joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14e0c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x14e185
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xea
je 0x14e119
call fcn.00015adc
jmp 0x14e18c
mov eax, dword [ebp - 0x10]
add eax, eax
call fcn.000142b0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x14e149
call fcn.00015adc
jmp 0x14e18c
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0014c198
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14e18c
mov eax, dword [ebp - 0x14]
push eax
call fcn.00019f24
pop ecx
cmp byte [ebp - 5], 0
jne 0x14e184
mov edx, 0xb
mov eax, dword [ebp - 4]
call fcn.0014e340
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x14e198
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x14e27d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x20a
call fcn.000142b0
mov dword [ebp - 0xc], eax
mov eax, 0x20a
call fcn.000142b0
mov dword [ebp - 0x10], eax
push 0x20a
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20a
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x14e212
call fcn.00015adc
jmp 0x14e284
mov eax, dword [ebx]
lea edx, [eax + 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00017fec
mov eax, dword [ebx]
lea edx, [eax + 0x20]
mov eax, dword [ebp - 0x10]
call fcn.00017fec
mov eax, dword [ebx]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x1c], edx
mov eax, dword [ebx]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x24], edx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14e284
mov eax, dword [ebp - 0xc]
push eax
call fcn.00019f24
pop ecx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00019f24
pop ecx
cmp byte [ebp - 5], 0
jne 0x14e27c
mov edx, 0xc
mov eax, dword [ebp - 4]
call fcn.0014e340
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14e290
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0xc
call fcn.0001487c
xor edx, edx
push ebp
push 0x14e32e
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x2d1080
push esi
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x14e2f1
call fcn.00015adc
jmp 0x14e335
mov eax, dword [ebx]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x28], edx
mov eax, dword [ebx]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x2c], edx
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x30], edx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14e335
cmp byte [ebp - 5], 0
jne 0x14e32d
mov edx, 0xe
mov eax, dword [ebp - 4]
call fcn.0014e340
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x153f74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp - 8], 0
je 0x15402c
cmp esi, 1
jae 0x153fa0
mov bl, 1
jmp 0x15402c
xor eax, eax
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, edi
call fcn.00154c88
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, esi
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
sub eax, 1
sbb edx, 0
push edx
push eax
mov eax, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
sub eax, 1
sbb edx, 0
cmp edx, dword [esp + 4]
jne 0x153fe5
cmp eax, dword [esp]
pop edx
pop eax
jae 0x153fe9
jmp 0x15402c
pop edx
pop eax
jl 0x15402c
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x15402c
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x154010
cmp eax, dword [ebp - 0x20]
jne 0x15402c
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x15402c
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x154038
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 1
jae 0x15405a
mov bl, 1
jmp 0x1540e6
xor eax, eax
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, edi
call fcn.00154c88
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, esi
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
sub eax, 1
sbb edx, 0
push edx
push eax
mov eax, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
sub eax, 1
sbb edx, 0
cmp edx, dword [esp + 4]
jne 0x15409f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x1540a3
jmp 0x1540e6
pop edx
pop eax
jl 0x1540e6
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x1540e6
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x1540ca
cmp eax, dword [ebp - 0x20]
jne 0x1540e6
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1540e6
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1540f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1542ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
cmp esi, 0xffffffff
je 0x1542ae
cmp dword [ebp + 0xc], 0
jne 0x15412b
cmp dword [ebp + 8], 1
jae 0x154136
mov byte [ebp - 5], 1
jmp 0x1542ae
xor eax, eax
push ebp
push 0x1542a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [edi + 0x4c]
shl ebx, 0xb
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1a9f0]
call fcn.00018878
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, ebx
call fcn.0001487c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, edi
call fcn.00154c88
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, edi
call fcn.00154cb4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
sub eax, 1
sbb edx, 0
push edx
push eax
mov eax, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
sub eax, 1
sbb edx, 0
cmp edx, dword [esp + 4]
jne 0x1541bc
cmp eax, dword [esp]
pop edx
pop eax
jae 0x1541ca
call fcn.00015adc
jmp 0x1542ae
mov eax, ebx
xor edx, edx
cmp edx, dword [ebp - 0x14]
jne 0x1541d6
cmp eax, dword [ebp - 0x18]
ja 0x1541e4
mov eax, ebx
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
jmp 0x1541f0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push esi
call sub.kernel32.dll_SetFilePointerEx
test al, al
jne 0x154210
call fcn.00015adc
jmp 0x1542ae
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x2c]
jne 0x15421e
cmp eax, dword [ebp - 0x30]
je 0x15422a
call fcn.00015adc
jmp 0x1542ae
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x154249
call fcn.00015adc
jmp 0x1542ae
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
sbb edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jne 0x154277
cmp dword [ebp - 0x18], 1
jae 0x1541ca
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1542ae
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1a9f0]
call fcn.00018878
add esp, 4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1542d1
lea eax, [ebp - 4]
mov edx, dword [0x1a9f0]
call fcn.00018998
ret
Function at 0x160924
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0xffffffff
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x160a40
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x20000000
push 2
push 0
push 2
push 0xc0000000
mov eax, esi
call fcn.00016ce8
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x16098c
mov eax, dword [ebp + 8]
mov dword [eax], 8
call fcn.00015adc
jmp 0x160a47
mov eax, dword [edi]
call fcn.000186b0
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, ebx
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [esp + 4]
jne 0x1609b4
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x1609c3
mov eax, dword [edi]
call fcn.000186b0
mov esi, eax
jmp 0x1609c8
mov esi, dword [ebp + 0xc]
sub esi, ebx
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [edi]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x1609f5
mov eax, dword [ebp + 8]
mov dword [eax], 9
call fcn.00015adc
jmp 0x160a47
cmp esi, dword [ebp - 0xc]
je 0x160a0a
mov eax, dword [ebp + 8]
mov dword [eax], 0xa
call fcn.00015adc
jmp 0x160a47
add ebx, dword [ebp - 0xc]
mov eax, ebx
xor edx, edx
cmp edx, dword [ebp + 0x10]
jne 0x160a19
cmp eax, dword [ebp + 0xc]
jb 0x16098c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x160a47
cmp dword [ebp - 8], 0xffffffff
je 0x160a3f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x160a54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x22], 0
je 0x160b64
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x160b64
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x160b51
xor eax, eax
push ebp
push 0x160b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x48
call fcn.000142b0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
lea esi, [eax + 8]
lea edi, [edx + 0x18]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
lea esi, [eax + 0x20]
lea edi, [edx + 0x30]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
mov edx, eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x24]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x160b47
mov eax, dword [ebp - 8]
push eax
call fcn.00019f24
pop ecx
ret
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x160a86
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1644d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x164617
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x424]
movzx edx, word [edi + 8]
call fcn.00016dc8
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 4]
mov ecx, 0x164634
call fcn.00017130
lea eax, [ebp - 0x216]
xor ecx, ecx
mov edx, 0x20a
call fcn.0001487c
lea eax, [ebp - 0x420]
xor ecx, ecx
mov edx, 0x20a
call fcn.0001487c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 4]
call fcn.00016ce8
push eax
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x1645f1
mov eax, esi
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00016e5c
push dword [ebp - 4]
push 0x164648
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x420]
mov ecx, 0x105
call fcn.00016e5c
push dword [ebp - 0x42c]
push 0x164674
push dword [esi]
lea eax, [ebp - 0x428]
mov edx, 5
call fcn.00017214
mov edx, dword [ebp - 0x428]
mov eax, edi
call fcn.001646b4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16461e
lea eax, [ebp - 0x42c]
mov edx, 3
call fcn.00016c54
lea eax, [ebp - 4]
call fcn.00016c4c
ret
Function at 0x16b3c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00016c44
xor eax, eax
push ebp
push 0x16b4b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00016c5c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x16b40f
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x16b40f
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.000163bc
test eax, eax
je 0x16b418
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x16b49f
