joyce8/EMBER2024-capa huggingface dataset:
Function at 0x704468
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x7044cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
call sub.kernel32.dll_GetACP
push eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040c8d8
mov eax, dword [ebp - 0x14]
pop edx
call fcn.004306e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7044d3
lea eax, [ebp - 0x14]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x705264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7052fc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00439d54
cmp eax, 2
jne 0x7052a4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x7052dc
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040c534
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040c0ac
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040c30c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x705303
lea eax, [ebp - 8]
call fcn.0040b8fc
lea eax, [ebp - 4]
call fcn.0040b8d8
pop eax
jmp eax

Function at 0x7056a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040c824
mov edx, eax
mov eax, ebx
call fcn.007050cc
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.007051a8
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x705716
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x705c44
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x705cf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x705ce0
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040c9b0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x705ce0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x705d08
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x705ce0
cmp dword [ebp - 0xc], 0x34
jne 0x705ce0
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x705cff
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7077d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x707a6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00705d0c
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x8d632c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x8d6330], eax
mov eax, dword [ebp - 0x24]
mov dword [0x8d6334], eax
call fcn.00439d54
cmp eax, 2
sete byte [0x8d5b05]
push 0x707a78
call sub.kernel32.dll_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.00705c14
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x8d5b05], 0
jne 0x70785f
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00705c44
test al, al
je 0x70785f
mov eax, dword [ebp - 0x4c]
mov dword [0x9780ec], eax
jmp 0x707866
xor eax, eax
mov dword [0x9780ec], eax
call fcn.00705ec8
and eax, 0x7f
cmp eax, 0x1e
ja case.0x707877.0
jmp dword [eax*4 + 0x70787e]
mov byte [0x8d5b00], 1
jmp case.0x707877.0
mov byte [0x8d5b01], 1
jmp case.0x707877.0
mov byte [0x8d5b02], 1
jmp case.0x707877.0
mov byte [0x8d5b03], 1
jmp case.0x707877.0
mov byte [0x8d5b04], 1
jmp case.0x707877.0
mov byte [0x8d5b06], 1
mov byte [0x8d5b07], 1
jmp case.0x707877.0
mov byte [0x8d5b06], 1
mov byte [0x8d5b08], 1
jmp case.0x707877.0
mov byte [0x8d5b06], 1
mov byte [0x8d5b08], 1
mov byte [0x8d5b09], 1
jmp case.0x707877.0
mov byte [0x8d5b0a], 1
jmp case.0x707877.0
mov byte [0x8d5b0b], 1
jmp case.0x707877.0
mov byte [0x8d5b0c], 1
jmp case.0x707877.0
mov byte [0x8d5b0d], 1
jmp case.0x707877.0
mov byte [0x8d5b0e], 1
jmp case.0x707877.0
mov byte [0x8d5b0f], 1
jmp case.0x707877.0
mov byte [0x8d5b10], 1
jmp case.0x707877.0
mov byte [0x8d5b11], 1
jmp case.0x707877.0
mov byte [0x8d5b12], 1
jmp case.0x707877.0
mov byte [0x8d5b13], 1
jmp case.0x707877.0
mov byte [0x8d5b14], 1
jmp case.0x707877.0
mov byte [0x8d5b15], 1
jmp case.0x707877.0
mov byte [0x8d5b16], 1
jmp case.0x707877.0
mov byte [0x8d5b17], 1
jmp case.0x707877.0
mov byte [0x8d5b18], 1
jmp case.0x707877.0
mov byte [0x8d5b19], 1
jmp case.0x707877.0
mov byte [0x8d5b1a], 1
jmp case.0x707877.0
mov byte [0x8d5b1b], 1
jmp case.0x707877.0
mov byte [0x8d5b1c], 1
jmp case.0x707877.0
mov byte [0x8d5b1d], 1
jmp case.0x707877.0
mov byte [0x8d5b1e], 1
jmp case.0x707877.0
mov byte [0x8d5b1f], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x707a73
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x70e660
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov ebx, edx
lea esi, [ebp - 0x2c]
xor edx, edx
push ebp
push 0x70e86a
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x70e695
call fcn.0043b224
xor edx, edx
push ebp
push 0x70e859
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x14
mov eax, ebx
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x70e6c4
call fcn.0043b224
xor edx, edx
push ebp
push 0x70e839
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e6f8
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e6f1
call fcn.0043b224
mov dword [esi + 4], 1
mov eax, dword [esi + 4]
cmp eax, 1
je 0x70e770
cmp eax, 3
je 0x70e770
mov byte [ebp - 1], 1
call fcn.0040b014
call fcn.0040b014
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e874
mov eax, 0xcccccccd
mul dword [esi + 0x18]
shr edx, 3
mov ebx, edx
cmp ebx, 0x3e8
jge 0x70e73c
mov ebx, 0x3e8
jmp 0x70e749
cmp ebx, 0x2710
jle 0x70e749
mov ebx, 0x2710
push ebx
call sub.kernel32.dll_Sleep
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e770
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e776
call fcn.0043b224
jmp 0x70e776
cmp dword [esi + 4], 3
je 0x70e720
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x70e793
call fcn.0043b224
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e812
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e7b2
call fcn.0043b224
mov dword [esi + 4], 1
jmp 0x70e812
mov eax, 0xcccccccd
mul dword [esi + 0x18]
shr edx, 3
mov ebx, edx
cmp ebx, 0x3e8
jge 0x70e7d7
mov ebx, 0x3e8
jmp 0x70e7e4
cmp ebx, 0x2710
jle 0x70e7e4
mov ebx, 0x2710
push ebx
call sub.kernel32.dll_Sleep
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e812
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e809
call fcn.0043b224
mov dword [esi + 4], 1
jmp 0x70e818
cmp dword [esi + 4], 2
je 0x70e7bb
cmp dword [esi + 4], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70e840
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x70e880
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
xor eax, eax
push ebp
push 0x70e922
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x70e911
push 0x24
mov eax, esi
call fcn.0040c824
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x70e90b
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x70e905
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e905
jmp 0x70e8ff
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e905
cmp edi, dword [ebp - 8]
ja 0x70e905
cmp dword [ebp - 0x18], 1
jne 0x70e8e0
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x18], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e92e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x70e938
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x70e9be
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi], 0
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov dword [ebp - 0x1c], 1
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x70e9b4
push 4
mov eax, esi
call fcn.0040c824
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x70e9ae
mov byte [edi], 1
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e9a8
cmp dword [ebp - 0x1c], 4
mov eax, dword [ebp - 4]
sete byte [eax]
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e9c8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x70f240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x70f3da
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edi, eax
xor edx, edx
mov eax, 2
call fcn.005fd0b0
mov esi, eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.005fd0d0
mov ebx, eax
jmp 0x70f3a4
cmp edi, dword [ebp - 0x22c]
je 0x70f395
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c8d8
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00431214
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0042f6d4
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.0042f6d4
mov edx, dword [ebp - 0x244]
pop eax
call fcn.0040cc24
je 0x70f37a
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c8d8
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.0042f6d4
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.0042f6d4
mov edx, dword [ebp - 0x250]
pop eax
call fcn.0040cc24
jne 0x70f395
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.005fd0f0
mov ebx, eax
test ebx, ebx
jne 0x70f2c9
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70f3e1
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x70fde4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x70fe15
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
jmp 0x70fe1c
mov eax, ebx
call fcn.0040b8b4
add esp, 0x204
pop ebx
ret
Function at 0x70fe60
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x70ff79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.00408280
mov dword [ebp - 0x40], 0x40
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0x44]
call fcn.007101ec
mov edx, dword [ebp - 0x44]
mov eax, dword [0x8dc888]
call fcn.0040bca4
mov eax, dword [0x8dc318]
mov edx, dword [ebp - 0x38]
mov dword [eax], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 4], edx
mov eax, dword [0x8dc318]
mov edx, dword [eax + 4]
mov eax, dword [eax]
test edx, edx
jge 0x70fed8
neg eax
adc edx, 0
neg edx
mov ecx, dword [0x8dc318]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [0x8dcb3c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x8dcb3c]
mov edx, dword [eax + 4]
mov eax, dword [eax]
test edx, edx
jge 0x70ff08
neg eax
adc edx, 0
neg edx
mov ecx, dword [0x8dcb3c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov ecx, dword [0x8dcc30]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
sub edx, 0x80000000
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fadd qword [0x70ff84]
fdiv dword [0x70ff8c]
call fcn.00407cd8
mov ecx, dword [0x8dd6d8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70ff80
