joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010a140
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x1010a15c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.10033deb
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.10033f7c
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.10033dce
add esp, 0x18
cmp eax, 2
jbe 0x1010a1e1
cmp word [esp + 0x10], di
jne 0x1010a1e1
cmp word [esp + 0x12], di
jne 0x1010a1e1
lea eax, [esp + 0x14]
push edi
push eax
call fcn.10033f7c
add esp, 8
test eax, eax
je 0x1010a269
add eax, 2
push edi
push eax
call fcn.10033f7c
add esp, 8
mov esi, eax
test esi, esi
je 0x1010a269
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x1010a229
test bl, 1
je 0x1010a218
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x1010a29f
cmp ebx, 0xffffffff
je 0x1010a232
test edi, edi
jne 0x1010a241
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x1010a29f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.10033f7c
mov esi, eax
add esp, 8
test esi, esi
jne 0x1010a1e9
test ebp, ebp
je 0x1010a29f
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1010a294
test al, 0x10
jne 0x1010a29f
test al, 1
je 0x1010a287
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x1010a29f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x1010da42
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocString
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1010dad2
cmp eax, ebx
je 0x1010dad2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1010dada
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1010dc85
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1010ddd7
xor edx, edx
cmp eax, edx
je 0x1010ddd7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x1010dcba
cmp eax, ecx
jb 0x1010dcba
xor ecx, ecx
jmp 0x1010dcbf
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x1010dcd9
jg 0x1010ddd7
cmp eax, dword [esi + 8]
ja 0x1010ddd7
cmp ecx, edx
jne 0x1010dcf3
cmp eax, dword [esi + 0x42c]
ja 0x1010dcf3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x1010dd38
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x1010dd13
cmp edi, edx
jb 0x1010dd13
xor edx, edx
jmp 0x1010dd18
mov edx, 1
cmp ecx, ebx
ja 0x1010dd38
cmp dword [esp + 0x14], edx
jg 0x1010dd38
jl 0x1010dd28
cmp eax, edi
ja 0x1010dd38
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.1010ddf0
test eax, eax
je 0x1010ddd7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x1010dd86
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x1010ddc7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x1010ddc7
jmp 0x1010dd96
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1010ddc7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1010ddc7
cmp dword [edi], ebp
jne 0x1010ddc7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x1010e220
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101ee4a8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1010e252
call fcn.100f41c0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1010e263
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1010e2b8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1010e29e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1010e3e4
cmp dword [esp + 0x18], ebx
jne 0x1010e2b8
cmp dword [esp + 0x14], ebx
je 0x1010e3e4
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1010e2c9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.101d2881
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1010e30f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1010e30f
call fcn.100fe6e0
test eax, eax
je 0x1010e30f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.101d2c95
push ebx
lea ecx, [esp + 0x14]
call fcn.101d2f24
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x1010e3be
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1010e34b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1010e3be
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1010e399
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1010e39c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1010e394
mov dword [esi + 0x10], ebx
jmp 0x1010e39c
mov dword [esi + 0x10], ecx
jmp 0x1010e39c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.101d2b0c
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.101d2b0c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1010e23a
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101ee4a8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1010e252
call fcn.100f41c0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1010e263
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1010e2b8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1010e29e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1010e3e4
cmp dword [esp + 0x18], ebx
jne 0x1010e2b8
cmp dword [esp + 0x14], ebx
je 0x1010e3e4
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1010e2c9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.101d2881
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1010e30f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1010e30f
call fcn.100fe6e0
test eax, eax
je 0x1010e30f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.101d2c95
push ebx
lea ecx, [esp + 0x14]
call fcn.101d2f24
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x1010e3be
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1010e34b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1010e3be
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1010e399
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1010e39c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1010e394
mov dword [esi + 0x10], ebx
jmp 0x1010e39c
mov dword [esi + 0x10], ecx
jmp 0x1010e39c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.101d2b0c
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.101d2b0c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1010eaa0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1010eb35
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x1010eaef
call fcn.100fe720
test eax, eax
je 0x1010eaef
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1010eadc
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1010eadc
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x1010eae8
add edi, ebx
mov ebx, 0x10004
jmp 0x1010eaf1
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x1010ecf0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x1010eb35
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x1010eb24
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1010eb60
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1010eb74
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1010ebc0
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x10113800
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x414
push ebx
push esi
mov dword [esp + 0x14], ecx
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, str.SOFTWAREITE
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x1c], 4
and ecx, 3
mov dword [esp + 0xc], 0
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x101138d1
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, str.SoftwareITE
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0xc], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
je 0x101138d1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.OnOff
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1011391f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
push str.Get_OnOff_key_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax + 4], edx
mov eax, 1
pop ebx
add esp, 0x414
ret

