joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4d4df0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x5ff6a0
push esi
mov dword [ebp - 8], ebx
call fcn.005d88c1
add esp, 8
test eax, eax
je 0x4d4e3c
test ebx, ebx
je 0x4d4e2c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4d4e65
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d4e65
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x4d4f10
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d4e81
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x674cf4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d4f06
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4d4f06
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d4eb2
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d4ed0
sub ecx, edx
add ecx, ebx
sub ecx, esi
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4d4ee0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4d4efd
push 8
push 0
push ebx
call eax
jmp 0x4d4f04
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x674cf8]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4d82f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4d8323
push 0x2e
push edi
call fcn.00480d80
add esp, 8
test eax, eax
je 0x4d8321
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4da660
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x674cf4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4da68d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4da6d4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4da6da
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4da73b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4da700
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4da767
mov eax, dword [esi + 4]
push 1
push 0x5ffe6e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5ffe6f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4da740
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50c1a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.0046d920
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004e6b40
mov ebx, eax
push ebx
push esi
call fcn.004e6a20
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x50c229
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x50c203
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004e6a90
push esi
call fcn.004e6be0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x50c229
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004e6b40
mov ebx, eax
push ebx
push esi
call fcn.004e6a20
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x50c298
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x50c27e
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004e6a90
push esi
call fcn.004e6be0
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x50c221
push esi
call fcn.004e6be0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x532970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x532997
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x532986
pop edi
movzx eax, dl
pop esi
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1f180a59
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x73d35065
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x68912ee0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_GetSystemTimeAsFileTime
lea ecx, [ebp - 0x10]
push ecx
call sym.kernelbase.dll_QueryPerformanceCounter
lea edx, [ebp - 8]
push edx
call sym.kernelbase.dll_QueryPerformanceCounter
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add eax, dword [ecx]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x68913ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 0x110]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0xf0
jbe 0x68914014
xor eax, eax
jmp 0x68914097
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea eax, [ebp + 0x18]
push eax
push 0x100
lea ecx, [ebp - 0x110]
push ecx
push 2
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtQueryValueKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6891405f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68914097
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
cmp eax, dword [ebp + 0x10]
je 0x68914078
push 0x65d
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68914097
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x689143a0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6896ad0c]
mov dword [ebp - 4], eax
mov ecx, dword [0x6896ad0c]
add ecx, 1
mov dword [0x6896ad0c], ecx
cmp dword [ebp - 4], 0
jne 0x689143d8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.__p___p__stub__n
call sub.ntext.dll_DbgPrint
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x68914510
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xd
ja case.0x68914533.3
mov ecx, dword [ebp - 0x14]
