joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1051d5f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10e607c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1051da3
xor eax, eax
inc eax
jmp 0x1051e90
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x1051e6e
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1003824
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x1051e57
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x1051e50
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x1051e57
inc esi
inc esi
cmp word [esi], bx
jne 0x1051e32
push esi
call fcn.01085613
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 8]
call fcn.01051c01
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x1051db1
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01078836
leave
ret 8
Function at 0x1051ea2
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10e607c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1051ee6
xor eax, eax
inc eax
jmp 0x1051fd0
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x1051fae
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1003824
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x1051f9a
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x1051f93
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x1051f9a
inc esi
inc esi
cmp word [esi], bx
jne 0x1051f75
push esi
call fcn.01085613
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
call fcn.01051d5f
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x1051ef4
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01078836
leave
ret 4

Function at 0x1052b45
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, dword [sym.imp.msvcrt.dll_fwrite]
jmp 0x1052b9f
mov eax, dword [ebp - 4]
sub eax, ebx
push esi
sar eax, 1
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1052bc9
push esi
push 2
push 2
push 0x100554c
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1052bc9
mov ebx, dword [ebp - 4]
add ebx, 2
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x1052b60
cmp word [ebx], ax
je 0x1052bc7
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1052bc9
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x1052fd5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, eax
call fcn.01022d6e
mov esi, edi
shl esi, 3
cmp dword [esi + 0x10e54f0], 0
mov ebx, eax
mov ax, word [esi + 0x10e54f4]
mov word [ebp - 0xc], ax
jne 0x10530fe
push edi
mov edi, 0x10ebc28
mov ecx, edi
call fcn.01052c3f
cmp word [esi + 0x10e54f4], 1
lea eax, [ebp - 8]
jne 0x1053035
push 0x100a9dc
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 4], 8
jmp 0x1053057
and dword [ebp - 4], 0
push 0x100a9d8
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov word [ebx + 0xac2], 1
mov word [esi + 0x10e54f4], 1
xor ebx, ebx
cmp word [0x10ebc28], bx
pop ecx
pop ecx
je 0x10530fe
push dword [ebp - 4]
push edi
call fcn.01085761
cmp eax, ebx
mov dword [esi + 0x10e54f0], eax
jne 0x105308a
push edi
push 0xdbb
call fcn.01084486
pop ecx
pop ecx
jmp 0x10530fe
push eax
mov byte [ebp - 2], 0xff
mov byte [ebp - 1], 0xfe
call dword [sym.imp.msvcrt.dll_ftell]
test eax, eax
pop ecx
jne 0x10530b5
push dword [esi + 0x10e54f0]
lea eax, [ebp - 2]
push 2
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
call fcn.01022d6e
cmp dword [eax + 0xbec], ebx
je 0x10530fe
cmp word [ebp - 0xc], 1
je 0x10530fe
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
push 1
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], ebx
call fcn.0105c581
test eax, eax
jl 0x10530fe
lea eax, [ebp - 0x2c]
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
lea eax, [ebp - 0x18]
push eax
call fcn.0105c70c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105769e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10e607c]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
xor edi, edi
push edi
push 0x2000000
push edi
push 0x100210c
push edi
push 0x100b550
push 0x80000002
mov dword [ebp - 0x20c], 7
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10576f5
xor eax, eax
inc eax
jmp 0x1057783
push esi
call fcn.01022e06
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push 0x10ebe50
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x14
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push edi
push 0x100b52c
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x1057771
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push edi
push 0x100b50c
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x1057774
xor edi, edi
inc edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.01078836
leave
ret
Function at 0x1057793
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10e607c]
push ebx
push esi
push edi
push 0x10
pop ecx
mov esi, 0x100b670
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
mov ebx, 0x2000000
push ebx
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x100210c
push esi
push eax
push 0x100b5d8
push 0x80000002
call edi
test eax, eax
jne 0x1057840
cmp dword [ebp - 0x50], 1
jne 0x1057818
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1057818
xor esi, esi
inc esi
jmp 0x1057847
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
push ebx
push eax
push esi
push eax
push 0x100a538
push 0x80000001
call edi
test eax, eax
je 0x1057845
xor eax, eax
inc eax
jmp 0x1057852
xor esi, esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret
Function at 0x1059fe1
Capabilities:
Set current directory

