joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b3b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x420
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
xor esi, esi
push 0x206
lea eax, [esp + 0x21e]
push esi
push eax
mov dword [esp + 0x10], esi
mov word [esp + 0x224], si
call fcn.1003d360
push 0x206
lea ecx, [esp + 0x22]
push esi
push ecx
mov word [esp + 0x28], si
call fcn.1003d360
add esp, 0x18
push 0x104
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x104
lea eax, [esp + 0x230]
push eax
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1000b44d
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.1003c13d
add esp, 0x420
ret
mov ecx, dword [esp + 0x420]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.1003c13d
add esp, 0x420
ret

Function at 0x1000b5e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov esi, 0x43
mov word [esp + 0x14], 0
call fcn.1003d360
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add esp, 0xc
lea esp, [esp]
movzx ecx, si
push ecx
push str._c:_
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.10003980
add esp, 0x10
lea eax, [esp + 8]
push eax
call edi
cmp eax, 1
je 0x1000b66b
add esi, 1
cmp si, 0x5a
jbe 0x1000b620
pop edi
mov ax, 0x2e
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1003c13d
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop edi
mov ax, si
pop esi
xor ecx, esp
call fcn.1003c13d
add esp, 0x20c
ret

Function at 0x1000b690
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov esi, ecx
mov word [esp + 0x18], 0
call fcn.1003d360
movzx ecx, word [esi]
push ecx
push str.._c:
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.1003cd26
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x1c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 3
push 0
push 1
mov ebx, eax
push SysReAllocString
lea eax, [esp + 0x24]
push eax
call esi
cmp eax, 0xffffffff
jne 0x1000b72d
call edi
sub eax, ebx
cmp eax, 0x3e8
ja 0x1000b734
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea ecx, [esp + 0x24]
push ecx
call esi
cmp eax, 0xffffffff
je 0x1000b707
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x20c
ret
Function at 0x1000ebf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x520
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x51c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x52c]
push esi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x221]
mov esi, ecx
push ebx
push eax
mov dword [esp + 0x1c], esi
mov byte [esp + 0x228], bl
call fcn.1003d360
push 0x103
lea ecx, [esp + 0x129]
push ebx
push ecx
mov byte [esp + 0x130], bl
call fcn.1003d360
push 0x103
lea edx, [esp + 0x31]
push ebx
push edx
mov byte [esp + 0x38], bl
call fcn.1003d360
push 0x103
lea eax, [esp + 0x349]
push ebx
push eax
mov byte [esp + 0x350], bl
call fcn.1003d360
push 0x103
lea ecx, [esp + 0x459]
push ebx
push ecx
mov byte [esp + 0x460], bl
call fcn.1003d360
add esp, 0x3c
mov eax, edi
mov dword [esp + 0xc], ebx
call fcn.1000ef60
test eax, eax
jne 0x1000ed93
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 0xc]
push edx
push 0x10058a30
push 0x104
lea eax, [esp + 0x228]
push eax
push 0xffffffffffffffff
push str.operating_systems
push ebx
push ebx
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x10058a30
push 0x104
lea edx, [esp + 0x124]
push edx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call esi
lea eax, [esp + 0xc]
push eax
push 0x10058a30
push 0x104
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
push str.none
push ebx
push ebx
call esi
lea edx, [esp + 0xc]
push edx
push 0x10058a30
push 0x104
lea eax, [esp + 0x32c]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
lea ecx, [esp + 0x320]
push ecx
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x430]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x51c]
xor ecx, esp
call fcn.1003c13d
add esp, 0x520
ret
push edi
push 0x104
push esi
push str.none
push ebp
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esp + 0x528]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x520
ret

Function at 0x1000ef60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000efb5
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000efae
mov dword [esp + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp word [esp + 4], 0xfeff
pop esi
sete al
add esp, 8
ret
Function at 0x1001e180
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov dword [esp + 0xc], reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x14], 0
call fcn.1003d360
add esp, 0xc
lea ecx, [esp]
push ecx
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1001e214
push eax
push str.Sys_ID__u
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.10003980
mov edx, dword [esp + 0x10]
add esp, 0x10
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1003c13d
add esp, 0x214
ret

Function at 0x1001e230
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x238
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push 0x206
lea eax, [esp + 0x36]
push 0
push eax
mov word [esp + 0x3c], 0
call fcn.1003d360
push 0
call fcn.1004055f
add esp, 0x10
push 0x1000
push 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1001e294
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.1003c13d
add esp, 0x238
ret
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.10040598
lea eax, [esp + 0x14]
push eax
push str.__Y__m__d__H:_M:_S_
lea ecx, [esp + 0x40]
push 0x104
push ecx
call fcn.1003eed2
push edi
lea edx, [esp + 0x4c]
push edx
push str._s_s_r_n
push 0x800
push esi
call fcn.10003980
mov eax, dword [ebx + 0x414]
add esp, 0x2c
cmp eax, 0xffffffff
je 0x1001e31a
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001e2f2
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [ebx + 0x414]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x238]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1003c13d
add esp, 0x238
ret
Function at 0x1001ee10
Capabilities:
Get disk size

Disassembly:
sub esp, 0x418
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x21a]
push ebx
push eax
mov esi, ecx
mov word [esp + 0x220], bx
call fcn.1003d360
push 0x1ff
lea ecx, [esp + 0x25]
push ebx
push ecx
mov byte [esp + 0x2c], bl
call fcn.1003d360
add esp, 0x18
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
call fcn.1001edb0
mov edx, dword [esi]
push edx
push str..PHYSICALDRIVE_i
lea eax, [esp + 0x21c]
push 0x104
push eax
call fcn.1003cd26
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x38], eax
jne 0x1001eed2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.1003c13d
add esp, 0x418
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
lea edx, [esp + 0x10]
push edx
push 0x200
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x700a0
push eax
call edi
test eax, eax
jne 0x1001ef1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esi + 4], eax
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.1003c13d
add esp, 0x418
ret
mov eax, dword [esp + 0x24]
mul dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push eax
call fcn.1003db20
mov ecx, dword [esi + 0x38]
push ebx
mov dword [esi + 0x14], edx
lea edx, [esp + 0x10]
push edx
push 8
mov dword [esi + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x7405c
push ecx
call edi
test eax, eax
jne 0x1001ef6f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call fcn.1003db20
mov dword [esi + 0xc], edx
jmp 0x1001ef7a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], ecx
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push ebx
mov dword [esi + 8], eax
push edi
xor eax, eax
push eax
push ebp
mov dword [esi + 0x3c], edx
call fcn.1003db20
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esi + 0x1c], edx
xor edx, edx
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x40]
cmp eax, ecx
sete dl
mov dword [esi + 0x28], ebp
pop ebp
mov dword [esi + 0x20], edi
mov dword [esi + 0x34], ecx
mov dword [esi + 4], ecx
pop edi
mov dword [esi + 0x48], edx
xor edx, edx
cmp eax, 1
sete dl
mov dword [esi + 0x24], ebx
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x41c]
mov dword [esi + 0x44], edx
pop esi
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x418
ret
Function at 0x1001f4a0
Capabilities:
Get disk information via ioctl

