joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e0f660
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
lea eax, [esp + 8]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.softwareTECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x12e0f6f6
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edi
push edx
push edi
push str.DisableFP
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x12e0f6f6
mov ecx, dword [esp + 0x14]
mov eax, 4
cmp ecx, eax
jne 0x12e0f6f6
cmp dword [esp + 0x10], eax
jne 0x12e0f6f6
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push edi
push edi
push str.DisableFP
push eax
mov dword [esp + 0x30], edi
call esi
test eax, eax
jne 0x12e0f6f6
cmp dword [esp + 0x18], 1
jne 0x12e0f6f6
mov ebx, 1
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x12e0f705
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x12e10600
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131a9568]
sub esp, 0x208
test eax, eax
jne 0x12e10619
mov dword [0x131a9568], 1
mov eax, dword [0x131a956c]
test eax, eax
jne 0x12e10759
call fcn.12f9c4e0
test eax, eax
je 0x12e10658
push 0
push 0x104
push 0x131a9570
call fcn.12f7a4e0
add esp, 0xc
push 0x104
push 0x131a9778
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x12e10705
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.12f7a3e0
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x103
not ecx
dec ecx
push 0x131a9570
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push eax
call esi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x131a9778
lea eax, [esp + 0x114]
push ecx
push eax
push 0
push 0
call esi
pop edi
pop esi
push 0x131a9570
call fcn.12f614f4
push 0x131a9778
call fcn.12f614f4
push 0x131a9570
call fcn.12f5c44d
push 0x131a9778
mov dword [0x131a9980], eax
call fcn.12f5c44d
mov dword [0x131a9984], eax
mov eax, dword [0x131a9980]
add esp, 0x10
test eax, eax
jbe 0x12e10754
mov eax, 1
mov dword [0x131a956c], eax
add esp, 0x208
ret
mov eax, dword [0x131a956c]
add esp, 0x208
ret
Function at 0x12e10ab0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x12e10ac7
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x2e
push esi
call fcn.12f5c8b4
add esp, 8
cmp eax, ebx
jne 0x12e10ade
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push str..lnk
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12e10af8
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
mov byte [esp + 8], 0x4c
mov dword [esp + 0x11], eax
mov byte [esp + 9], bl
mov word [esp + 0x15], ax
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], bl
mov byte [esp + 0xc], 1
mov byte [esp + 0xd], 0x14
mov byte [esp + 0xe], 2
mov byte [esp + 0x10], bl
mov dword [esp + 0x1c], ebx
push ebx
je 0x12e10b49
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 7
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x12e10b7d
push ebx
push 3
push ebx
push 3
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e10b7d
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x18]
push 7
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 7
lea edi, [esp + 0xc]
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
pop edi
pop esi
pop ebx
sete al
add esp, 0x10
ret
Function at 0x12e12990
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
xor ebp, ebp
cmp ebx, ebp
jne 0x12e129b0
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov eax, dword [0x131a9cb4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
push edi
je 0x12e129dd
call esi
cmp eax, dword [0x131a9cb4]
jb 0x12e129dd
call esi
mov ecx, dword [0x131a9cb4]
add ecx, 0x493e0
cmp ecx, eax
jae 0x12e129fe
mov ecx, 0xc8
xor eax, eax
mov edi, 0x131a998c
mov dword [0x131a9cb0], ebp
rep stosd dword es:[edi], eax
mov dword [0x131a9cac], ebp
call esi
mov dword [0x131a9cb4], eax
mov esi, dword [0x131a9cac]
mov dword [esp + 0x14], ebp
cmp esi, 0x64
jbe 0x12e12a18
mov esi, 0x64
mov dword [0x131a9cac], esi
xor edi, edi
cmp esi, ebp
jbe 0x12e12a3f
mov ebp, 0x131a998c
push ebp
push ebx
call fcn.12f5df5c
add esp, 8
test eax, eax
je 0x12e12b4f
inc edi
add ebp, 8
cmp edi, esi
jb 0x12e12a23
xor ebp, ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebp
push ebp
push SysReAllocStringLen
mov dword [esp + 0x24], ebp
call esi
test eax, eax
jne 0x12e12b40
mov ecx, 0x40
lea edi, [esp + 0x21]
mov byte [esp + 0x20], al
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
push str._sShellNew
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], ebp
push eax
call fcn.12f5ce9d
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push edx
push eax
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x12e12b39
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [0x131a9cac]
mov dword [esp + 0x14], 1
cmp edx, 0x64
jae 0x12e12b39
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx*8 + 0x131a998c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc edx
mov dword [0x131a9cac], edx
mov byte [ecx + edx*8 + 0x131a9984], al
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e12b39
push edx
push str.IsShellNewExtension_2_match_g_dwShellNewExtNum__d_
push str.ShellNew
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e12b6c
push str.IsShellNewExtension_1_match
push str.ShellNew
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x114
ret
Function at 0x12e12c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
test ebx, ebx
jne 0x12e12c77
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0x2f
mov word [esp + 0x10], 0x22
mov word [esp + 0x12], 0x3a
mov word [esp + 0x14], 0x2a
mov word [esp + 0x16], 0x3f
mov word [esp + 0x18], 0x3c
mov word [esp + 0x1a], 0x3e
mov word [esp + 0x1c], 0x7c
xor esi, esi
lea edi, [esp + 0xc]
mov ax, word [edi]
push eax
push ebx
call fcn.12f5cfc9
add esp, 8
test eax, eax
jne 0x12e12c6e
inc esi
add edi, 2
cmp esi, 9
jb 0x12e12cbc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x12e1ba30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305c528
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x131aa1fc]
xor ebx, ebx
cmp ecx, ebx
je 0x12e1ba72
cmp eax, ecx
jb 0x12e1ba72
add ecx, 0x493e0
cmp ecx, eax
ja 0x12e1bb29
mov ecx, 0x82
xor eax, eax
mov edi, 0x131a9ff4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
call fcn.12e9bef0
push 1
push ebx
push ecx
mov dword [esp + 0x4c], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.password_restriction_messagetext
call fcn.12f46a80
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], bl
call fcn.12e9c100
lea ecx, [esp + 0x14]
call fcn.12e9c170
test eax, eax
je 0x12e1bb11
push 0x131911a8
lea ecx, [esp + 0x14]
call fcn.12f46a80
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov byte [esp + 0x44], 2
call fcn.12e9c830
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp eax, ebx
je 0x12e1bb04
push 0x103
push eax
lea ecx, [esp + 0x18]
call fcn.12f47ef0
push eax
push 0x131a9ff4
call fcn.12f5c4ab
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.12f47220
call esi
mov dword [0x131aa1fc], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.12e9c060
xor edx, edx
cmp word [0x131a9ff4], bx
setne dl
mov ebp, edx
cmp ebp, ebx
je 0x12e1bb70
mov esi, dword [esp + 0x48]
cmp esi, ebx
je 0x12e1bb70
mov edx, dword [esp + 0x4c]
cmp edx, ebx
jle 0x12e1bb70
lea ecx, [edx + edx]
xor eax, eax
mov ebx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
push edx
push 0x131a9ff4
rep stosb byte es:[edi], al
push esi
call fcn.12f5c4ab
add esp, 0xc
mov ecx, dword [esp + 0x38]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x12e22970
Capabilities:
Get file attributes
Get graphical window text

Disassembly:
sub esp, 0x208
push ebp
push esi
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12e229a0
push esi
push str.GetPathFromForegroundWindow_1__Hwnd_:_0x_08x_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
push ebx
cmp esi, ebp
push edi
je 0x12e22b4c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push 0x103
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [0x13198f68], ebp
je 0x12e229f0
lea ecx, [esp + 0x10]
push ecx
push str.GetPathFromForegroundWindow_2__HwndName_:__s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
mov eax, dword [str.CabinetWClass]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12e22b4c
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, 0x130783d4
mov ecx, dword [edi]
push 0
push ecx
push 0
push esi
call ebx
mov esi, eax
test esi, esi
je 0x12e22a31
add edi, 4
cmp edi, str.Enable_DDE_Re_Broadcast
jb 0x12e22a16
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e22a4f
push esi
push str.GetPathFromForegroundWindow_3__DstHwnd_:__d_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
test esi, esi
je 0x12e22b4c
lea edx, [esp + 0x10]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
push 0x103
push edx
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x10]
push 0x13102e9c
push eax
call fcn.12f5c46a
mov esi, eax
mov eax, dword [0x13198f68]
add esp, 8
test eax, eax
je 0x12e22ab7
test esi, esi
mov eax, esi
jne 0x12e22a9d
mov eax, 0x131911a8
lea ecx, [esp + 0x10]
push eax
push ecx
push str.GetPathFromForegroundWindow_4__szName_:__s___Dir_:__s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
test esi, esi
jne 0x12e22b08
lea edx, [esp + 0x10]
push 0x13102e24
push edx
call fcn.12f5c46a
mov esi, eax
add esp, 8
test esi, esi
je 0x12e22ad6
sub esi, 2
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e22b04
test esi, esi
mov eax, esi
jne 0x12e22aea
mov eax, 0x131911a8
push eax
lea eax, [esp + 0x14]
push eax
push str.GetPathFromForegroundWindow_5__DstHwndName:_s___Dir2:_s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
test esi, esi
je 0x12e22b4c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e22b30
push ebx
push esi
push str.GetPathFromForegroundWindow_6__Dir:_s___Attr:0x_08x_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
cmp ebx, 0xffffffff
je 0x12e22b4c
test bl, 0x10
je 0x12e22b4c
mov ecx, dword [esp + 0x21c]
push esi
call fcn.12f474a0
mov ebp, 1
mov eax, dword [0x13198f68]
pop edi
test eax, eax
pop ebx
je 0x12e22b76
mov ecx, dword [esp + 0x214]
mov edx, dword [ecx]
push edx
push ebp
push str.GetPathFromForegroundWindow__ret_:__d___Dir:_s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
mov eax, ebp
pop esi
pop ebp
add esp, 0x208
ret
Function at 0x12e282d0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
push ebx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x50]
push ebp
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 0xc]
push edi
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x40]
push eax
push 0x12e28180
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov edi, 1
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x12e283f5
call fcn.12e28220
test eax, eax
je 0x12e283f5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.12e5c5e0
add esp, 4
test eax, eax
je 0x12e283f5
mov ebp, dword [sym.imp.USER32.dll_GetPropW]
cmp edi, 0x14
jg 0x12e283f5
push 0x12c
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x12e283bf
push str.ddeconv
push ebx
call ebp
mov esi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e283bb
push esi
push str.HandlerBroadcastMessage_GetPropW_0x_x__r_n
push str.DDELimit
push 4
call fcn.12dad750
add esp, 0x10
test esi, esi
jne 0x12e283f5
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e283dd
push edi
push str.HandlerBroadcastMessage_Time__d__r_n
push str.DDELimit
push 4
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x12e28180
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x12e2837a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x12e31550
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push ebp
mov dword [esp + 0xc], eax
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x12e3157e
push ebx
call fcn.12f5c44d
add esp, 4
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x12e31593
push ebp
call fcn.12f5c44d
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add edx, ecx
lea edi, [edx + edx + 0x10]
push edi
call fcn.12f5bf8b
mov esi, eax
add esp, 4
test esi, esi
jne 0x12e315b8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x12e315fa
mov edx, dword [esi]
lea eax, [esi + 0xc]
push edx
push ebx
push eax
call fcn.12f5c4ab
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x12e31616
mov edx, dword [esi]
mov ecx, dword [esi + 4]
push ecx
push ebp
lea eax, [esi + edx*2 + 0xe]
push eax
call fcn.12f5c4ab
add esp, 0xc
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
push 0
push esi
push 0x12e31650
push 0
mov dword [esi + 8], ecx
push 0
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x12e32190
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.12f5c44d
mov ebx, dword [esp + 0x24]
add esp, 4
mov ebp, eax
mov eax, 0x1f3
sub eax, ebp
push ebx
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x12e321d5
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
push edi
mov edi, 1
test byte [ebx], 0x10
je 0x12e322f2
add ebx, 0x2c
cmp word [ebx], 0x2e
jne 0x12e3220f
mov ecx, dword [esp + 0x24]
mov ax, word [ecx + 0x2e]
cmp ax, 0x2e
jne 0x12e32206
cmp word [ecx + 0x30], 0
je 0x12e322c1
test ax, ax
je 0x12e322c1
push ebx
call fcn.12f5c44d
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0x18], eax
inc eax
cmp ecx, eax
jb 0x12e322c1
mov eax, dword [esp + 0x2c]
lea ebp, [esi + ebp*2 - 2]
push eax
push 0x10002
push ebx
push esi
mov word [ebp], 0
call dword [esp + 0x38]
mov edi, eax
test edi, edi
je 0x12e322dd
push ebx
push esi
call fcn.12f5c865
push 0x13109518
push esi
call fcn.12f5c865
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
push esi
call fcn.12e32190
mov edi, eax
add esp, 0x20
test edi, edi
je 0x12e322dd
mov ecx, 0x82
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push ecx
push ebp
push ebx
call fcn.12f5c4ab
mov edx, dword [esp + 0x38]
add esp, 0xc
mov word [ebp], 0
push edx
push 0x20002
push ebx
push esi
call dword [esp + 0x38]
mov edi, eax
mov eax, dword [esp + 0x20]
mov word [ebp], 0x2a
mov ebp, eax
mov word [esi + eax*2], 0
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x12e322dd
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x12e321db
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x2c]
lea edx, [ebx + 0x2c]
push ecx
push 1
push edx
push esi
mov word [esi + ebp*2 - 2], 0
call dword [esp + 0x38]
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
jmp 0x12e322c5
Function at 0x12e32b10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
xor edx, edx
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
je 0x12e32cbe
cmp dword [esp + 0x38], 0x200
jne 0x12e32cbe
push esi
push edi
mov ecx, 7
lea edi, [esp + 0x16]
mov word [esp + 0x14], dx
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], edx
rep stosd dword es:[edi], eax
mov eax, dword [0x130d5510]
mov ecx, dword [0x130d5514]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
add eax, 0x41
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], ax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
push ecx
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], edx
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x12e32c84
lea edx, [esp + 0x14]
push edx
call fcn.12f5c44d
lea esi, [ebx + 0x36]
push 5
push str.FAT16
push esi
mov edi, eax
call fcn.12f69b10
add esp, 0x10
test eax, eax
jne 0x12e32be4
cmp edi, 5
jne 0x12e32c1d
push edi
lea eax, [esp + 0x18]
push 0x131096bc
push eax
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
je 0x12e32c39
push 5
push str.FAT12
push esi
call fcn.12f69b10
add esp, 0xc
test eax, eax
jne 0x12e32c45
cmp edi, 3
jne 0x12e32c45
push edi
lea edx, [esp + 0x18]
push 0x131096ac
push edx
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12e32c45
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edi, 3
jne 0x12e32be4
push edi
lea ecx, [esp + 0x18]
push 0x131096ac
push ecx
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12e32be4
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x28
ret
push 5
lea eax, [ebx + 0x52]
push str.FAT32
push eax
call fcn.12f69b10
add esp, 0xc
test eax, eax
jne 0x12e32c84
cmp edi, 5
jne 0x12e32c84
push edi
lea ecx, [esp + 0x18]
push 0x13109698
push ecx
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12e32c84
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x28
ret
lea esi, [ebx + 3]
push 5
push str.EXFAT
push esi
call fcn.12f69b10
add esp, 0xc
test eax, eax
jne 0x12e32ca7
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x28
ret
push 4
push str.NTFS
push esi
call fcn.12f69b10
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x12e32cd0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov ebx, dword [esp + 0x118]
rep stosd dword es:[edi], eax
mov cl, byte [0x131096e2]
xor esi, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x131096e0]
mov byte [esp + 0xe], cl
test ebx, ebx
mov word [esp + 0xc], ax
je 0x12e32d15
cmp ebx, 1
jne 0x12e32d2d
call fcn.12f9c4e0
test eax, eax
jne 0x12e32d2d
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x108
ret
lea edx, [esp + 0x10]
push 0x104
lea eax, [esp + 0x10]
add bl, 0x41
push edx
push eax
mov byte [esp + 0x18], bl
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jbe 0x12e32d9e
cmp eax, 0x104
jae 0x12e32d9e
lea ecx, [esp + 0x10]
push ecx
call fcn.12f5e838
lea edx, [esp + 0x14]
push str.cdrom
push edx
call fcn.12f5de64
add esp, 0xc
test eax, eax
je 0x12e32d79
mov esi, 5
lea eax, [esp + 0x10]
push str.floppy
push eax
call fcn.12f5de64
add esp, 8
test eax, eax
je 0x12e32daa
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x108
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret