x7d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 8
Function at 0x75b65d67
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.759d9a99
pop ecx
pop ecx
test al, al
je 0x75b65d88
push 4
pop eax
leave
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x75b65da0
cmp edi, 1
jne 0x75b65db4
call fcn.759d82c4
push dword [ebp + 8]
call esi
push 1
mov edi, eax
call fcn.759d07de
pop ecx
push edi
call fcn.759da45d
add esp, 4
pop edi
pop esi
leave
ret

Function at 0x75b666a9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub esp, 0x10
push ebx
xor ebx, ebx
mov byte [eax], bl
xor eax, eax
inc eax
mov dword [ecx], eax
cmp dword [ebp + 8], ebx
jne 0x75b666ce
or eax, 0xffffffff
jmp 0x75b667a8
push esi
push edi
push ebx
push 0x100000
push 3
push ebx
push eax
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x75b6679c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 3
je 0x75b6670a
cmp eax, 2
jne 0x75b66740
cmp dword [0x75bc8ca8], ebx
je 0x75b66732
push ebx
push ebx
mov eax, 0x759b7ff8
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push 0x759fe368
push ebx
push ebx
push 9
call fcn.759c26bf
add esp, 0x30
push esi
call edi
push 0x6e
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0xffffffff
je 0x75b6679c
push ebx
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x75b667a0
cmp dword [ebp - 4], 0xc
jne 0x75b667a0
cmp dword [ebp - 0x10], 0x66637474
jne 0x75b6679c
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp - 8]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
and edx, 0xff00
shl eax, 0x10
or edx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [eax], ecx
mov eax, esi
jmp 0x75b667a6
push esi
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x75b675cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 1
push dword [ebp + 8]
call fcn.759da3e0
push eax
call fcn.75b65dc6
add esp, 0xc
test al, al
je 0x75b675ec
mov al, 1
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x75b67601
test eax, 0x4000
jne 0x75b675e8
xor al, al
pop ebp
ret
Function at 0x75b6760a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
and dword [esi + 0x54], 0
lea ebx, [esi + 0x4c]
mov eax, dword [ebx]
mov dword [ebp - 0x2a0], ebx
test eax, eax
je 0x75b6763c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
mov edi, 0x75bc8bfc
mov dword [ebx], edi
lea ebx, [esi + 0x48]
mov eax, dword [ebx]
test eax, eax
je 0x75b67653
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
mov dword [ebx], edi
mov dword [ebp - 0x28c], 0x75bc8fe0
call dword [eax + 0x38]
xor edi, edi
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x290], edi
jmp 0x75b67683
xor edi, edi
cmp dword [ebp - 0x290], edi
jle 0x75b676b2
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push eax
lea ecx, [ebp - 0x28c]
call fcn.759c8365
push 0x75bce448
lea ecx, [ebp - 0x28c]
call fcn.759ca705
jmp 0x75b676cc
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push 0x75bce448
push eax
call dword [ecx + 0x48]
push eax
lea ecx, [ebp - 0x28c]
call fcn.759c755e
cmp dword [esi + 0x58], edi
je 0x75b676d6
call fcn.759d82c4
mov eax, dword [ebp - 0x28c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push 0x40
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [esi + 0x5c]
push ecx
lea ecx, [ebp - 0x298]
push ecx
lea ecx, [esi + 0x50]
push ecx
push 0xff
lea ecx, [ebp - 0x288]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, eax
test edi, edi
jne 0x75b6771f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x294], eax
cmp dword [esi + 0x58], 0
je 0x75b6772d
push 1
call fcn.759d07de
pop ecx
test edi, edi
jne 0x75b6774c
cmp dword [ebp - 0x29c], edi
je 0x75b6774c
inc dword [ebp - 0x290]
cmp dword [ebp - 0x290], 1
jle 0x75b67681
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
xor ecx, ecx
cmp edi, ecx
pop edi
jne 0x75b677b8
cmp eax, 2
je 0x75b67763
cmp eax, 5
jne 0x75b67791
cmp dword [ebp - 0x294], 0x15
jne 0x75b67791
mov dword [esi + 0x54], 1
xor esi, esi
mov eax, dword [ebp - 0x28c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
mov eax, dword [ebp - 0x28c]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push eax
push dword [ebp - 0x294]
push 0x8ff
call fcn.75a207b8
add esp, 0xc
mov esi, eax
jmp 0x75b67775
cmp dword [0x75bceb78], ecx
