joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1175b570
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11772586
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.1168b120
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.1168b120
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1175b6a9
mov edx, dword [0x117912a4]
mov cx, word [0x117912a8]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11684ff0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.1168b6c0
mov edx, dword [0x11773dfc]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.11685a10
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.1168b6c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11685790
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11685790
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1175b5cb
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x11765f40
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x11766026
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x11765fb3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x1176600a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x11765fc6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x11765ff6
mov ebx, 0x3d
jmp 0x11766004
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x11765f5a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x117667a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.116c0e00
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x117668f4
cmp ebx, 0x80
jg 0x117668f4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.117670b0
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x11766837
test ebp, ebp
jle 0x11766885
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x11766824
jmp 0x11766881
xor esi, esi
test ebp, ebp
jle 0x11766885
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x11766867
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x11766863
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x11766894
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x117668c5
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x117668dc
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x117668d8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call fcn.00401390
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004099d0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004015fe
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40d3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x445850]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d4ac
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40d4c1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40d480
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40d418
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40d428
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40d473
test edx, edx
jne 0x40d466
test ecx, ecx
je 0x40d410
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40d4d0
cmp eax, 8
je 0x40d410
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40d402
call fcn.0040cda0
mov eax, dword [0x445850]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40d3f4
call fcn.0040d040
mov eax, dword [0x445850]
jmp 0x40d3f4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040d340
cmp eax, 7
jne 0x40d46b
mov eax, dword [0x445850]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d523
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40d54e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40d52f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040cda0
mov eax, dword [0x445850]
jmp 0x40d501
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d512
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d512
call fcn.0040d040
mov eax, dword [0x445850]
jmp 0x40d508
Function at 0x10001030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10001067
lea ecx, [ebp - 4]
push ecx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100010d7
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call edi
mov eax, dword [ebp - 8]
cmp eax, 2
jb 0x100010cd
add eax, 2
mov dword [ebp - 8], eax
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000fa77
mov esi, eax
add esp, 4
test esi, esi
je 0x100010cd
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call edi
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100010f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1000112c
lea ecx, [ebp - 4]
push ecx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10001160
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x100017b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100017cb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001802
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100017fe
jmp 0x100017f0
cmp esi, eax
jae 0x10001802
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100017f0
cmp esi, eax
jb 0x10001809
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004460
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10126920
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10173500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
call fcn.1001064f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x100044a8
push 0x80004005
call fcn.10001cb0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov edi, 1
mov dword [ebp - 4], edi
test ebx, ebx
je 0x10004568
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100044d0
sub eax, edx
sar eax, 1
je 0x10004568
push ebx
call fcn.10003c80
add esp, 4
test eax, eax
jne 0x10004568
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100044f7
sub eax, edx
sar eax, 1
je 0x10004568
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004510
sub eax, edx
sar eax, 1
cmp eax, 0xf8
jb 0x10004568
push ebx
call fcn.10003a00
add esp, 4
test eax, eax
je 0x10004541
push ebx
lea esi, [ebp - 0x10]
call fcn.10003ad0
add esp, 4
jmp 0x1000454e
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.10004020
add esp, 8
test eax, eax
je 0x10004568
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
xor edx, edx
test eax, eax
setne dl
mov eax, edx
test eax, eax
je 0x10004568
mov dword [ebp - 0x14], edi
or edi, 0xffffffff
cmp dword [0x1017be54], 0
je 0x10004595
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
push str.COverlongPathApi::CreateDirectoryW_bChangeToLongPath__d__wstrLongPath__s_
push str.COverlongPathApi
mov ecx, edi
mov edx, 0x1017bdc4
call fcn.10005f70
add esp, 0x10
cmp dword [ebp - 0x14], 0
push 0
jne 0x100045a8
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
jmp 0x100045b4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x100045d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100052b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10125af8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10173500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.10011a38
mov dword [ebp - 4], 0
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
test eax, eax
je 0x10005343
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005343
mov ecx, dword [esi + 0x24]
push 2
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
mov dword [ebp + 8], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005320
mov ecx, dword [esi + 0x24]
sub eax, edx
push 0
sar eax, 1
lea edx, [ebp + 8]
push edx
add eax, eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10011a14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10006810
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [esi + 8], 0
jne 0x1000685b
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x100068f0
push 0
push 0
call fcn.1010396d
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x1000685b
mov ecx, dword [esi + 0x20]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x1000684b
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x10006860
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [esi + 8], 0
jne 0x10006872
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
push eax
mov dword [ebp - 8], ecx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x100068b5
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100068ba
jmp 0x100068c6
cmp eax, 1
je 0x100068c6
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10009250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x7074], 0
je 0x10009425
mov ecx, dword [esi + 0x7078]
cmp eax, ecx
jb 0x10009286
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10009425
mov ecx, dword [esi + 0x7088]
cmp eax, ecx
jb 0x100092a2
lea edx, [ecx + 0x1f4]
cmp edx, eax
jae 0x10009425
cmp eax, ecx
jae 0x100092ac
mov dword [esp + 0xc], 0x1f4
jmp 0x100092b2
sub eax, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x7070]
imul ecx, dword [esp + 0xc]
add ecx, dword [esi + 0x7068]
mov eax, 0
adc eax, dword [esi + 0x706c]
cmp eax, dword [esi + 0x7064]
jg 0x10009425
jl 0x100092e8
cmp ecx, dword [esi + 0x7060]
jae 0x10009425
mov ebx, dword [esi + 0x7054]
mov dword [esi + 0x706c], eax
mov eax, dword [esi + 0x7050]
xor edi, edi
mov dword [esi + 0x7068], ecx
mov dword [esp + 0x10], eax
test ebx, ebx
jl 0x100093bb
jg 0x10009318
test eax, eax
je 0x100093bb
mov eax, dword [esi + 0x7048]
add eax, ecx
mov ecx, dword [esi + 0x704c]
adc ecx, dword [esi + 0x706c]
push 0
push 0xffff
push ecx
push eax
call fcn.10107120
mov ecx, dword [esp + 0x10]
push ebx
push ecx
push edx
push eax
call fcn.10107160
cmp dword [0x1017be54], 0
mov edi, eax
je 0x10009374
mov edx, dword [esi + 0x7038]
push edx
push edi
push str.CIFOCMS::SetProgressBarPos__nPos_:__d__m_dwCurrentPos_:__d_
push str.ifocms
or ecx, 0xffffffff
mov edx, 0x1017bdc4
call fcn.10005f70
add esp, 0x10
cmp edi, 0xffffffff
jne 0x10009394
inc dword [esi + 0x7038]
mov eax, dword [esi + 0x160]
mov ecx, dword [esi + 0x7038]
test eax, eax
je 0x100093bb
push 0
push ecx
jmp 0x100093af
cmp edi, dword [esi + 0x7038]
je 0x100093bb
mov dword [esi + 0x7038], edi
mov eax, dword [esi + 0x160]
test eax, eax
je 0x100093bb
push 0
push edi
push 0x46a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x7088], eax
cmp dword [0x1017be54], 0
je 0x10009425
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x7048]
add ecx, dword [esi + 0x7068]
mov edx, dword [esi + 0x704c]
adc edx, dword [esi + 0x706c]
push edi
push ebx
push eax
push 0
push 0xffff
push edx
push ecx
call fcn.10107120
mov ecx, dword [esi + 0x7070]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
push str.LoadFackBar__m_dwSecondsSize_:__d___dwTickCount_:__d____I64u__I64u____d_
push str.ifocms
or ecx, 0xffffffff
mov edx, 0x1017bdc4
call fcn.10005f70
add esp, 0x24
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009430
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10173500]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10153224]
mov eax, dword [ebp + 8]
mov edx, dword [0x10153228]
mov ax, word [eax]
push esi
mov dword [ebp - 0x14], ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov si, word [ebp - 0x14]
mov edi, eax
cmp si, 0x41
je 0x10009489
cmp si, 0x42
je 0x10009489
cmp si, 0x61
je 0x10009489
cmp si, 0x62
jne 0x10009500
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.10105240
mov ecx, dword [0x1015322c]
mov dx, word [0x10153230]
add esp, 0xc
push 0x104
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov word [ebp - 8], dx
mov word [ebp - 0xc], si
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [ebp - 0x21c]
push edx
call fcn.10107d6c
lea eax, [ebp - 0x21c]
push str.floppy
push eax
call fcn.10102e29
add esp, 0xc
test eax, eax
mov eax, 2
jne 0x10009500
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101026e9
mov esp, ebp
pop ebp
ret 4