Disassembly:
push ecx
cmp dword [ebx + 0x38], 0xffffffff
mov dword [esp], 0
je 0x1001f53f
push esi
push edi
mov edi, 0xf60
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1001f52d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov ecx, dword [ebx + 0x38]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 0
push 0
push 0x70050
push ecx
call ebp
test eax, eax
jne 0x1001f523
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001f50f
push 0x40
add edi, 0x5a0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov esi, eax
test esi, esi
jne 0x1001f4d0
jmp 0x1001f52c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
jmp 0x1001f52c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 4], eax
pop ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001f537
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
mov dword [ebx + 4], 0x80004002
xor eax, eax
pop ecx
ret 4
Function at 0x10020160
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
xor ebp, ebp
cmp dword [esi + 0x38], 0xffffffff
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
jne 0x1002018c
mov dword [esi + 4], 0x10000101
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov ebx, dword [esp + 0x30]
cmp ebx, ebp
jl 0x100202ee
mov edi, dword [esp + 0x2c]
jg 0x100201a6
cmp edi, ebp
jb 0x100202ee
cmp ebx, dword [esi + 0xc]
jg 0x100202ee
jl 0x100201ba
cmp edi, dword [esi + 8]
ja 0x100202ee
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x100201df
mov dword [esi + 4], 0x10000004
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov ecx, edi
add ecx, dword [esi + 0x20]
mov eax, ebx
adc eax, dword [esi + 0x24]
cmp eax, dword [esi + 0xc]
jl 0x100201fd
jg 0x100202ee
cmp ecx, dword [esi + 8]
ja 0x100202ee
mov edx, dword [esi + 0x38]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10020228
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov eax, dword [esi + 0x20]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x100202dc
mov dword [esp + 0x10], ebp
xor ebx, ebx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x38]
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
push edi
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100202bf
mov eax, dword [esi + 0x20]
cmp dword [esp + 0x2c], eax
jne 0x100202bf
mov ecx, dword [esp + 0x34]
push eax
push edi
push eax
lea edx, [ecx + ebp]
push edx
call fcn.1003c1af
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
add esp, 0x10
add dword [esp + 0x10], 1
adc ebx, 0
add ebp, eax
adc dword [esp + 0x24], ecx
test ebx, ebx
jl 0x10020244
jg 0x100202a3
cmp dword [esp + 0x10], 1
jb 0x10020244
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], ebx
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov dword [esi + 4], 8
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
pop edi
pop ebp
mov dword [esi + 4], 0x10000002
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x10020300
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, eax
xor eax, eax
cmp dword [esi + 0x38], 0xffffffff
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jne 0x1002032e
mov dword [esi + 4], 0x10000101
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
mov ebx, dword [esp + 0x30]
cmp ebx, eax
jl 0x100204b8
mov ebp, dword [esp + 0x2c]
jg 0x10020348
cmp ebp, eax
jb 0x100204b8
cmp ebx, dword [esi + 0xc]
jg 0x100204b8
jl 0x1002035c
cmp ebp, dword [esi + 8]
ja 0x100204b8
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10020382
mov dword [esi + 4], 0x10000004
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, ecx
add edi, ebp
mov eax, edx
adc eax, ebx
cmp eax, dword [esi + 0xc]
jl 0x100203a4
jg 0x100204b8
cmp edi, dword [esi + 8]
ja 0x100204b8
mov edi, edx
push 0
mov ebp, ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x38]
push edx
push eax
push ecx
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100204a3
test edi, edi
jl 0x1002044b
jg 0x100203ec
test ebp, ebp
jbe 0x1002044b
jmp 0x100203ec
mov edi, dword [esp + 0x1c]
test edi, edi
jl 0x100203fc
jg 0x100203f7
cmp ebp, 0xffffffff
jbe 0x100203fc
or edi, 0xffffffff
jmp 0x100203fe
mov edi, ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esi + 0x38]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x10020442
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10020429
mov eax, edi
mov dword [esp + 0x14], eax
sub ebp, eax
mov eax, dword [esp + 0x1c]
sbb eax, 0
test eax, eax
mov dword [esp + 0x1c], eax
jg 0x100203e8
jl 0x1002044b
test ebp, ebp
ja 0x100203e8
jmp 0x1002044b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov edx, dword [esi + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ebp, ebp
cmp ebx, ebp
je 0x100204bf
cmp dword [esi + 0x24], ebp
jl 0x10020468
jg 0x10020491
cmp dword [esi + 0x20], 0xffffffff
ja 0x10020491
mov eax, dword [esi + 0x20]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebp
je 0x10020491
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push edi
push ecx
push edx
call fcn.10020160
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
mov dword [esi + 4], 0x10000002
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0xc
Function at 0x100244c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10050274
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10063790]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x10]
mov dword [esi], vtable.CSDSPartition.0
xor ebx, ebx
mov eax, 7
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
lea ebp, [esi + 0x44]
mov dword [esp + 0x1c], ebx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], bx
lea eax, [esi + 0x88]
push eax
mov byte [esp + 0x20], 1
call fcn.10024810
push ebx
mov byte [esp + 0x20], 2
push 0x10057090
mov ecx, edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.10001bf0
push ebx
push 0x10057090
mov ecx, ebp
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
call fcn.10001bf0
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], 1
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xdc], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x10024e30
Capabilities:
Get disk information