Function at 0x101149b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
call fcn.10114a20
mov dword [0x107947e8], eax
push eax
lea eax, [esp + 8]
push str.OS_version___d__r_n
push eax
call fcn.1003399c
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.10114b20
neg eax
sbb eax, eax
neg eax
mov dword [0x1027b1b0], eax
call fcn.10115580
call fcn.10114da0
call fcn.10115160
call fcn.10115350
call fcn.101153c0
xor al, al
pop edi
add esp, 0x104
ret
Function at 0x10114a20
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x10114a6a
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x10114a6a
pop edi
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
dec eax
je 0x10114ac0
dec eax
jne 0x10114b14
cmp ecx, 6
jne 0x10114a94
mov eax, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp ecx, 5
jne 0x10114ac0
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x10114b14
cmp eax, 1
je 0x10114b14
test eax, eax
jne 0x10114b14
mov eax, esi
pop edi
mov dword [0x1079c3f0], 1
pop esi
add esp, 0x9c
ret
cmp ecx, 4
jne 0x10114b14
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10114af8
push eax
push str.Microsoft_Windows_95__r_n
push 1
mov ecx, 0x10788728
call fcn.10113950
mov al, byte [esp + 0x1d]
cmp al, 0x43
je 0x10114aeb
cmp al, 0x42
jne 0x10114aed
xor esi, esi
cmp dword [esp + 0xc], 4
jne 0x10114b14
mov eax, dword [esp + 0x10]
cmp eax, 0xa
jne 0x10114b0a
xor esi, esi
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 0x5a
jne 0x10114b14
mov esi, 0xbb8
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x10115160
Capabilities:
Get disk information

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
push 0
push str.___ScanAllDriveLetter_____r_n
push 1
mov ecx, 0x10788728
call fcn.10113950
mov ecx, 0x43
xor eax, eax
mov edi, 0x107947f0
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x43
mov dword [esp + 0x18], 0x107947f5
push ebx
lea eax, [esp + 0x124]
push 0x1027b29c
push eax
call fcn.1003399c
add esp, 0xc
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebp, eax
cmp ebp, 5
je 0x101151db
cmp ebp, 2
je 0x101151db
cmp ebp, 3
jne 0x101152a7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, 0x1027a098
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x10], eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call fcn.101152c0
add esp, 8
test eax, eax
je 0x101152a7
mov esi, dword [esp + 0x18]
cmp ebp, 5
jne 0x10115266
mov dword [esi - 4], 1
mov edx, dword [esp + 0x10]
push esi
push edx
call fcn.10115300
add esp, 8
test eax, eax
jne 0x10115285
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101152a7
mov eax, dword [esp + 0x10]
mov byte [esi - 5], bl
test eax, eax
je 0x10115297
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
inc ecx
add esi, 9
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
inc ebx
cmp ebx, 0x5a
jle 0x101151a2
mov al, byte [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret

Function at 0x10115300
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x10
xor eax, eax
lea ecx, [esp]
mov dword [esp + 4], eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
mov dword [esp], 0
push eax
push ecx
push 0xc
push edx
push eax
mov dword [esp + 0x20], eax
push eax
mov eax, dword [esp + 0x2c]
push 0x2d1080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10115346
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
mov dword [ecx], edx
mov eax, 1
add esp, 0x10
ret
Function at 0x10115580
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov ecx, 0x2fa8
xor eax, eax
mov edi, 0x10788730
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x14], 0
mov bl, 0x43
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0
and eax, 0xff
lea ecx, [eax + eax*2]
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*8]
lea ecx, [eax + edx*4]
lea edx, [esp + 0x10]
push edx
push ebx
lea esi, [eax + ecx*4 + 0x10788730]
call fcn.101156a0
add esp, 8
test eax, eax
jne 0x101155ef
lea eax, [esp + 0x10]
push eax
call fcn.10115710
add esp, 4
jmp 0x10115681
mov ecx, dword [esp + 0x10]
push esi
push ecx
call fcn.10115730
add esp, 8
test eax, eax
jne 0x10115610
lea edx, [esp + 0x10]
push edx
call fcn.10115710
add esp, 4
jmp 0x10115681
movsx edi, bl
push edi
lea eax, [esi + 1]
push str._c:_
push eax
call fcn.1003399c
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call fcn.101159b0
add esp, 0x14
lea edx, [esp + 0x18]
push edi
push 0x1027b29c
push edx
call fcn.1003399c
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call ebp
cmp eax, 5
jne 0x10115659
mov dword [esi + 0x403], 1
mov ecx, dword [esp + 0x10]
add esi, 0x407
push esi
push ecx
call fcn.10115300
lea edx, [esp + 0x18]
push edx
call fcn.10115710
mov al, byte [esp + 0x20]
add esp, 0xc
inc al
mov byte [esp + 0x14], al
inc bl
mov al, bl
sub al, 0x43
cmp al, 0x17
jbe 0x101155a7
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10c
ret

Function at 0x10116180
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov dword [esp + 0xc], esi
mov al, byte [edi + 0x2f7]
test al, al
jbe 0x10116247
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov cl, byte [edi + esi + 0x510]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], 0
call fcn.101156a0
add esp, 8
test eax, eax
je 0x10116230
cmp dword [0x107947e8], 0x893
jne 0x10116218
xor esi, esi
xor edi, edi
push 0x3e8
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [0x107946e0]
add esp, 4
cmp eax, 1
jne 0x101161fe
inc esi
push str.SYS._Ready_r_n
jmp 0x10116203
push str.SYS._not_Ready_r_n
call ebp
cmp esi, 2
jg 0x10116210
inc edi
cmp edi, 0xa
jl 0x101161dc
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push eax
call dword [0x107946ac]
lea ecx, [esp + 0x14]
push ecx
call fcn.10115710
add esp, 8
xor edx, edx
inc esi
mov dl, byte [edi + 0x2f7]
mov dword [esp + 0x14], esi
cmp esi, edx
jl 0x101161ab
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret