joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001670
Capabilities:
Read .ini file

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x1000168a
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4
add eax, 4
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4

Function at 0x10001830
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
xor ecx, ecx
test eax, eax
setne cl
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov edi, ecx
test edi, edi
jne 0x10001881
push 0x64
call fcn.10001430
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push esi
push ebx
push str.pExeFile_NULL
jmp 0x100018bf
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001884
sub eax, edx
sar eax, 1
xor ecx, ecx
mov esi, eax
cmp ecx, esi
sbb edi, edi
neg edi
jne 0x100018d8
push 0x66
call fcn.10001430
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push esi
push ebx
push str.szlExe_0
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x14
jmp 0x10001992
push ebp
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor ecx, ecx
mov ebx, eax
cmp ebx, 0xffffffff
setne cl
mov edi, ecx
test edi, edi
jne 0x10001924
push 0x69
call fcn.10001430
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebp
push str.hProcessSnap_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x10001991
lea ecx, [esp + 0x14]
push ecx
push ebx
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov edi, eax
test edi, edi
jne 0x1000195f
push 0x6d
call fcn.10001430
add esp, 4
push eax
push str.Process32First__hProcessSnap__pe32_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100015b0
add esp, 8
jmp 0x10001991
mov ebp, dword [sym.imp.MSVCR80.dll__wcsnicmp]
xor edi, edi
mov edx, dword [esp + 0x10]
push esi
push edx
lea eax, [esp + 0x40]
push eax
call ebp
add esp, 0xc
test eax, eax
je 0x1000198c
lea ecx, [esp + 0x14]
push ecx
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10001967
jmp 0x10001991
mov edi, 1
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x234
ret
Function at 0x100029c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectSys
xor ecx, ecx
test ebx, ebx
setne cl
mov esi, ecx
test esi, esi
jne 0x10002a2b
push 0x250
call fcn.10001430
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pDir_NULL
jmp 0x10002a5b
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
jne 0x10002a85
push 0x251
call fcn.10001430
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pSys_NULL
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1010dc50
add esp, 0x20c
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10002b08
xor eax, eax
jmp 0x10002aa0
movzx ecx, word [eax + str.C:ProgramData]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x10002aa0
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x10002ac0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002ac0
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10002b66
push 0x257
call fcn.10001430
add esp, 4
push eax
push str.l_Length
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100015b0
add esp, 8
jmp 0x10002b7f
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002b22
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10002b66
push 0x25d
call fcn.10001430
add esp, 4
push eax
push str.l_Length
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100015b0
add esp, 8
jmp 0x10002b7f
lea eax, [esp + 0xc]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10002b70
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x20c
ret
Function at 0x10002f30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x42c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
mov ebp, dword [esp + 0x438]
mov bl, 1
call sub.Comn.dll_GetObjectSys
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10002f63
xor bl, bl
push 0x3fe
lea ecx, [esp + 0x36]
push 0
push ecx
mov word [esp + 0x3c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
test bl, bl
je 0x10003048
mov eax, dword [0x1011e44c]
mov ecx, dword [0x1011e450]
mov edx, dword [0x1011e448]
mov dword [esp + 0xc], eax
mov ax, word [0x1011e458]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x30]
push ecx
mov word [esp + 0x1c], ax
xor eax, eax
push eax
push eax
mov dword [esp + 0x14], edx
mov edx, dword [0x1011e454]
push 0x23
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 8]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002ff0
push esi
push edi
lea edi, [esp + 0x38]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10003006
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0x38]
rep movsb byte es:[edi], byte [esi]
push edx
mov ecx, ebp
call dword [0x101193e4]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1010dc50
add esp, 0x42c
ret
push 0x400
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x30]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
lea edx, [esp + 0x30]
push edx
mov ecx, ebp
mov word [eax], 0
call dword [0x101193e4]
mov ecx, dword [esp + 0x430]
pop ebp
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x42c
ret
Function at 0x100030a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x101100eb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x1013b024]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x2e]
push 0
push eax
mov word [esp + 0x34], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x28]
push 0x5c
push edx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
lea edi, [esp + 0x30]
add esp, 8
mov word [eax], 0
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10003122
mov ecx, 6
mov esi, str.Version.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
movsw word es:[edi], word [esi]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x240], 0
call dword [0x101193e4]
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x1000316f
lea eax, [esp + 0x10]
push eax
push 0x11
push str.versionCode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x23c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1010dc50
add esp, 0x234
ret
Function at 0x100031d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x10110d6c
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1013b024]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x3a]
