joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107a714
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword fs:[0x18]
push ebx
push esi
xor ebx, ebx
push 0x6a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jne 0x107a755
mov esi, 0xc0000017
jmp 0x107a87e
test byte [ebp + 0xc], 1
push edi
je 0x107a773
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0107a686
mov esi, eax
cmp esi, ebx
jge 0x107a8c5
push ebx
push 0x18
lea eax, [ebp - 0x34]
push eax
push 7
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp esi, ebx
jl 0x107a867
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x34], ebx
jbe 0x107a862
push ebx
push dword [ebp + 0xc]
push 0x1105456
push 0x35
push dword [ebp - 0x14]
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
cmp dword [ebp - 8], ebx
je 0x107a7cc
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.0107b03e
test eax, eax
jl 0x107a84e
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x107a84e
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 4], ebx
jbe 0x107a84e
add eax, 0x48
push 4
pop ecx
mov edi, 0x1007144
lea esi, [eax + 8]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x107a814
cmp byte [ebp - 1], bl
jne 0x107a829
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax]
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add eax, 0x90
cmp edx, dword [ecx + 4]
jb 0x107a7ef
jmp 0x107a84e
lea eax, [ebp - 0x18]
push eax
call fcn.0107b4ba
test eax, eax
jl 0x107a8bc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.0107ae32
test eax, eax
jl 0x107a8bc
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x34]
jb 0x107a798
cmp byte [ebp - 1], bl
jne 0x107a8c3
mov esi, 0xc0000452
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
cmp dword [ebp - 8], ebx
je 0x107a899
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x18], ebx
je 0x107a8b4
push dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0xc0000451
jmp 0x107a867
xor esi, esi
cmp dword [ebp + 8], ebx
jne 0x107a8cd
mov dword [ebp - 0xc], ebx
push dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x1105456
push 0x35
push edi
call sub.msvcrt.dll_swprintf_s
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [eax], edi
jmp 0x107a87d
Function at 0x107a90c
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x60019
xor edi, edi
mov esi, 0x1105852
push esi
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.0107abfa
mov ebx, eax
cmp ebx, edi
jge 0x107a945
cmp ebx, 0xc0000034
jne 0x107a99b
xor ebx, ebx
jmp 0x107a99b
mov edi, 0xf003f
push edi
call fcn.01071dbc
mov dword [ebp - 8], eax
test eax, eax
jne 0x107a95e
mov ebx, 0xc0000001
jmp 0x107a99b
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov ebx, eax
test ebx, ebx
jl 0x107a99b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0
call fcn.0107abfa
mov ebx, eax
test ebx, ebx
jl 0x107a99b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
mov ebx, eax
xor esi, esi
cmp dword [ebp - 4], esi
je 0x107a9ab
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 8], esi
je 0x107a9c6
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x107a9d2
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x1105852
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
xor ebx, ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0107a90c
mov esi, eax
cmp esi, edi
jl 0x107aa9a
lea eax, [ebp - 8]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x28]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
cmp esi, edi
jl 0x107aa9a
mov eax, dword [ebp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x107aa45
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push 0x1105832
push dword [ebp - 4]
call fcn.0107adbe
mov esi, eax
cmp esi, edi
jl 0x107aa9a
push 0x60019
call fcn.01071dbc
mov ebx, eax
cmp ebx, edi
jne 0x107aa88
mov esi, 0xc0000001
jmp 0x107aa9a
push ebx
push 4
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov esi, eax
cmp esi, edi
jge 0x107aaa3
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
cmp dword [ebp - 4], edi
je 0x107aab1
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp ebx, edi
je 0x107aac9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x107ac72
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp + 0x10], ebx
je 0x107acc0
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0107abfa
mov edi, eax
cmp edi, ebx
jl 0x107ad85
jmp 0x107acc6
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x107acfa
cmp edi, ebx
jl 0x107ad84
mov edi, 0xc0000001
jmp 0x107ad84
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x107ad65
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jl 0x107ad84
mov esi, dword [ebp - 8]
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x14]
je 0x107ad44
mov edi, 0xc0000024
jmp 0x107ad84
sub dword [ebp + 0xc], 0xc
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, edi
jne 0x107ad6c
mov edi, 0xc000009a
jmp 0x107ad84
push dword [ebp + 0xc]
add esi, 0xc
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ecx], eax
pop esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
je 0x107ad94
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 8], 0
je 0x107adb1
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
leave
ret 0x18
Function at 0x107b6d7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
jne 0x107b6fa
push 0x1007258
push 0x38
push 0x1007228
call fcn.0107b644
or dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.0107d16c
mov edi, eax
cmp edi, ebx
jl 0x107b77f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x107b75c
lea eax, [ebp - 8]
push eax
push 0x100720c
push dword [ebp - 4]
call fcn.0107ca99
mov edi, eax
cmp edi, ebx
jl 0x107b77f
push ebx
push 0x4000080
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x107b77f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x107b770
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070005
jne 0x107b77f
mov edi, 0x80780047
push dword [ebp - 4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
cmp dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], ebx
je 0x107b7a4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x107b7b2
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x107b7d9
push 0x1007268
push 0xe5
push 0x1007228
call fcn.0107b644
mov ebx, dword [ebp + 0x10]
push esi
mov byte [ebx], 0
mov dword [ebp - 4], edi
call fcn.0107eedf
mov byte [ebp + 0x13], al
lea eax, [ebp - 4]
push eax
push esi
call fcn.0107d16c
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x107b9d5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x107b8ab
mov eax, dword [0x111024c]
mov esi, 0x111024c
mov edi, 0x10071fc
cmp eax, esi
je 0x107b842
test byte [eax + 0x1c], 1
je 0x107b842
cmp byte [eax + 0x19], 5
jb 0x107b842
push dword [ebp + 8]
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019633
cmp byte [ebp + 0x13], 0
jne 0x107b854
mov dword [ebp - 8], 0x8078011a
jmp 0x107b9d5
cmp byte [ebp + 0xc], 0
je 0x107b8a3
push dword [ebp - 4]
call fcn.0107b6d7
mov dword [ebp - 8], eax
test eax, eax
jge 0x107b8a3
mov eax, dword [0x111024c]
cmp eax, esi
je 0x107b9d5
test byte [eax + 0x1c], 1
je 0x107b9d5
cmp byte [eax + 0x19], 4
jb 0x107b9d5
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01048c37
jmp 0x107b9d5
mov byte [ebx], 1
jmp 0x107b9d5
cmp eax, 1
jne 0x107b9a7
cmp byte [ebp + 0x13], 0
jne 0x107b8f3
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107b9d5
test byte [eax + 0x1c], 1
je 0x107b9d5
cmp byte [eax + 0x19], 5
jb 0x107b9d5
push 1
push esi
push 0x10071fc
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x107b9d0
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x107b971
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x107b968
cmp eax, 0x52e
je 0x107b968
cmp eax, 0x43
je 0x107b95f
cmp eax, 0x35
je 0x107b95f
cmp eax, 3
je 0x107b95f
mov ecx, dword [0x111024c]
cmp ecx, 0x111024c
je 0x107b9d5
test byte [ecx + 0x1c], 1
je 0x107b9d5
cmp byte [ecx + 0x19], 4
jb 0x107b9d5
push eax
push 0x10071fc
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01019fa8
jmp 0x107b9d5
mov dword [ebp - 8], 0x80780071
jmp 0x107b9d5
mov dword [ebp - 8], 0x8078006f
jmp 0x107b9d5
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107b99e
test byte [eax + 0x1c], 1
je 0x107b99e
cmp byte [eax + 0x19], 2
jb 0x107b99e
push dword [ebp - 4]
push 0x10071fc
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019633
mov dword [ebp - 8], 0x8000ffff
jmp 0x107b9d5
mov ecx, dword [0x111024c]
cmp ecx, 0x111024c
je 0x107b9d5
test byte [ecx + 0x1c], 1
je 0x107b9d5
cmp byte [ecx + 0x19], 5
jb 0x107b9d5
push eax
push esi
push 0x10071fc
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01048c37
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x107c169
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, 0x10072d8
jne 0x107c18a
push 0x1007314
push 0x205
push esi
call fcn.0107b644
cmp dword [ebp + 0xc], 0
jne 0x107c1a0
push 0x1007310
push 0x206
push esi
call fcn.0107b644
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x107c1ee
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jge 0x107c21b
or eax, 0x10000000
mov esi, eax
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107c21b
test byte [eax + 0x1c], 1
je 0x107c21b
cmp byte [eax + 0x19], 2
jb 0x107c21b
push esi
push 0x100728c
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019fa8
jmp 0x107c21b
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107c21b
test byte [eax + 0x1c], 1
je 0x107c21b
cmp byte [eax + 0x19], 5
jb 0x107c21b
push dword [ebp + 0xc]
push 0x100728c
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019fa8
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x107d404
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.0107d1fe
mov ebx, eax
cmp ebx, edi
jl 0x107d52b
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x107d4a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107d48a
test byte [eax + 0x1c], 1
je 0x107d48a
cmp byte [eax + 0x19], 2
jb 0x107d48a
push esi
push dword [ebp - 4]
push 0x10075f8
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01048c37
mov eax, dword [0x111024c]
cmp esi, edi
jg 0x107d495
mov ebx, esi
jmp 0x107d530
and esi, 0xffff
or esi, 0x80070000
jmp 0x107d48e
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x7405c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x107d515
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107d501
test byte [eax + 0x1c], 1
je 0x107d501
cmp byte [eax + 0x19], 2
jb 0x107d501
push esi
push dword [ebp - 4]
push 0x10075f8
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01048c37
cmp esi, edi
jle 0x107d511
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
jmp 0x107d520
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [0x111024c]
cmp dword [ebp - 4], edi
je 0x107d543
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x111024c]
cmp ebx, edi
jge 0x107d573
cmp eax, 0x111024c
je 0x107d573
test dword [eax + 0x1c], 0x200
je 0x107d573
cmp byte [eax + 0x19], 2
jb 0x107d573
push ebx
push dword [ebp + 8]
push 0x10075f8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01048c37
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x107dbbb
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x111027c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x111024c]
mov esi, 0x111024c
mov ebx, 0x10075f8
cmp eax, esi
je 0x107dc02
test byte [eax + 0x1c], 1
je 0x107dc02
cmp byte [eax + 0x19], 4
jb 0x107dc02
push ebx
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
push edi
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x5a
mov byte [ebp - 0x19], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
pop edi
test eax, eax
jge 0x107dc66
or eax, 0x10000000
mov dword [ebp - 0x20], eax
mov eax, dword [0x111024c]
cmp eax, esi
je 0x107dcf5
test byte [eax + 0x1c], 8
je 0x107dcd7
cmp byte [eax + 0x19], 2
jb 0x107dcd7
push dword [ebp - 0x20]
push ebx
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019fa8
jmp 0x107dcd2
mov eax, dword [0x111024c]
cmp eax, esi
je 0x107dc91
test byte [eax + 0x1c], 1
je 0x107dc91
cmp byte [eax + 0x19], 4
jb 0x107dc91
push dword [ebp - 8]
push ebx
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019fa8
mov eax, dword [0x111024c]
cmp dword [ebp - 8], 2
jne 0x107dc9b
mov byte [ebp - 0x19], 1
cmp eax, esi
je 0x107dcca
test byte [eax + 0x1c], 1
je 0x107dcca
cmp byte [eax + 0x19], 4
jb 0x107dcca
cmp byte [ebp - 0x19], 0
mov ecx, 0x1003118
jne 0x107dcbb
mov ecx, 0x1003110
push ecx
push ebx
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019633
mov eax, dword [ebp - 0x24]
mov cl, byte [ebp - 0x19]
mov byte [eax], cl
mov eax, dword [0x111024c]
cmp eax, esi
je 0x107dcf5
test byte [eax + 0x1c], 1
je 0x107dcf5
cmp byte [eax + 0x19], 4
jb 0x107dcf5
push ebx
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f798
leave
ret 4
Function at 0x107ddff
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov dword [eax], esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x107de53
call ebx
cmp eax, 0xea
je 0x107de53
cmp eax, esi
jg 0x107de47
mov dword [ebp - 4], eax
jmp 0x107df04
and eax, 0xffff
or eax, 0x80070000
jmp 0x107de3f
mov eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
add eax, eax
push eax
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x107de74
mov dword [ebp - 4], 0x8007000e
jmp 0x107def5
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0xc]
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x107de9a
call ebx
test eax, eax
jle 0x107de95
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x107def5
mov eax, dword [ebp - 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x107dea0
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x107def5
lea edi, [ebx + ebx]
lea eax, [edi + 2]
push eax
call esi
mov esi, eax
test esi, esi
jne 0x107deca
mov dword [ebp - 4], 0x8007000e
jmp 0x107deea
push dword [ebp - 8]
inc ebx
push ebx
push esi
call fcn.010257dc
mov dword [ebp - 4], eax
test eax, eax
jl 0x107deea
xor eax, eax
mov word [edi + esi - 2], ax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor esi, esi
test esi, esi
je 0x107def5
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 8], 0
je 0x107df04
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
jge 0x107df3d
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107df3d
test byte [eax + 0x1c], 1
je 0x107df3d
cmp byte [eax + 0x19], 3
jb 0x107df3d
push dword [ebp - 4]
push dword [ebp + 8]
push 0x10075f8
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01048c37
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x107efc4
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x111027c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x1007780
test ebx, ebx
jne 0x107effb
push 0x10078b0
push 0x79d
push esi
call fcn.0107b644
test edi, edi
jne 0x107f00f
push 0x1007898
push 0x79e
push esi
call fcn.0107b644
and dword [edi], 0
and dword [ebp - 0x418], 0
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x107f072
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107f06b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x107f0f9
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x107f0d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107f09f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jne 0x107f0fb
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107f0cf
test byte [eax + 0x1c], 1
je 0x107f0cf
cmp byte [eax + 0x19], 2
jb 0x107f0cf
push 0x1007770
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov esi, 0x8000ffff
jmp 0x107f0f9
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0107c9fc
mov esi, eax
test esi, esi
jl 0x107f0fd
mov eax, dword [ebp - 0x418]
mov dword [edi], eax
test esi, esi
jge 0x107f109
push dword [ebp - 0x418]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f798
leave
ret 8

Function at 0x107f183
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x107f1a4
push 0x10078c4
push 0x814
push 0x1007780
call fcn.0107b644
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x107f219
push 0
push 0
push dword [ebp + 0xc]
push esi
call fcn.0107e515
test eax, eax
jl 0x107f21b
push dword [0x1110338]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x107f219
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x107f205
test byte [eax + 0x1c], 2
je 0x107f205
cmp byte [eax + 0x19], 2
jb 0x107f205
push esi
push 0x1007770
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019fa8
test esi, esi
jle 0x107f215
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x107f21b
xor eax, eax
pop esi
pop ebp
ret 8