mov eax, dword [ebp - 4]
call fcn.00016ce8
mov edi, eax
push 0
push 0
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 1
jb 0x16b49f
xor edx, edx
push ebp
push 0x16b498
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
add eax, eax
call fcn.000142b0
mov dword [ebp - 8], eax
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
jne 0x16b46a
call fcn.00015adc
jmp 0x16b49f
inc eax
cmp ebx, eax
je 0x16b476
call fcn.00015adc
jmp 0x16b49f
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00017fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b49f
mov eax, dword [ebp - 8]
push eax
call fcn.00019f24
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b4bc
lea eax, [ebp - 4]
call fcn.00016c4c
ret

Function at 0x16b4c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x16b57e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x16b561
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x820
call fcn.000142b0
mov dword [ebp - 8], eax
push 0xffffffffffffffff
movzx eax, si
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x16b525
call fcn.00015adc
jmp 0x16b568
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00017fec
mov esi, dword [ebx]
lea edx, [ebp - 4]
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
call fcn.0002bcb4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00016c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b568
mov eax, dword [ebp - 8]
push eax
call fcn.00019f24
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b585
lea eax, [ebp - 4]
call fcn.00016c4c
ret
Function at 0x16b58c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x16b664
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00016c5c
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
cmp ebx, 1
jb 0x16b64e
xor edx, edx
push ebp
push 0x16b647
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
add eax, eax
call fcn.000142b0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x16b5fa
call fcn.00015adc
jmp 0x16b64e
lea edx, [eax + 1]
cmp ebx, edx
je 0x16b608
call fcn.00015adc
jmp 0x16b64e
mov edx, esi
mov ecx, eax
mov eax, dword [ebp - 8]
xchg edx, eax
call fcn.00016d98
mov ebx, dword [esi]
lea edx, [ebp - 4]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
call fcn.0002bcb4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00016c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b64e
mov eax, dword [ebp - 8]
push eax
call fcn.00019f24
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16b66b
lea eax, [ebp - 4]
call fcn.00016c4c
ret
Function at 0x17af20
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0xc8]
mov edx, dword [0x202b0]
call fcn.00017a08
xor eax, eax
push ebp
push 0x17b0a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 8]
xor ecx, ecx
mov edx, 0x90
call fcn.0001487c
call sub.kernel32.dll_GetUserDefaultLCID
lea edx, [ebp - 0xc8]
call fcn.0002c360
mov word [ebp - 0xc0], 0x2f
mov word [ebp - 0xbe], 0x3a
lea eax, [ebp - 0xb4]
mov edx, 0x17b0c0
call fcn.00016cb0
lea eax, [ebp - 0xa4]
mov edx, 0x17b0e4
call fcn.00016cb0
lea eax, [ebx + 0xc]
mov edx, 0x17b104
call fcn.00016c5c
lea eax, [ebp - 0xd8]
call fcn.0012947c
lea esi, [ebp - 0xd8]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x25], 0
mov byte [ebx + 0x51], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
lea ecx, [ebp - 0xc8]
lea edx, [ebx + 0x68]
mov eax, 0x17b124
call fcn.00029424
lea ecx, [ebp - 0xc8]
lea edx, [ebx + 0x70]
mov eax, 0x17b124
call fcn.00029424
mov byte [ebx + 0x78], 0
lea eax, [ebx + 0x7c]
xor edx, edx
call fcn.00016c5c
lea eax, [ebx + 0x80]
xor edx, edx
call fcn.00016c5c
lea eax, [ebx + 0x84]
xor edx, edx
call fcn.00016c5c
lea eax, [ebx + 0x88]
xor edx, edx
call fcn.00016c5c
lea eax, [ebx + 0x8c]
xor edx, edx
call fcn.00016c5c
mov byte [ebx + 0xf9], 0
lea eax, [ebp - 0xd8]
call fcn.0012947c
lea esi, [ebp - 0xd8]
lea edi, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xd8]
call fcn.0012947c
lea esi, [ebp - 0xd8]
lea edi, [ebx + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b0ac
lea eax, [ebp - 0xc8]
mov edx, dword [0x202b0]
call fcn.00017ae0
ret
Function at 0x17b25c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
xor edx, edx
call fcn.00016c5c
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, 4
mov eax, ebx
call fcn.0017ce20
xor eax, eax
push ebp
push 0x17b313
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
call sub.advapi32.dll_GetUserNameW
cmp dword [ebp - 8], 1
jae 0x17b2b9
mov edx, 5
mov eax, ebx
call fcn.0017ce20
call fcn.00015adc
jmp 0x17b31a
mov eax, dword [ebp - 8]
add eax, eax
call fcn.000142b0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x17b2ef
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00017fec
mov edx, 6
mov eax, ebx
call fcn.0017ce20
jmp 0x17b2fb
mov edx, 5
mov eax, ebx
call fcn.0017ce20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b31a
mov eax, dword [ebp - 4]
push eax
call fcn.00019f24
pop ecx
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret