joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012e8a
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10012eb6
call fcn.100126e4
test eax, eax
jne 0x10012eb6
pop edi
pop esi
pop ebx
leave
ret 0xc
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, ebx
je 0x10012ed6
cmp esi, 0xffffffff
jne 0x10012eee
cmp dword [ebp - 8], ebx
jne 0x10012ee2
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
call fcn.1000a76d
mov eax, ebx
jmp 0x10012eaf
mov edi, dword [ebp + 0x10]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10012f12
cmp dword [ebp - 4], edi
jne 0x10012f12
xor ebx, ebx
inc ebx
jmp 0x10012ee2
cmp dword [ebp - 8], ebx
jne 0x10012ee2
or dword [ebp - 0xc], 0xffffffff
cmp esi, 0xffffffff
je 0x10012f2b
cmp esi, ebx
je 0x10012f2b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
jmp 0x10012edc

Function at 0x1001317a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.1002bdc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
call fcn.100130e3
mov eax, 0x179b06cc
xor ecx, ecx
push esi
movzx edx, byte [ebp + ecx - 0x80]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10057180]
inc ecx
cmp ecx, 0x24
jl 0x100131c2
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
not eax
pop esi
call fcn.10029677
add ebp, 0x88
leave
ret
Function at 0x10013257
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 8], eax
movsx eax, byte [ebp + 8]
push ebx
push esi
push edi
push eax
push str.__c:
lea esi, [ebp - 0x60]
call fcn.100141ea
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x10013289
mov eax, dword [eax + 4]
jmp 0x1001328c
add eax, 4
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov ebx, eax
push 1
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x40], ebx
call fcn.10001d94
cmp ebx, esi
je 0x100132ba
cmp ebx, 0xffffffff
jne 0x100132d4
lea eax, [ebp - 0x40]
call fcn.1000a76d
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret
push 0x28
pop edx
push 9
pop ecx
xor eax, eax
push esi
mov dword [ebp - 0x3c], edx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push edx
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10013320
or esi, 0xffffffff
lea eax, [ebp - 0x40]
call fcn.1000a76d
mov eax, esi
jmp 0x100132c5
mov esi, dword [ebp - 0x20]
jmp 0x10013314

Function at 0x10013325
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x420], eax
test ebx, ebx
je 0x100133b0
test eax, eax
je 0x100133b0
cmp word [ebx + 2], 0x3a
jne 0x100133b0
mov ax, word [ebx]
push edi
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov esi, 0x208
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop edi
test eax, eax
jbe 0x100133b0
push esi
add ebx, 4
push ebx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push esi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
inc eax
jmp 0x100133b2
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret 4
Function at 0x10013735
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10055330]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.10013bc2
push esi
test eax, eax
je 0x100137c2
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1002bdc0
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x100137b9
cmp esi, 0xffffffff
je 0x100137b9
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x100137b5
push edi
lea eax, [esp + 0xc]
push eax
call fcn.10013bc2
test eax, eax
je 0x100137b9
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1001379b
lea eax, [esp + 4]
call fcn.1000a76d
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.10029677
mov esp, ebp
pop ebp
ret 4

Function at 0x100137d7
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 8
mov eax, 0x1004096a
call fcn.1002a641
mov eax, dword [ebp + 0x238]
mov dword [ebp - 0x14], eax
test edi, edi
je 0x1001386c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x10013864
cmp esi, 0xffffffff
je 0x10013864
push 0x228
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp], 0x22c
call fcn.1002bdc0
add esp, 0xc
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10013860
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x10013864
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10013849
lea eax, [ebp - 0x10]
call fcn.1000a76d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.10029677
add ebp, 0x230
leave
ret 4

