joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005ddf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 0xc], eax
test ebx, ebx
jne 0x1005de07
xor eax, eax
pop ebx
add esp, 0x40
ret
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
jne 0x1005de1b
pop edi
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x58]
xorps xmm0, xmm0
push ebp
mov ebp, dword [esp + 0x58]
push 0
movups xmmword [esp + 0x28], xmm0
push 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x30]
movq qword [esp + 0x54], xmm0
push eax
push edi
movups xmmword [esp + 0x4c], xmm0
mov dword [esp + 0x38], 0x28
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], 0x200001
mov dword [esp + 0x48], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x1005de8e
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x40
ret
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x60]
mov esi, ebp
imul esi, edx
mov dword [esp + 0x1c], eax
sub esi, 1
mov ecx, esi
js 0x1005dec0
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
mov dword [eax + ecx*4], 0x1000001
sub ecx, 1
jns 0x1005deb0
push 3
push 0
push 0
push edx
push ebp
push ebx
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
test esi, esi
js 0x1005df17
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + esi*4]
cmp ecx, 0x1000001
jne 0x1005def8
mov dword [eax + esi*4], 0
jmp 0x1005df12
cmp ecx, 1
jne 0x1005df06
mov dword [eax + esi*4], 0
jmp 0x1005df12
cmp byte [eax + esi*4 + 3], 0
jne 0x1005df12
mov byte [eax + esi*4 + 3], 0xff
sub esi, 1
jns 0x1005dee0
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], 0x1ff0000
push dword [esp + 0x10]
push eax
push ebp
push 0
push 0
push edi
push eax
push ebp
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x40]
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
push dword [esp + 0x1c]
mov esi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x40
ret
Function at 0x1006b438
Capabilities:
Check if file exists
Create directory
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x100c36e4
call fcn.1008c851
mov dword [ebp - 0x228], 0x101139f4
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
mov dword [0x101139f4], 0x100fa518
mov dword [0x10113a14], 7
mov dword [0x10113a10], esi
mov word [0x10113a00], ax
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
inc ebx
mov byte [ebp - 4], bl
push esi
push eax
mov dword [0x101139f8], esi
mov dword [0x101139fc], esi
call fcn.1008f060
add esp, 0xc
mov dword [ebp - 0x21c], esi
push 4
pop eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push str.EnableLogToView
push str.SOFTWARETencentQMDownload
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1006b4f5
mov eax, dword [0x101139f8]
cmp dword [ebp - 0x21c], ebx
cmove eax, ebx
mov dword [0x101139f8], eax
push 0x103
lea eax, [ebp - 0x218]
push eax
push str._APPDATA_TencentQMDownload_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1006b530
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1006b530
push esi
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x218]
push eax
call fcn.10001a48
pop ecx
push eax
lea eax, [ebp - 0x218]
mov edi, 0x10113a00
push eax
mov ecx, edi
call fcn.10001ddf
mov esi, str.DownloadErrLogFile.log
push esi
call fcn.10001a48
pop ecx
push eax
push esi
mov ecx, edi
call fcn.10005760
mov eax, 0x101139f4
call fcn.1008c7fb
ret
Function at 0x1006b5a5
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x800
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.1008f060
add esp, 0xc
cmp dword [esi + 8], ebx
jne 0x1006b60f
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x1006b5e7
mov eax, dword [eax]
push ebx
push 0x20
push 2
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
test eax, eax
je 0x1006b6f8
cmp eax, 0xffffffff
je 0x1006b6f8
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x1006b6f8
cmp eax, 0x100000
ja 0x1006b6f8
cmp dword [esi + 4], ebx
jne 0x1006b688
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x806]
push edi
push eax
movzx eax, word [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x80a]
push eax
movzx eax, word [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__5u___02u:_02u:_02u._03u_:__s
push 0x7fd
mov edi, 0x800
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.1006b407
add esp, 0x28
jmp 0x1006b6af
push 0x7fd
push edi
mov edi, 0x800
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.100a1251
lea eax, [ebp - 0x804]
push eax
call fcn.100a1260
add esp, 0x14
cmp eax, 3
jle 0x1006b6f8
mov word [ebp + eax - 0x804], 0xa0d
add eax, 2
mov dword [ebp - 0x818], ebx
cmp eax, edi
jae 0x1006b70b
mov byte [ebp + eax - 0x804], bl
lea eax, [ebp - 0x818]
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.100a1260
pop ecx
push eax
lea eax, [ebp - 0x804]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008bb47
mov esp, ebp
pop ebp
ret 4
call fcn.1008c026
int3
Function at 0x1006d3af
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1006d3ba
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1006d476
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
sub edi, 1
jne 0x1006d3cf
pop edi
test esi, esi
je 0x1006d492
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
inc edx
sub esi, 1
jne 0x1006d47a
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1006d499
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x100eb390]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100eb390]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x1006dbdc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, ebx
mov edx, ecx
imul edi, dword [ebp + 8]
cmp byte [esi], 0
je 0x1006dc12
push 0
lea eax, [ebp + 8]
push eax
push edi
push edx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006dc0d
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x1006dc48
xor eax, eax
mov ecx, edi
add ecx, dword [esi + 0x28]
adc eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x24]
jl 0x1006dc2e
jg 0x1006dc28
cmp ecx, dword [esi + 0x20]
jbe 0x1006dc2e
mov edi, dword [esi + 0x20]
sub edi, dword [esi + 0x28]
mov ecx, dword [esi + 0x1c]
add ecx, dword [esi + 0x28]
push edi
push ecx
push edx
call fcn.1008eae0
add esp, 0xc
mov eax, edi
add dword [esi + 0x28], edi
adc dword [esi + 0x2c], 0
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x1006e849
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1006e8d6
cmp dword [esi + 4], 0xffffffff
jne 0x1006e8d6
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.100a1544
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x1006e8a5
cmp eax, 0x2f
je 0x1006e8a5
push edi
call fcn.100a1544
pop ecx
mov ecx, 0x103
sub ecx, eax
push ecx
push 0x100d3d18
push edi
call fcn.100a161c
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.1006da8a
pop ecx
pop ecx
test eax, eax
jne 0x1006e8bd
mov eax, dword [ebp - 4]
jmp 0x1006e8db
mov ecx, eax
call fcn.1006de7f
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x1006e8db
mov eax, 0x1000000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1006ee98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x1006eeca
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1006eeca
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x1006ef95
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x1006eee7
cmp ax, 0x5c
jne 0x1006eee9
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x1006eedb
cmp esi, ebx
je 0x1006ef31
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.1008eae0
add esp, 0xc
cmp esi, 0x208
jae 0x1006efa5
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.1006ee98
xor eax, eax
mov esi, 0x103
mov word [ebp - 0x20c], ax
test edi, edi
je 0x1006ef54
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10096be9
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.100a1544
sub esi, eax
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.100a161c
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
jne 0x1006ef95
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1008bb47
mov esp, ebp
pop ebp
ret
call fcn.1008c026
int3
Function at 0x1006fe10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x14], 0
je 0x1006fe3e
call edi
mov ecx, dword [esi + 0x14]
sub eax, ecx
cmp eax, 0x2932e00
ja 0x1006fe3e
call fcn.10075b00
test eax, eax
je 0x1006fe3e
pop edi
xor eax, eax
pop esi
ret 4
call edi
lea ecx, [esi + 4]
mov dword [esi + 0x14], eax
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
ret 4

Function at 0x10070820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x10070855
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10070845
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x10070890
push 0
push 0
call fcn.100974fc
xor ecx, ecx
mov dword [esi + 4], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10071f20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x84]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push 0x80
push eax
push 0x100d3e22
push str.config1
push str.Profile
call edi
xor ecx, ecx
mov al, byte [ebp + ecx - 0x84]
inc ecx
cmp al, 0x30
jl 0x10071f72
cmp al, 0x39
jle 0x10071f84
cmp al, 0x61
jl 0x10071f7a
cmp al, 0x66
jle 0x10071f84
sub al, 0x41
cmp al, 5
ja 0x10072081
cmp ecx, 0x20
jl 0x10071f62
xor eax, eax
cmp byte [ebp + ecx - 0x84], al
sete al
test eax, eax
je 0x10072081
cmp byte [ebp - 0x84], 0
jne 0x10071faa
xor ecx, ecx
jmp 0x10071fbc
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10071fb3
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
mov ecx, ebx
push eax
call fcn.10005859
push esi
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0x100d3e22
push str.config2
push str.Profile
call edi
cmp byte [ebp - 0x84], 0
jne 0x10071ff6
xor ecx, ecx
jmp 0x10072009
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10072000
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x48]
call fcn.10005859
push esi
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0x100d3e22
push str.config3
push str.Profile
call edi
cmp byte [ebp - 0x84], 0
jne 0x10072044
xor ecx, ecx
jmp 0x10072059
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10072050
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x18]
call fcn.10005859
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bb47
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008bb47
mov esp, ebp
pop ebp
ret 8

Function at 0x10075530
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.TencentDeskUpdate
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1009715a
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
cmp word [ebp - 0x20c], ax
jne 0x100755bd
xor ecx, ecx
jmp 0x100755d5
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100755c6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.10001ddf
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008bb47
mov esp, ebp
pop ebp
ret
Function at 0x100756d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.TencentDeskUpdate
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1009715a
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
cmp word [ebp - 0x20c], ax
jne 0x1007575d
xor ecx, ecx
jmp 0x10075775
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10075766
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.10001ddf
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008bb47
mov esp, ebp
pop ebp
ret
Function at 0x10077440
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c40a6
mov eax, dword fs:[0]
push eax
mov eax, 0x1094
call fcn.1008cee0
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [edi]
mov ecx, ebx
call fcn.100773b0
mov dword [ebp - 0x109c], 0xffffffff
push 3
push 0
push ebx
lea ecx, [ebp - 0x109c]
mov dword [ebp - 4], 0
call fcn.10080310
mov esi, dword [ebp - 0x109c]
test eax, eax
jne 0x100774b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
jmp 0x10077668
push 0x1004
xorps xmm0, xmm0
mov dword [ebp - 0x101c], 0
lea eax, [ebp - 0x1018]
movq qword [ebp - 0x1024], xmm0
push 0
push eax
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x10a0], 0
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x10a0]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push 0xc
lea eax, [ebp - 0x1024]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10077533
xor edi, edi
jmp 0x10077668
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x10077554
cmp eax, 0x1000
jae 0x10077554
lea ecx, [ebp - 0x1018]
add eax, ecx
mov ecx, edi
push eax
call fcn.10077290
mov eax, dword [ebp - 0x1004]
test eax, eax
je 0x10077575
cmp eax, 0x1000
jae 0x10077575
lea ecx, [ebp - 0x1018]
add eax, ecx
mov ecx, edi
push eax
call fcn.100772d0
mov eax, dword [ebp - 0x1000]
test eax, eax
je 0x10077596
cmp eax, 0x1000
jae 0x10077596
lea ecx, [ebp - 0x1018]
add eax, ecx
mov ecx, edi
push eax
call fcn.10077310
mov eax, dword [ebp - 0x100c]
test eax, eax
je 0x100775b7
cmp eax, 0x1000
jae 0x100775b7
lea ecx, [ebp - 0x1018]
add eax, ecx
mov ecx, edi
push eax
call fcn.10077350
cmp byte [ebp - 0x100e], 0
mov eax, dword [ebp - 0xffc]
mov dword [edi + 0x64], eax
je 0x100775cf
or dword [edi + 0x68], 1
jmp 0x100775d3
and dword [edi + 0x68], 0xfffffffe
mov ecx, edi
call fcn.100767a0
cmp esi, 0xffffffff
je 0x100775ef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x109c], esi
cmp dword [edi + 0x44], 0
jne 0x10077663
push ebx
lea ecx, [ebp - 0x1098]
call fcn.100708a0
mov byte [ebp - 4], 1
call fcn.100803b0
cmp dword [ebp - 0x1054], 0
je 0x10077658
lea ecx, [edi + 4]
lea eax, [ebp - 0x1094]
cmp ecx, eax
je 0x1007762a
push 0xffffffffffffffff
push 0
push eax
call fcn.100058d2
lea ecx, [edi + 0x1c]
lea eax, [ebp - 0x107c]
cmp ecx, eax
je 0x10077641
push 0xffffffffffffffff
push 0
push eax
call fcn.100058d2
lea ecx, [edi + 0x34]
lea eax, [ebp - 0x1064]
cmp ecx, eax
je 0x10077658
push 0xffffffffffffffff
push 0
push eax
call fcn.100058d2
lea ecx, [ebp - 0x1098]
call fcn.1006f650
mov edi, 1
cmp esi, 0xffffffff
je 0x10077674
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bb47
mov esp, ebp
pop ebp
ret
Function at 0x10078550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c422e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x48], esi
mov dword [esi + 0x10], 0
jb 0x100785a8
mov eax, dword [esi]
jmp 0x100785aa
mov eax, esi
mov byte [eax], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.100759d0
mov edi, eax
mov byte [ebp - 4], 1
cmp esi, edi
je 0x10078635
cmp dword [esi + 0x14], 0x10
jb 0x10078610
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
inc eax
cmp eax, 0x1000
jb 0x10078607
test cl, 0x1f
je 0x100785e3
call fcn.10091aa1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x100785ef
call fcn.10091aa1
sub ecx, eax
cmp ecx, 4
jae 0x100785fb
call fcn.10091aa1
cmp ecx, 0x23
jbe 0x10078605
call fcn.10091aa1
mov ecx, eax
push ecx
call fcn.1008bb42
add esp, 4
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x10078628
mov eax, dword [esi]
jmp 0x1007862a
mov eax, esi
push edi
mov ecx, esi
mov byte [eax], 0
call fcn.10007941
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x10078683
mov ecx, dword [ebp - 0x40]
inc eax
cmp eax, 0x1000
jb 0x1007867a
test cl, 0x1f
je 0x10078656
call fcn.10091aa1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x10078662
call fcn.10091aa1
sub ecx, eax
cmp ecx, 4
jae 0x1007866e
call fcn.10091aa1
cmp ecx, 0x23
jbe 0x10078678
call fcn.10091aa1
mov ecx, eax
push ecx
call fcn.1008bb42
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.10075530
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100786b5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x1007870d
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
jbe 0x100786cd
call fcn.10091aa1
add eax, eax
cmp eax, 0x1000
jb 0x10078704
test cl, 0x1f
je 0x100786e0
call fcn.10091aa1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x100786ec
call fcn.10091aa1
sub ecx, eax
cmp ecx, 4
jae 0x100786f8
call fcn.10091aa1
cmp ecx, 0x23
jbe 0x10078702
call fcn.10091aa1
mov ecx, eax
push ecx
call fcn.1008bb42
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bb47
mov esp, ebp
pop ebp
ret