push ebp
push eax
mov esi, ecx
mov word [esp + 0x40], bp
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea ebx, [esp + 0x34]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10003240
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x100032ae
push ebx
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24c], 0
call fcn.10003370
add ebx, 8
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003280
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x18]
mov edi, eax
mov dword [esp + 0x248], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add ebp, 1
cmp edi, 3
je 0x10003254
mov eax, ebp
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1010dc50
add esp, 0x238
ret
Function at 0x10004110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectSys
xor ecx, ecx
test ebx, ebx
setne cl
mov esi, ecx
test esi, esi
jne 0x10004178
push 0x1a
call fcn.10003f10
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pDir_NULL
jmp 0x100041a5
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
jne 0x100041cf
push 0x1b
call fcn.10003f10
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pSys_NULL
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1010dc50
add esp, 0x20c
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10004245
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.C:ProgramData]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x100041e0
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x10004200
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004200
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x100042a1
push 0x21
call fcn.10003f10
add esp, 4
push eax
push str.l_lenth
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100015b0
add esp, 8
jmp 0x100042bf
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004260
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x100042a1
push 0x27
call fcn.10003f10
add esp, 4
push eax
push str.l_lenth
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100015b0
add esp, 8
jmp 0x100042bf
lea eax, [esp + 0xc]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x100042b0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100042b0
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x20c
ret
Function at 0x10004e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 8]
push edx
push 0
push str.ProductName
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10004e66
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 4
cmp dword [esp], 1
sete al
pop ecx
ret 4
Function at 0x1000dc60
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x1010f85e
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x1013b024]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov eax, 1
test byte [0x101534e8], al
jne 0x1000dcc3
or dword [0x101534e8], eax
mov ecx, 0x101534cc
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x10118360
call fcn.1010dd6d
add esp, 4
mov dword [esp + 0x1c], 0xffffffff
push 0
push ebp
mov dword [esp + 0x2c], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x1000dd5f
lea ecx, [ecx]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x1000dce0
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000dd4a
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x1011da4c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000dd4a
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0x16]
movzx ecx, word [eax + 0x10]
push edx
movzx edx, word [eax + 0x12]
push ecx
push edx
push str._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push esi
mov ecx, 0x101534cc
call dword [0x101193e4]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x101534e4], 8
mov eax, dword [0x101534d0]
jae 0x1000dd72
mov eax, 0x101534d0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x1000df20
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10110b5b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x42c], eax
push edi
mov eax, dword [0x1013b024]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
call fcn.100030a0
lea ecx, [esp + 8]
mov edi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x206
lea eax, [esp + 0x2a]
push 0
mov dword [esp + 0x448], 0
push eax
mov word [esp + 0x30], 0
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x23e]
push 0
push ecx
mov word [esp + 0x244], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
lea edx, [esp + 0x24]
push edx
call fcn.100164b0
lea eax, [esp + 0x24]
push eax
push str._sVersion.ini
lea edx, [esp + 0x234]
call fcn.10003ef0
add esp, 8
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0xc]
call dword [0x101193e4]
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x1000dff1
lea eax, [esp + 0xc]
push eax
push 0
push 0x1011eb0c
push 0x1011eb10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [edi - 1]
cmp ecx, 0xf
ja case.default.0x1000e010
jmp dword [ecx*4 + 0x1000e154]
push str.beta
jmp 0x1000e111
push 0x1011eb54
jmp 0x1000e111
push 0x1011eb58
jmp 0x1000e111
push 0x1011f858
jmp 0x1000e111
push 0x1011eb60
jmp 0x1000e111
push str.tech
jmp 0x1000e111
push str.techp
jmp 0x1000e111
add eax, 0xfffffffe
cmp eax, 0xf
ja case.0x1000e069.6
jmp dword [eax*4 + 0x1000e194]
push str.pro_trial
jmp 0x1000e111
push str.srv_trial
jmp 0x1000e111
push str.tech_trial
jmp 0x1000e111
push str.techp_trial
jmp 0x1000e111
push str.ws_trial
jmp 0x1000e111
push str.agent_Trial
jmp 0x1000e111
push str.stand_cn
jmp 0x1000e111
push str.pro_trial_cn
jmp 0x1000e111
push str.enterprise_trial_cn
jmp 0x1000e111
push str.agent_Trial_cn
jmp 0x1000e111
push str.home_Trial
jmp 0x1000e111
cmp eax, 0xa
mov ecx, esi
jne 0x1000e0d4
push str.agent_unreg
jmp 0x1000e113
push str.formal
jmp 0x1000e113
push str.agent_pro
jmp 0x1000e111
push str.agent_srv
jmp 0x1000e111
push str.std_cn
jmp 0x1000e111
push str.pro_cn
jmp 0x1000e111
push str.srv_cn
jmp 0x1000e111
push str.enterprise_cn
jmp 0x1000e111
push str.home
jmp 0x1000e111
push str.unknown
mov ecx, esi
call dword [0x10119420]
lea ecx, [esp + 8]
mov dword [esp + 0x440], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.1010dc50
add esp, 0x43c
ret
Function at 0x10016850
Capabilities:
Get disk information

Disassembly:
sub esp, 0x14
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x1011e3e8]
mov ecx, dword [0x1011e3ec]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], ecx
mov word [esp + 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1010dc50
add esp, 0x14
ret

Function at 0x100168a0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x14
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x1011e3e8]
mov ecx, dword [0x1011e3ec]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], ecx
mov word [esp + 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1010dc50
add esp, 0x14
ret

Function at 0x100168f0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [0x1011e3e8]
mov ecx, dword [0x1011e3ec]
push ebx
lea edx, [esp + 4]
mov dword [esp + 4], eax
push edx
mov dword [esp + 0xc], ecx
mov word [esp + 8], si
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1001694a
mov ecx, esi
call fcn.10016960
cmp eax, 7
jne 0x1001694a
mov al, 1
movzx eax, al
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1010dc50
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
movzx eax, bl
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x10
ret
Function at 0x10016960
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x24c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [str._:]
mov edx, dword [0x1011e33c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [0x1011e338]
push 0x1fa
xor edi, edi
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], eax
mov ax, word [0x1011e340]
lea ecx, [esp + 0x5a]
push edi
push ecx
xor ebp, ebp
mov dword [esp + 0x5c], edx
mov word [esp + 0x60], ax
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp si, 0x41
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
jb 0x100169ff
cmp si, 0x5a
jbe 0x10016a0c
lea edx, [esi - 0x61]
cmp dx, 0x19
ja 0x10016ae3
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocString
lea eax, [esp + 0x60]
push eax
mov word [esp + 0x6c], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10016a6a
push 0xb80
call fcn.1000d7b0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.hDrv_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
mov eax, ebp
jmp 0x10016ae5
push edi
lea eax, [esp + 0x14]
push eax
push 0x28
lea ecx, [esp + 0x2c]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push 0x2d1400
push esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10016ad4
push 0xb8a
call fcn.1000d7b0
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.DeviceIoControl_hDrv___IOCTL_STORAGE_QUERY_PROPERTY___ProQuery__sizeof_ProQuery____DevDesc__sizeof_DevDesc____ulBytesResult___NULL_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
jmp 0x10016ae5
mov ebp, dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
jmp 0x10016ae5
xor eax, eax
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x24c
ret