Function at 0x10013891
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 8], ebx
jne 0x100138a7
xor eax, eax
jmp 0x10013921
push 0x40
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.1002bdc0
add esp, 0xc
cmp esi, ebx
jne 0x100138ce
xor eax, eax
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x14], ebx
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
call fcn.100122f2
mov edi, eax
lea eax, [ebp - 0x14]
push eax
neg esi
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
sbb esi, esi
and esi, 0xf8000000
add esi, 0x8000000
push esi
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10013919
push dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001231f
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10013a56
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x10013a6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.1001397b
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x10013b6b
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.100137d7
cmp dword [ebp - 0x14], esi
je 0x10013a66
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x10013aab
cmp eax, 0xffffffff
jne 0x10013ab7
lea eax, [ebp - 0x10]
call fcn.1000a76d
mov eax, esi
jmp 0x10013a68
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10013aab
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10013b61
mov edi, dword [ebp + 8]
call fcn.100122f2
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.1002bdc0
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x44], ax
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x48], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10013b50
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
call ebx
push dword [ebp + 8]
call fcn.1001231f
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x10013aab
Function at 0x10014567
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041eb3
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.1003ce70
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov esi, ecx
mov dword [ebp - 0x202c], edi
call fcn.10026cc0
xor ebx, ebx
push esi
inc ebx
lea esi, [ebp - 0x2024]
mov dword [ebp - 0x202c], ebx
call fcn.10012084
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2020], edi
je 0x1001467c
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.1002bdc0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x10014666
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push eax
lea esi, [ebp - 0x2048]
call fcn.10001b24
mov eax, esi
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp - 0x2028]
call fcn.10014a18
push edi
push 1
mov byte [ebp - 4], 1
call fcn.10001e8c
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], 0x1000
call ebx
test eax, eax
je 0x10014618
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x2020], edi
je 0x1001469a
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10029677
leave
ret

Function at 0x10014708
Capabilities:
Check if file exists
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], 3
push edi
mov edi, eax
jbe 0x10014724
cmp dword [ebp + 0x10], esi
ja 0x100147c2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100147c2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp edi, esi
jne 0x1001476e
cmp ebx, esi
je 0x100147c2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..sys
push ebx
call edi
test eax, eax
jne 0x1001475f
xor edi, edi
inc edi
jmp 0x1001476e
push str..exe
push ebx
call edi
test eax, eax
jne 0x100147c2
push 0x10
pop edi
push 0xf003f
push esi
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100147ba
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push 1
push dword [ebp + 0x10]
push edi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
call fcn.100146e8
xor eax, eax
cmp dword [ebp - 8], esi
setne al
jmp 0x100147c4
lea eax, [ebp - 0xc]
call fcn.100146e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100147cb
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x1001482a
push 0xf003f
push edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x10014822
push 0x10
push dword [ebp + 8]
lea esi, [ebp - 0xc]
call fcn.100146ba
cmp dword [ebp - 0xc], edi
je 0x10014822
push edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1001481f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10014822
xor edi, edi
inc edi
lea eax, [ebp - 0xc]
call fcn.100146e8
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x10014896
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x100148e4
push 0xf003f
push edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x100148dc
push 0x10000
push dword [ebp + 8]
lea esi, [ebp - 0xc]
call fcn.100146ba
cmp dword [ebp - 0xc], edi
je 0x100148dc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
lea eax, [ebp - 0xc]
call fcn.100146e8
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x100148ec
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 8], edi
je 0x10014951
push 4
push edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x10014949
push 4
push dword [ebp + 8]
lea esi, [ebp - 0xc]
call fcn.100146ba
cmp dword [ebp - 0xc], edi
je 0x10014949
push 6
mov dword [ebp - 0x28], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10014949
cmp dword [ebp - 0x24], 4
jne 0x10014949
inc ebx
lea eax, [ebp - 0xc]
call fcn.100146e8
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x100166f6
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push 0x43c
mov eax, 0x10043041
call fcn.1002a6aa
call fcn.100133c2
mov dword [ebp - 0x440], eax
call fcn.10012f30
mov dword [ebp - 0x444], eax
call fcn.1001667e
mov ebx, eax
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
mov dword [ebp - 0x448], ebx
call fcn.1002bdc0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x420]
push eax
xor ecx, ecx
call fcn.10012cec
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x100167c4
cmp word [0x10058c20], ax
je 0x1001679d
push esi
push 0x10058c20
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x448]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x100167c4
lea eax, [ebp - 0x420]
push eax
push str.file_not_found:__s
call fcn.10025121
pop ecx
pop ecx
xor eax, eax
jmp 0x10016946
xor eax, eax
push edi
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.1002bdc0
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, str.driverspoflt64.sys
cmp dword [ebp - 0x444], edi
jne 0x10016800
mov eax, str.driverspoflt32.sys
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
je 0x1001691a
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
call fcn.10012af7
test eax, eax
jne 0x10016915
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call esi
mov ebx, eax
cmp ebx, edi
je 0x10016866
push str.upgrade_poflt_driver_succeeded
call fcn.10011995
pop ecx
jmp 0x10016931
lea eax, [ebp - 0x218]
push eax
push str.overwrite__s_failed__rename_it
call fcn.10011c6b
pop ecx
pop ecx
call fcn.1001317a
push eax
lea eax, [ebp - 0x218]
push eax
push str._s._08x.dirty
lea ecx, [ebp - 0x43c]
call fcn.1001418c
add esp, 0xc
mov dword [ebp - 4], edi
cmp dword [ebp - 0x424], 8
mov eax, dword [ebp - 0x438]
jae 0x100168b1
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea eax, [ebp - 0x218]
je 0x100168f4
push edi
push eax
lea eax, [ebp - 0x420]
push eax
call esi
mov ebx, eax
cmp ebx, edi
je 0x100168e6
push str.upgrade_poflt_driver_succeeded
call fcn.10011995
jmp 0x10016900
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.copy_poflt_driver_failed:__d
jmp 0x100168fa
push eax
push str.rename__s_failed
call fcn.10011c6b
pop ecx
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push 1
lea esi, [ebp - 0x43c]
call fcn.10001e8c
jmp 0x10016931
xor ebx, ebx
inc ebx
jmp 0x10016931
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
cmp dword [ebp - 0x440], edi
je 0x10016944
push dword [ebp - 0x440]
call fcn.10013402
mov eax, ebx
call fcn.1002a72d
ret
Function at 0x1001694c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x21c], eax
call fcn.10012f30
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.1002bdc0
add esp, 0xc
call fcn.1001667e
mov ecx, dword [ebp - 0x21c]
mov edi, eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x214]
push eax
mov ebx, edi
call fcn.10012cec
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x214]
push eax
call ebx
test eax, eax
jne 0x100169ff
cmp word [0x10058c20], ax
je 0x100169f2
push esi
push 0x10058c20
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x214]
push eax
call ebx
test eax, eax
je 0x10016a2d
call fcn.100133c2
cmp dword [ebp - 0x218], 0
mov eax, str.poflt64.sys
jne 0x10016a3e
mov eax, str.poflt32.sys
mov ecx, str.poflt32
push eax
lea edx, [ebp - 0x214]
call fcn.1002815f
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret 4
mov ecx, str.poflt64
jmp 0x10016a1c

Function at 0x100230f7
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
mov esi, ecx
call fcn.1002bdc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logs_accelerator
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call fcn.10001b24
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10029677
add ebp, 0x190
leave
ret

Function at 0x10023170
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
mov esi, ecx
call fcn.1002bdc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call fcn.10001b24
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10029677
add ebp, 0x190
leave
ret
Function at 0x100231e9
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x1004171a
call fcn.1002a641
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.1002bdc0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x10023255
push str.projonepodlp
jmp 0x10023263
cmp dword [ebp + 0x234], 2
jne 0x10023282
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x1002327c
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
push eax
jmp 0x100232d5
cmp dword [ebp + 0x234], ebx
jne 0x100232d0
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.100231e9
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x100232a8
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x100232cc
push 2
push edi
call fcn.100231e9
add esp, 0xc
push ebx
push 1
lea esi, [ebp]
call fcn.10001e8c
jmp 0x100232dc
push 1
jmp 0x100232b6
push 0x100489f8
mov esi, edi
call fcn.10001b24
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10029677
add ebp, 0x228
leave
ret

Function at 0x10023675
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x100236b2
cmp eax, 3
jne 0x100236ca
push ebx
call fcn.10013257
pop ecx
cmp eax, 0xffffffff
je 0x100236d7
cmp eax, 7
jne 0x100236ca
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x100236d9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10029677
leave
ret