jmp dword [ecx*4 + 0x6891469c]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 0x28
jmp 0x689145d3
mov dword [ebp - 8], 5
mov dword [ebp - 0xc], 0x18
jmp 0x689145d3
mov dword [ebp - 8], 9
mov dword [ebp - 0xc], 8
jmp 0x689145d3
mov dword [ebp - 8], 0x16
mov dword [ebp - 0xc], 0x20
jmp 0x689145d3
mov dword [ebp - 8], 0x1c
mov dword [ebp - 0xc], 0x10
jmp 0x689145d3
mov dword [ebp - 8], 0x23
mov dword [ebp - 0xc], 8
jmp 0x689145d3
mov byte [ebp - 2], 1
mov dword [ebp - 8], 0x25
mov dword [ebp - 0xc], 0x70
mov byte [ebp - 1], 1
jmp 0x689145d3
mov dword [ebp - 8], 0x37
mov dword [ebp - 0xc], 0x74
jmp 0x689145d3
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68914694
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x14]
jbe 0x689145e9
push 0x18
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68914694
movzx eax, byte [ebp - 1]
test eax, eax
je 0x68914644
movzx ecx, byte [ebp - 2]
push ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtQueryDirectoryFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x103
jne 0x68914642
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_WaitForSingleObjectEx
cmp eax, 0xffffffff
jne 0x6891463c
xor eax, eax
jmp 0x68914694
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
jmp 0x68914661
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntext.dll_NtQueryInformationFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x68914689
cmp dword [ebp + 0xc], 7
jne 0x68914680
cmp dword [ebp - 0x18], 0
jne 0x68914680
push 0x26
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68914694
mov eax, 1
jmp 0x68914694
mov edx, dword [ebp - 0x10]
push edx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x68914e10
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x29
push 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtSetInformationFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x68914e47
mov eax, 1
jmp 0x68914e50
push 0x78
call sub.kernel32.dll_SetLastError
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x68915350
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push 0x22
push 0
call sym.kernelbase.dll_GetProcessHeap
push eax
call dword [sym.imp.ntext.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x68915375
xor eax, eax
jmp 0x689153f4
push 0x22
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ntext.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x10], ecx
push str.ADVAPI32.DLL
call sym.kernelbase.dll_LoadLibraryW
mov dword [ebp - 0x14], eax
push str.SystemFunction036
mov edx, dword [ebp - 0x14]
push edx
call sym.kernelbase.dll_GetProcAddress
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
jmp 0x689153be
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x10
jge 0x689153f1
mov byte [ebp - 1], 0
push 1
lea ecx, [ebp - 1]
push ecx
call dword [ebp - 0x18]
movzx eax, byte [ebp - 1]
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x41
mov eax, dword [ebp - 0x10]
mov word [eax], dx
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov dword [ebp - 0x10], ecx
jmp 0x689153b5
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x68915400
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], 1
jne 0x6891542f
mov dword [ebp - 4], 8
jmp 0x68915486
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x68915457
mov edx, dword [ebp + 0xc]
and edx, 0x20
je 0x68915448
mov dword [ebp - 8], 0x40
jmp 0x6891544f
mov dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x68915486
mov ecx, dword [ebp + 0xc]
and ecx, 4
je 0x6891547f
mov edx, dword [ebp + 0xc]
and edx, 0x20
je 0x68915470
mov dword [ebp - 0xc], 0x20
jmp 0x68915477
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x68915486
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0xffffffff
je 0x68915498
mov ecx, dword [ebp + 0x20]
add ecx, 1
or ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtMapViewOfSection]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x689154d2
mov ecx, dword [ebp - 0x10]
push ecx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
jmp 0x689154d5
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x68915670
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_SetFileAttributesA
pop ebp
ret 0xc

Function at 0x68915690
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_SetFileAttributesW
pop ebp
ret 0xc
Function at 0x689160c0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x214]
mov ecx, dword [ebp - 8]
call fcn.68916170
test eax, eax
jne 0x689160ee
xor eax, eax
jmp 0x68916166
lea eax, [ebp - 0xc]
push eax
push 0x100
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
lea edx, [ebp - 0x214]
push edx
call sym.kernelbase.dll_GetVolumePathNamesForVolumeNameW
test eax, eax
jne 0x68916112
xor eax, eax
jmp 0x68916166
mov eax, 2
imul eax, eax, 0
mov ecx, 0x5c
mov edx, dword [ebp - 4]
mov word [edx + eax], cx
mov eax, 2
shl eax, 0
mov ecx, 0x5c
mov edx, dword [ebp - 4]
mov word [edx + eax], cx
mov eax, 2
shl eax, 1
mov ecx, 0x3f
mov edx, dword [ebp - 4]
mov word [edx + eax], cx
mov eax, 2
imul eax, eax, 3
mov ecx, 0x5c
mov edx, dword [ebp - 4]
mov word [edx + eax], cx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x68916170
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
add ecx, 0x1e
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x400
jbe 0x689161a1
push 8
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x689161f8
push 0x1c
push 0x68938b68
lea edx, [ebp - 0x40c]
push edx
call sub.ntext.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
shr edx, 1
xor eax, eax
mov word [ebp + edx*2 - 0x40e], ax
push 0x104
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x40c]
push edx
call sym.kernelbase.dll_GetVolumeNameForVolumeMountPointW
mov esp, ebp
pop ebp
ret
Function at 0x68916970
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_RtlSetHeapInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x6891699e
mov eax, 1
jmp 0x689169b6
push str.HeapSetInformation_::_Status_unsuccess__return_FALSE_n
call sub.ntext.dll_DbgPrint
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x68916ae0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x20], 0
je 0x68916afb
push str.unexpected_version_parameter_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x24], 0
je 0x68916b0e
push str.unexpected_reserved_value_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x28], 0
je 0x68916b21
push str.unexpected_lParam_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x68916b2d
cmp dword [ebp + 0x18], 0
jne 0x68916b3b
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68916bdd
mov eax, dword [ebp + 0xc]
and eax, 0xaffceff8
je 0x68916b56
push 0x3ec
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68916bdd
mov ecx, dword [ebp + 0xc]
and ecx, 0x10000000
je 0x68916b6e
push str.Ignoring_unknown_flags_0x10000000_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x14], 0
jge 0x68916b83
mov edx, dword [ebp + 0x10]
push edx
call sub.ntext.dll_wcslen
add esp, 4
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x1c], 0
jge 0x68916b98
mov eax, dword [ebp + 0x18]
push eax
call sub.ntext.dll_wcslen
add esp, 4
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.68929440
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x68916bd8
cmp dword [ebp - 4], 0
jge 0x68916bcc
mov dword [ebp - 8], 1
jmp 0x68916bd3
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
jmp 0x68916bdd
mov eax, 2
mov esp, ebp
pop ebp
ret 0x24
Function at 0x689175d0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x689175fd
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68917791
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.Locale
mov ecx, dword [0x6896ad38]
push ecx
call sym.kernelbase.dll_RegOpenKeyExW
test eax, eax
je 0x68917624
xor eax, eax
jmp 0x68917791
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push str.Alternate_Sorts
mov eax, dword [ebp - 0x18]
push eax
call sym.kernelbase.dll_RegOpenKeyExW
test eax, eax
je 0x68917648
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0xa
cmp dword [ebp - 4], 0
je 0x6891765d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
jmp 0x68917663
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call sym.kernelbase.dll_RegEnumValueW
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x28], 0
je 0x689176bd
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x2c], 0
je 0x689176b4
jmp 0x6891777a
mov dword [ebp - 8], 0
jmp 0x68917648
cmp dword [ebp - 0x30], 1
je 0x689176c5
jmp 0x68917648
push 0x10
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.ntext.dll_wcstoul
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x689176e3
jmp 0x68917648
push 0x100
lea ecx, [ebp - 0x24c]
push ecx
push 0x8000005c
mov edx, dword [ebp - 0xc]
push edx
call sym.kernelbase.dll_GetLocaleInfoW
push 2
lea eax, [ebp - 0x1c]
push eax
push 0xa0000071
mov ecx, dword [ebp - 0xc]
push ecx
call sym.kernelbase.dll_GetLocaleInfoW
test eax, eax
jne 0x6891771c
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 4], 0
je 0x6891772b
mov dword [ebp - 0x14], 4
jmp 0x6891774a
cmp dword [ebp - 0x1c], 0
je 0x6891773a
mov dword [ebp - 0x24], 0x10
jmp 0x68917741
mov dword [ebp - 0x24], 0x20
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0xc], 0
je 0x6891775d
mov eax, dword [ebp - 0x14]
and eax, dword [ebp + 0xc]
jne 0x6891775d
jmp 0x68917648
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x24c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x68917775
jmp 0x6891777a
jmp 0x68917648
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.68924510
mov edx, dword [ebp - 0x18]
push edx
call fcn.68924510
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10