jne 0x75b677d2
cmp dword [ebp - 0x298], 0xc
jbe 0x75b677d2
mov dword [esi + 0x28], 1
jmp 0x75b677d5
mov dword [esi + 0x28], ecx
mov eax, dword [ebx]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x88]
push edx
push eax
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [ecx]
mov edx, dword [eax]
push ecx
lea ecx, [ebp - 0x288]
push ecx
push eax
call dword [edx + 0x28]
jmp 0x75b67773
Function at 0x75b6a41f
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
cmp dword [ebp + 0x1c], ebx
je 0x75b6a452
call fcn.759d82c4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x75b6a48a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x1c], ebx
je 0x75b6a497
push 1
call fcn.759d07de
pop ecx
cmp dword [ebp + 0xc], ebx
jne 0x75b6a4a3
xor al, al
jmp 0x75b6a559
cmp dword [ebp + 0x18], 4
je 0x75b6a4b9
cmp byte [0x75bce5cc], bl
je 0x75b6a4b9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x75b6a4bf
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shrd eax, ecx, 9
shr ecx, 9
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x24]
mov dword [edi], eax
mov eax, dword [ebp - 0x28]
shrd eax, ecx, 9
mov dword [esi], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 4]
shr ecx, 9
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x14]
mov ebx, 0x10000
mov dword [ecx], eax
cmp eax, ebx
jbe 0x75b6a504
push dword [ebp + 8]
call fcn.759da3c0
pop ecx
test al, al
je 0x75b6a504
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [edi]
or eax, dword [edi + 4]
jne 0x75b6a557
push eax
push dword [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp - 0xc]
call fcn.759c931f
push ebx
push dword [ebp - 8]
push edx
push eax
call fcn.759c931f
shrd eax, edx, 9
mov dword [edi], eax
xor eax, eax
push eax
push dword [ebp - 4]
shr edx, 9
push eax
push dword [ebp - 0x10]
mov dword [edi + 4], edx
call fcn.759c931f
push ebx
push dword [ebp - 8]
push edx
push eax
call fcn.759c931f
shrd eax, edx, 9
shr edx, 9
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75b6b7f1
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
or dword [ebp - 0x224], 0xffffffff
push ebx
mov dword [ebp - 0x230], ecx
push esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x218], ecx
push edi
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x234]
push ecx
push eax
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 0x21c], 0x75bc8fe0
mov byte [ebp - 0x234], 0
call fcn.75b666a9
add esp, 0xc
push eax
lea ecx, [ebp - 0x224]
call fcn.75acb2de
cmp dword [ebp - 0x224], 0xffffffff
jne 0x75b6b899
xor esi, esi
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x218]
call fcn.759b170a
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
xor eax, eax
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x22c], eax
jb 0x75b6b95c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and dword [ebp - 0x228], esi
movzx ebx, ax
mov eax, dword [ebp - 0x228]
sub eax, 0
je 0x75b6b901
dec eax
je 0x75b6b8fc
dec eax
je 0x75b6b8f2
dec eax
je 0x75b6b8ed
dec eax
je 0x75b6b8e9
dec eax
jne 0x75b6b906
mov esi, 0x800
jmp 0x75b6b906
mov esi, ebx
jmp 0x75b6b8f4
movzx esi, bx
jmp 0x75b6b906
mov esi, edi
and esi, 0xff00
jmp 0x75b6b906
movzx esi, di
jmp 0x75b6b906
mov esi, 0x409
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
lea eax, [ebp - 0x224]
push dword [ebp - 0x234]
mov dword [ebp - 0x210], 0x104
push 4
push esi
push 3
push eax
call fcn.75b69797
add esp, 0x1c
test eax, eax
ja 0x75b6b991
inc dword [ebp - 0x228]
cmp dword [ebp - 0x228], 6
jl 0x75b6b8c8
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x220], eax
jbe 0x75b6b9db
push 0x75b6ba0c
lea ecx, [ebp - 0x21c]
call fcn.759ca705
push dword [ebp - 0x230]
lea ecx, [ebp - 0x21c]
call fcn.759ca326
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x75b6b871
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x75b6b9b1
push 0x75b6ba04
lea ecx, [ebp - 0x21c]
call fcn.759ca705
push dword [ebp - 0x218]
lea ecx, [ebp - 0x21c]
call fcn.759ca705
inc dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x22c]
ja 0x75b6b95c
jmp 0x75b6b8ae
mov ecx, dword [ebp - 0x230]
mov eax, 0x75bc8bfc
mov dword [ecx], eax
push eax
mov eax, dword [0x75bc8bfc]
call dword [eax + 4]
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x75b6b86f