lea eax, [ebp - 0x44]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x70ff90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x710180
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x70ffc4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bcec
jmp 0x70ffd3
lea edx, [ebp - 4]
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e982c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x71019c
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x70ffff
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov eax, dword [ebp - 0x20]
mov edx, 0x7101ac
call fcn.0040cc24
jne 0x71003a
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x7101ac
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x710066
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x7101c0
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x710092
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov eax, dword [ebp - 4]
test eax, eax
je 0x71009c
mov eax, dword [eax - 4]
inc eax
call fcn.00431920
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00431660
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.0040b8b4
test edi, edi
jle 0x710159
lea eax, [edi + 1]
call fcn.00431920
mov esi, eax
push esi
push edi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x710152
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x7101c4
push esi
call sub.version.dll_VerQueryValueW
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [edi + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [edi + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x7101d4
call fcn.00431adc
mov eax, esi
call fcn.00431960
mov eax, ebx
call fcn.00431960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x710187
lea eax, [ebp - 0x20]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7104dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x71067c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
mov edx, 0x710698
call fcn.0040bcec
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x710528
bt dword [ebp - 0xc], eax
jae 0x71062f
mov edx, ebx
add dx, 0x61
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x710547
mov eax, edx
and ax, 0xffdf
mov esi, eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.0040c844
push dword [ebp - 0x24]
push 0x7106a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
push dword [ebp - 4]
lea edx, [ebp - 0x28]
mov eax, esi
call fcn.007109e8
push dword [ebp - 0x28]
push 0x7106a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.007103f0
test al, al
jne 0x7105d6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
call fcn.004304a4
push dword [ebp - 0x2c]
push 0x7106a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x30]
call fcn.004304a4
push dword [ebp - 0x30]
push 0x7106a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
lea eax, [ebp - 4]
mov edx, 0x7106b8
call fcn.0040ca34
inc ebx
cmp ebx, 0x1a
jne 0x71051d
cmp dword [ebp - 4], 0
jne 0x71064c
lea eax, [ebp - 4]
mov edx, 0x7106c8
call fcn.0040bcec
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040bca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x710683
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x7106cc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, eax
mov eax, ebx
mov edx, 0x710734
call fcn.0040bca4
push esp
push 0
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [esp], 0
je 0x710720
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x710720
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x210
pop ebx
ret
Function at 0x7109e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x710ae8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
push ebp
push 0x710aa6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040c844
lea eax, [ebp - 0x18]
mov edx, 0x710b04
call fcn.0040ca34
mov eax, dword [ebp - 0x18]
call fcn.0040c824
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x710a9c
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 0xc]
mov edx, 4
call fcn.0043060c
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0043060c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
pop ecx
call fcn.0040ca8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x710ab8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040bca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x710aef
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x715f88
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x716060
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bcec
lea eax, [ebp - 4]
call fcn.0040be90
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x716048
mov eax, ebx
call fcn.00407160
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x716041
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x716029
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x716070
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x716029
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x716048
mov eax, dword [ebp - 0x10]
call fcn.0040717c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x716067
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax