joyce8/EMBER2024-capa huggingface dataset:
Function at 0x625c6640
Capabilities:
Get file version info

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x5c], eax
test byte [0x625d3028], 8
jne 0x625c67c8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.version.dll_GetFileVersionInfoSizeW]
sub esp, 8
test eax, eax
jne 0x625c66b0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp], eax
mov dword [ebp - 0x60], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x60]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 8], edx
mov dword [esp], edi
call dword [sym.imp.version.dll_GetFileVersionInfoW]
sub esp, 0x10
test eax, eax
je 0x625c6810
lea eax, [ebp - 0x58]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x625d5dcc
mov dword [esp], ebx
call dword [sym.imp.version.dll_VerQueryValueW]
sub esp, 0x10
test eax, eax
je 0x625c6810
mov eax, dword [ebp - 0x58]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], str._d._d._d._d
mov dword [esp + 4], 0x1e
mov ecx, edx
xor edx, edx
mov esi, edx
mov edi, ecx
xor edx, edx
add esi, eax
movzx eax, ax
adc edi, edx
mov dword [esp + 0x18], eax
mov eax, esi
shrd eax, edi, 0x10
movzx eax, ax
mov dword [esp + 0x14], eax
movzx eax, di
mov dword [esp + 0x10], eax
mov eax, edi
lea edi, [ebp - 0x54]
shr eax, 0x10
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sym._swprintf
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], edi
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov esi, dword [ebp - 0x5c]
sub esp, 4
mov dword [esi], eax
test byte [0x625d3028], 8
je 0x625c669a
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.version_s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.filesys_GetFileVersion
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c669a
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_1
mov esi, dword [ebp - 0x5c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], str._p__s__p_n
mov dword [esp + 8], str.filesys_GetFileVersion
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c666c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x625c6684
Function at 0x625c68e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625c6930
test ebx, ebx
je 0x625c6961
mov eax, dword [esi + 8]
mov dword [esp], eax
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
cmp eax, 1
mov dword [ebx], eax
sbb eax, eax
and eax, 0x8007000e
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [esi - 0xc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.folder_get_Path
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c6901
mov eax, 0x80004003
jmp 0x625c6920

Function at 0x625c6970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625c6a08
test esi, esi
je 0x625c6a3c
mov edi, dword [ebx + 8]
mov dword [esi], 0
mov dword [esp], 0x18
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x625c6a53
mov dword [eax + 0xc], sym._foldercoll_QueryInterface_12
mov dword [eax + 0x10], 1
mov dword [esp], edi
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebx + 0x14], eax
sub esp, 4
test eax, eax
je 0x625c6a43
lea edi, [ebx + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], 0x625d7950
call sym._init_classinfo
mov dword [esi], edi
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebx - 0xc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.folder_get_SubFolders
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c6992
mov eax, 0x80004003
jmp 0x625c69f6
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, 0x8007000e
jmp 0x625c69f6
mov eax, 0x8007000e
jmp 0x625c69f6

Function at 0x625c6ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
test byte [0x625d3028], 8
jne 0x625c6cc8
mov dword [ebx], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 8
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.filesys_GetTypeInfoCount
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov dword [ebx], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x625c6f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c6f68
mov eax, 0x80004001
ret 0x18
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.drivecoll_get_Item
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 0x18

Function at 0x625c72d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
test byte [0x625d3028], 8
jne 0x625c72f8
mov dword [ebx], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 8
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0x625d5e28
sub eax, 0xc
mov dword [esp + 8], str.drive_GetTypeInfoCount
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov dword [ebx], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 8

Function at 0x625c74d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c74e8
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.__p_____s_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.drive_put_VolumeName
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c7540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7558
mov eax, 0x80004001
ret 0xc
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0x10]
call sym._wine_dbgstr_wn.constprop.0_1
mov ebx, eax
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str._p__s__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.filesys_MoveFolder
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov ebx, dword [ebp - 4]
mov eax, 0x80004001
leave
ret 0xc

Function at 0x625c7710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7728
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.__p_____s_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_put_Name
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8
Function at 0x625c79c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c79d8
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_get_DateCreated
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c7a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7a38
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_get_DateLastModified
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c7a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7a98
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_get_DateLastAccessed
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c7ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7af8
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_get_Type
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c7b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
test byte [0x625d3028], 1
jne 0x625c7b60
leave
mov eax, 0x80004001
ret 8
cwde
mov dword [esp + 0xc], str.__p_____x_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.folder_Delete
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8
Function at 0x625c7ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 0x10]
test byte [0x625d3028], 1
jne 0x625c7bc8
mov ebx, dword [ebp - 4]
mov eax, 0x80004001
leave
ret 0xc
mov eax, dword [ebp + 0xc]
movsx ebx, bx
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__p_____s__x_:_stub_n
sub eax, 0xc
mov dword [esp + 8], str.folder_Copy
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov ebx, dword [ebp - 4]
mov eax, 0x80004001
leave
ret 0xc

Function at 0x625c7f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c7f28
mov eax, 0x80004001
ret 0x18
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.foldercoll_get_Item
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 0x18

Function at 0x625c7f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
lea eax, [edi - 0xc]
mov dword [ebp - 0x1c], eax
test byte [0x625d3028], 8
jne 0x625c7ff0
test esi, esi
je 0x625c8021
mov dword [esi], 0
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x625c8028
mov dword [eax], sym._enumvariant_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 4]
mov dword [esi], ebx
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.foldercoll_get__NewEnum
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c7f98
mov eax, 0x80004003
jmp 0x625c7fe2
mov eax, 0x8007000e
jmp 0x625c7fe2

Function at 0x625c8500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c8518
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.file_get_ShortName
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8
Function at 0x625c8560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c8578
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.file_get_Drive
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c85c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c85d8
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.file_get_ParentFolder
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c88f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c8908
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.textstream_get_Line
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c8950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x625d3028], 1
jne 0x625c8968
mov eax, 0x80004001
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p_____p_:_stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.textstream_get_Column
sub eax, 0xc
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 8

Function at 0x625c9260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x625d3028], 8
jne 0x625c92c0
test esi, esi
je 0x625c9307
mov eax, dword [ebx + 8]
cmp eax, 2
je 0x625c92f8
cmp eax, 8
je 0x625c92f8
mov ecx, dword [ebx + 0x20]
xor eax, eax
test ecx, ecx
jne 0x625c92b0
mov word [esi], ax
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8
mov edx, dword [ebx + 0x28]
xor eax, eax
test edx, edx
sete al
neg eax
jmp 0x625c9298
lea eax, [ebx - 0xc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.textstream_get_AtEndOfStream
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c927a
mov ebx, 0xffffffff
mov eax, 0x800a0036
mov word [esi], bx
jmp 0x625c929d
mov eax, 0x80004003
jmp 0x625c929d
Function at 0x625c9400
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x498
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625c9510
test esi, esi
je 0x625c956e
mov dword [esi], 0
mov eax, dword [ebx + 8]
lea edi, [ebp - 0x268]
lea ebx, [ebp - 0x470]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp], ebx
mov dword [esp + 4], 0x625d5ea6
call dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp], ebx
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov ebx, eax
cmp eax, 0xffffffff
jne 0x625c9494
jmp 0x625c9548
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x625c94e0
test byte [ebp - 0x268], 0x10
je 0x625c9480
lea eax, [ebp - 0x23c]
mov dword [esp + 4], 0x625d5dd4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x625c9480
lea eax, [ebp - 0x23c]
mov dword [esp + 4], 0x625d5dda
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x625c9480
inc dword [esi]
jmp 0x625c9480
mov dword [ebp - 0x47c], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
mov edx, dword [ebp - 0x47c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebx - 0xc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.foldercoll_get_Count
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c9429
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
movzx eax, dx
or eax, 0x80070000
test edx, edx
cmovg edx, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov edx, 0x80004003
jmp 0x625c94f8
Function at 0x625c9e20
Capabilities:
Contain obfuscated stackstrings
Get disk size

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625c9ee0
test ebx, ebx
je 0x625c9f1f
lea eax, [ebp - 0x20]
add esi, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x625c9f18
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x625c9ea8
mov eax, dword [ebp - 0x20]
test eax, eax
js 0x625c9ea8
mov edx, 3
mov dword [ebx + 8], eax
xor eax, eax
mov word [ebx], dx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, 5
add ebx, 8
mov word [ebx - 8], cx
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.oleaut32.dll_VarR8FromUI8]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [esi - 0xc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.drive_get_TotalSize
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c9e45
mov eax, 0x80004005
jmp 0x625c9ece
mov eax, 0x80004003
jmp 0x625c9ece

Function at 0x625c9f30
Capabilities:
Get disk size

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625c9ff0
test ebx, ebx
je 0x625ca02f
lea eax, [ebp - 0x20]
add esi, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x625ca028
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x625c9fb8
mov eax, dword [ebp - 0x20]
test eax, eax
js 0x625c9fb8
mov edx, 3
mov dword [ebx + 8], eax
xor eax, eax
mov word [ebx], dx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, 5
add ebx, 8
mov word [ebx - 8], cx
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.oleaut32.dll_VarR8FromUI8]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [esi - 0xc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.drive_get_AvailableSpace
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625c9f55
mov eax, 0x80004005
jmp 0x625c9fde
mov eax, 0x80004003
jmp 0x625c9fde