Disassembly:
sub esp, 0x414
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x206
lea eax, [esp + 0x16]
push ebp
push eax
mov word [esp + 0x1c], bp
call fcn.1003d360
push 0x206
lea ecx, [esp + 0x22a]
push ebp
push ecx
mov word [esp + 0x230], bp
call fcn.1003d360
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add esp, 0x18
lea edi, [ebp + 0x43]
test ebp, ebp
jne 0x10024f33
movzx esi, di
push esi
push str._c:_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.1003cd26
push esi
push 0x10058458
lea eax, [esp + 0x230]
push 0x104
push eax
call fcn.1003cd26
add esp, 0x20
lea ecx, [esp + 0x10]
push ecx
call ebx
cmp eax, 3
je 0x10024ed9
lea edx, [esp + 0x10]
push edx
call ebx
cmp eax, 2
jne 0x10024f1e
push edi
call fcn.10031f40
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x10024ef1
push edi
call fcn.10027350
mov esi, eax
push edi
call fcn.10031e80
add esp, 4
cmp eax, 0xffffffff
jne 0x10024f05
push edi
call fcn.10027350
cmp eax, dword [esp + 0x428]
jne 0x10024f1e
cmp esi, dword [esp + 0x42c]
jne 0x10024f1e
mov ebp, 1
jmp 0x10024f21
add edi, 1
cmp di, 0x5a
jbe 0x10024e86
test ebp, ebp
mov ax, 0x2e
je 0x10024f36
mov ax, di
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x414
ret 8

Function at 0x10025060
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x1004efa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10063790]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, 0x43
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
mov dword [esp + 0x3c], ebp
mov ebx, 1
lea edi, [esi - 0x3b]
cmp dword [esp + 0x2c], ebx
jae 0x100250cb
mov eax, dword [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.10001dc0
cmp dword [esp + 0x2c], edi
mov eax, dword [esp + 0x18]
jae 0x100250d9
lea eax, [esp + 0x18]
mov word [eax], si
cmp dword [esp + 0x2c], edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], ebx
jae 0x100250ee
lea eax, [esp + 0x18]
push 2
push 0x1005b6ec
lea ecx, [esp + 0x1c]
mov word [eax + 2], bp
call fcn.100019e0
cmp dword [esp + 0x2c], edi
mov eax, dword [esp + 0x18]
jae 0x10025110
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebx
je 0x1002513c
add esi, ebx
cmp si, 0x5a
jbe 0x100250b6
cmp dword [esp + 0x2c], edi
jb 0x10025136
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1003c1aa
add esp, 4
mov ax, 0x2e
jmp 0x10025152
cmp dword [esp + 0x2c], edi
jb 0x1002514f
mov edx, dword [esp + 0x18]
push edx
call fcn.1003c1aa
add esp, 4
mov ax, si
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1003c13d
add esp, 0x2c
ret
Function at 0x10025180
Capabilities:
Get disk information

Disassembly:
sub esp, 0x30
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x2c], eax
xor eax, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
push esi
push edi
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
lea eax, [esp + 0xc]
push eax
mov esi, ecx
push 0x14
lea ecx, [esp + 0x18]
push ecx
xor edi, edi
push esi
mov word [esp + 0x20], di
mov dword [esp + 0x1c], edi
call ebp
cmp eax, edi
jne 0x10025274
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1002520e
mov edx, dword [esp + 0xc]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x10025222
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1003c13d
add esp, 0x30
ret
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
push esi
call ebp
test eax, eax
jne 0x1002526a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10057090
mov ecx, ebx
mov esi, eax
call fcn.100019a0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1003c13d
add esp, 0x30
ret
push edi
mov ecx, ebx
call fcn.100019a0
jmp 0x1002529c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x10025280
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10025280
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
call fcn.10001bf0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.1003c13d
add esp, 0x30
ret