joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064500
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
push edi
jne 0x1006452d
call fcn.100646d0
test eax, eax
je 0x100646a8
cmp dword [esi + 0x24], 0
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jne 0x10064572
mov eax, dword [0x100c7a54]
test eax, eax
jne 0x10064564
push 0x100a6b44
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x10064564
push 0x100abe40
push eax
call ebp
test eax, eax
je 0x10064564
call eax
mov dword [0x100c7a54], eax
mov dword [esi + 0x24], eax
test eax, eax
je 0x10064572
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call edx
cmp dword [esi + 0x20], 0
je 0x100646a8
cmp dword [esi + 0x28], 0
je 0x100646a8
cmp dword [esi + 0x2c], 0
je 0x100646a8
cmp dword [esi + 0x14], 0
je 0x100645a8
push 1
xor edi, edi
mov eax, esi
mov dword [esi + 0x14], 0
call fcn.10064ec0
cmp dword [0x100c75c0], 0
mov ebx, dword [0x100bc66c]
mov dword [esp + 0x10], ebx
jne 0x100645e1
push 0x100abe04
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x10064667
push 0x100ae37c
push eax
call ebp
test eax, eax
je 0x100645e1
call eax
mov dword [0x100c75c0], eax
mov edi, dword [0x100c75c0]
test edi, edi
je 0x10064667
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push edi
call ecx
test eax, eax
je 0x10064667
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.10087b80
mov ecx, dword [edi]
mov eax, dword [ecx + 0x1c]
add esp, 0xc
push 0
push 0x103
lea edx, [esp + 0x20]
push edx
push 0x100af02c
push edi
call eax
test eax, eax
je 0x10064667
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10064635
sub eax, edx
sar eax, 1
je 0x10064667
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10064667
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
call fcn.100035a0
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx - 8]
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
neg eax
sbb eax, eax
and eax, ebx
push eax
mov eax, dword [edx + 4]
push ecx
mov dword [0x100c13dc], 1
call eax
lea ecx, [ebx - 0xc]
cmp ecx, 0x100bc65c
je 0x100646a8
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x100646a8
push esi
call fcn.1008441c
add esp, 4
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10083dbb
add esp, 0x21c
ret
Function at 0x100647a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x814
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
push 0x808
lea eax, [esp + 0xc]
push 0
push eax
call fcn.10087b80
mov edx, dword [0x100c6764]
add esp, 0xc
push 0x400
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
lea eax, [esp + 8]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call esi
push 0x100af04c
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esp + 8]
call fcn.1000a880
test eax, eax
jne 0x1006482f
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1006483e
mov edi, 0x100bc9a0
lea esi, [esp + 8]
call fcn.1000aa30
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
jne 0x10064857
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.10083dbb
add esp, 0x814
ret
push 0x100af070
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x1006483e
call eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x814
ret
Function at 0x10064a80
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
push ebx
mov ebx, dword [eax + 0x38]
push ebp
push esi
push edi
test ebx, ebx
je 0x10064c36
cmp dword [eax + 0x28], 0
je 0x10064c36
mov ebp, dword [ebx + 0x2c]
sub ebp, dword [ebx + 0x28]
add ebx, 0x1c
sar ebp, 3
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x10064c36
mov edi, ebp
lea esi, [esp + 0x20]
call fcn.100650a0
xor edi, edi
cmp ebp, edi
mov dword [esp + 0x14], edi
jle 0x10064c1a
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
sar eax, 3
cmp edi, eax
jb 0x10064ae3
call fcn.100848cc
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x2c], 0
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx + edi*8]
lea ebp, [edi*8]
je 0x10064b7e
mov eax, dword [eax + 0x2c]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
mov esi, eax
test esi, esi
je 0x10064b7e
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
sar ecx, 3
cmp edi, ecx
jb 0x10064b22
call fcn.100848cc
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + ebp]
add eax, ebp
mov eax, dword [esp + 0x30]
push edx
call fcn.10064fa0
test eax, eax
je 0x10064b7e
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x9c]
push 1
push esi
call edx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10064b7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call edx
test eax, eax
je 0x10064b7e
mov esi, ebx
call fcn.10031720
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [edx + eax*4], ecx
inc eax
mov dword [esp + 0x14], eax
inc edi
cmp edi, dword [esp + 0x1c]
jl 0x10064ad1
cmp dword [esp + 0x14], 0
jle 0x10064c1a
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x10064bb1
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10064bb1
mov eax, dword [ecx + 0x34]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x10064bb3
xor eax, eax
test eax, eax
je 0x10064bbf
mov eax, dword [eax + 0x11c]
jmp 0x10064bc1
xor eax, eax
lea ecx, [eax + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
push 0
call edx
push 4
lea eax, [esp + 0x34]
push eax
push 4
push 0x100aea98
push 0x100aeab4
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x48], 1
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
cmp dword [esp + 0x34], 0
mov ecx, 0xc0
je 0x10064c04
mov ecx, 0x10c0
mov eax, dword [esi + 0x28]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
push eax
call edx
mov eax, dword [esp + 0x20]
push eax
call fcn.1008441c
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
Function at 0x10064c50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0x18], ebx
jle 0x10064c9c
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
push 0x100c5a78
neg ecx
or ecx, eax
push ecx
call fcn.1008589d
lea ecx, [esi*4]
push ecx
push ebx
push eax
mov dword [esp + 0x2c], eax
call fcn.10087b80
add esp, 0x14
mov dword [esp + 0x24], ebx
cmp esi, ebx
jbe 0x10064ddb
jmp 0x10064cb0
mov edi, dword [esp + 0x28]
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0xc]
sar edx, 2
cmp ebx, edx
jb 0x10064cc6
call fcn.100848cc
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
push eax
call fcn.100846cb
add esp, 4
cmp dword [ebp + 0x2c], 0
mov edi, eax
je 0x10064d3c
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push eax
call edx
mov esi, eax
test esi, esi
je 0x10064d38
push edi
mov eax, ebp
call fcn.10064fa0
test eax, eax
je 0x10064d38
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x9c]
push 1
push esi
call edx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10064d38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call edx
test eax, eax
je 0x10064d38
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov dword [ecx + eax*4], edi
inc eax
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x2c]
inc ebx
cmp ebx, esi
jb 0x10064cb0
mov esi, dword [esp + 0x24]
test esi, esi
jle 0x10064ddb
mov eax, dword [ebp + 0x34]
test eax, eax
je 0x10064d6a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10064d6a
mov eax, dword [ecx + 0x34]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x10064d6c
xor eax, eax
test eax, eax
je 0x10064d78
mov eax, dword [eax + 0x11c]
jmp 0x10064d7a
xor eax, eax
mov edx, dword [eax + 0x30]
lea ecx, [eax + 0x30]
mov eax, dword [edx + 0x1c]
push 0
call eax
push 4
lea ecx, [esp + 0x30]
push ecx
push 4
push 0x100aea98
push 0x100aeab4
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x44], 1
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
mov eax, dword [ebp + 0x28]
mov edx, dword [eax]
push 0x10c0
push esi
mov esi, dword [esp + 0x20]
push esi
push eax
mov eax, dword [edx + 0xc]
call eax
push esi
call fcn.1008441c
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1008441c
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x10073b00
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x100afaec
lea edi, [esp + 0xc]
call fcn.100036f0
mov ebx, 1
xor edi, edi
test byte [0x100c7adc], bl
jne 0x10073b4a
or dword [0x100c7adc], ebx
push 0x100a37b0
mov dword [0x100c7aa4], 0x100afdec
mov dword [0x100c7aa8], edi
mov dword [0x100c7ab4], edi
call fcn.1008416d
add esp, 4
mov esi, dword [esp + 0xc]
push ebx
push edi
push esi
mov ecx, 0x100c7aa4
call fcn.100751b0
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0x100afd60
push 0x100aee7c
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
push edi
push ebx
push esi
mov ecx, 0x100c7aa4
call fcn.100751b0
lea ecx, [esi - 0xc]
cmp ecx, 0x100bc65c
je 0x10073bac
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10073bac
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10076950
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.1007a4e0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.1007a580
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x68
ret
Function at 0x10076ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x100afdf0
push reloc.OLEAUT32.DLL_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x10076c51
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push 0x100afe2c
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x10076b53
cmp dword [esp + 0x14], 1
jne 0x10076c38
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x10076c38
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x100afe40
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10076b98
cmp dword [esp + 0x14], 1
jne 0x10076c38
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10076c38
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x100afe54
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10076bcf
cmp dword [esp + 0x14], 1
jne 0x10076c38
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10076c38
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x100afe74
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10076c38
cmp dword [esp + 0x14], 3
jne 0x10076c38
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x10076c38
lea eax, [esi + 0xc]
call fcn.100769c0
test eax, eax
je 0x10076c38
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10077040
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.10079020
add esp, 8
test eax, eax
jne 0x100770ab
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10083dbb
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x100770c0
push esi
lea ecx, [esp + 0x14]
call fcn.1007a4e0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.1007a580
test edi, edi
je 0x100770de
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.10083dbb
add esp, 0x6c
ret

Function at 0x10077120
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10079210
add esp, 4
test eax, eax
jne 0x1007717e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10083dbb
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.1007a580
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10083dbb
add esp, 0x64
ret

Function at 0x100771a0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.100792f0
add esp, 8
test eax, eax
jne 0x1007721f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10083dbb
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.1007a0d0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.10083dbb
add esp, 0x74
ret

Function at 0x10077b90
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x10077bbb
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x10077bd4
push 0x100a7638
call fcn.1007b050
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x10078470
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x100784a3
mov dword [esp + 0x10], 0xffffffff
jmp 0x100784a9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x100784d7
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
jmp 0x100785b7
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x10078507
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
jmp 0x100785b7
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x10078529
mov eax, 1
push 0x100a7638
call fcn.1007b050
add esp, 4
jmp 0x100785b7
cmp dword [esp + 0x40], ebx
je 0x10078565
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x1007854b
mov eax, 5
push 0x100a7638
call fcn.1007b050
add esp, 4
jmp 0x100785b7
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x100785af
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x10078573
mov ebx, esi
jmp 0x10078537
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x1007859c
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
jmp 0x100785b7
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.10077b90
test eax, eax
je 0x100785b7
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100785c1
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x28
ret
Function at 0x10078ea0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x10078ee6
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x10078f78
jg 0x10078f0e
cmp ebx, ecx
jb 0x10078f78
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x10078f3d
push 0x100a7638
mov eax, 0x100a7638
call fcn.1007afe0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.10077b90
test eax, eax
je 0x10078f33
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10078f5e
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10078f85
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x10078f85
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x10079830
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x10079970
cmp dword [esp + 0x28], ebp
je 0x10079970
push edi
push 0x2800
call fcn.100842c4
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x10079893
push 8
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10083dbb
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x100798a0
push ebx
push 0x100afec4
push 0x2800
call fcn.10077a60
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10079946
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.10087b80
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x10079939
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x10079939
mov edx, dword [esp + 0x18]
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push edx
push 0x100afed8
call fcn.100795c0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x10079950
inc ebx
cmp ebx, 0x10
jl 0x100798a0
push edi
call fcn.1008438e
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10083dbb
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.10083dbb
add esp, 0x1c
ret