Disassembly:
call fcn.01022d63
test eax, eax
jne 0x1059fef
call fcn.01057793
push ebx
push esi
push edi
call fcn.01023372
call fcn.0105769e
mov ebx, 0x100
push ebx
push 0x10ec308
mov edi, 0x100210c
push edi
xor eax, eax
push 0x100c050
mov esi, 0x100b8a0
push esi
mov word [0x10ecbd4], ax
mov word [0x10ecbd8], ax
mov word [0x10ecbda], ax
call fcn.01022f01
call fcn.01022d84
push eax
call fcn.01023120
push ebx
push 0x10ec508
push edi
push 0x100c034
push esi
call fcn.01022f01
call fcn.01022dd7
push eax
call fcn.0102323e
push 1
push 0x100be50
push esi
call fcn.01022e22
movzx eax, ax
mov dword [0x10ecbec], eax
call fcn.01098c29
push 0
call fcn.01092fb5
test eax, eax
pop edi
pop esi
mov dword [0x10ecbe0], eax
mov dword [0x10ebe48], eax
pop ebx
je 0x105a0cc
mov word [eax + 0x66], 1
mov eax, dword [0x10ebe48]
or dword [eax + 0x9c], 2
call fcn.01057864
call fcn.01059c42
call fcn.01057db5
call fcn.01057ef8
and dword [0x10eae90], 0
call fcn.01058034
call fcn.01058076
call fcn.0101a3e5
jmp fcn.01022e11
ret

Function at 0x105a2a9
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea ecx, [ebp - 4]
push ecx
xor eax, eax
mov ebx, 0xf003f
push ebx
push eax
mov edi, 0x100c5f0
push edi
mov esi, 0x80000002
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x105a2f7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push ebx
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105a313
push 0x8a
push 0x100c698
push 2
push 0
push 0x100c670
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x105a325
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret

Function at 0x105a36b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10e607c]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
xor esi, esi
push esi
push 0x2000000
push esi
push esi
push esi
push 0x100a538
xor edi, edi
push 0x80000001
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105a3df
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push 0x100c7f8
push dword [ebp - 0x30]
mov dword [ebp - 0x38], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105a3d6
cmp dword [ebp - 0x34], 4
jne 0x105a3d6
mov edi, dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.01078836
leave
ret
Function at 0x105a3f2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10e607c]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push 0x2000000
push esi
push esi
push esi
push 0x100a538
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105a44a
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x100c7f8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret 4

Function at 0x105a93b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10d5bc7
call fcn.0107a498
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call edi
mov esi, dword [ebp + 0xc]
push eax
mov ecx, esi
mov dword [ebp - 0x14], eax
call sub.MFC42u.dll_CString::GetBufferSetLength
cmp eax, ebx
je 0x105aa21
push dword [ebp - 0x14]
push eax
call edi
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42u.dll_CString::ReleaseBuffer
push dword [esi]
call fcn.010354d9
mov edi, eax
cmp edi, ebx
je 0x105aa21
mov eax, dword [esi]
push edi
push eax
lea ecx, [ebp + 0xc]
call fcn.0107999e
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [0x10eae78]
call fcn.01087561
test ax, ax
jne 0x105aa15
push dword [ebp - 0x18]
push dword [0x10eae7c]
call fcn.010951ce
cmp eax, ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x105aa15
push edi
mov ecx, esi
call fcn.010204f8
cmp ax, 0x5c
mov ecx, esi
lea eax, [ebp + 8]
jne 0x105a9f0
inc edi
push edi
push eax
call sub.MFC42u.dll_CString::Mid_1
mov byte [ebp - 4], 1
jmp 0x105a9fb
push edi
push eax
call sub.MFC42u.dll_CString::Mid_1
mov byte [ebp - 4], 2
mov ecx, esi
push eax
call fcn.01078b5e
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
mov dword [ebp - 0x10], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x105aa3a
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10d5be1
call fcn.0107a498
sub esp, 0x124
mov eax, dword [0x10e607c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.01077607
mov ecx, esi
call sub.MFC42u.dll_CCmdTarget::BeginWaitCursor
mov ecx, esi
call sub.MFC42u.dll_CCmdTarget::EndWaitCursor
push 1
call fcn.0102ffd2
mov edi, eax
cmp edi, 1
je 0x105ab61
cmp edi, 4
je 0x105ab4f
lea ecx, [ebp - 0x12c]
call sub.MFC42u.dll_CString::CString_2
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x128]
xor edi, edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0105a93b
test eax, eax
je 0x105ab2c
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
push 0x2000000
push edi
push edi
push edi
push 0x100c870
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105ab2c
push 0x45
pop ecx
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x124]
mov esi, 0x114
push eax
mov dword [ebp - 0x124], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
lea eax, [ebp - 0x124]
push eax
push 3
push 0
push 0x100c854
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov ecx, ebx
call fcn.01077244
test eax, eax
je 0x105ab3e
push 7
call fcn.0103b6aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call sub.MFC42u.dll_CString::CString
jmp 0x105ab61
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xd4]
push 1
call sub.MFC42u.dll_CWnd::EnableWindow
xor edi, edi
mov ecx, dword [ebp - 0xc]
xor eax, eax
test edi, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
sete al
pop ebx
call fcn.01078836
leave
ret 4
Function at 0x105b487
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10e607c]
push ebx
push esi
push edi
mov esi, 0x100c928
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [0x1004c60]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x1004c64]
push 0x41
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
pop esi
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x105b57f
push edi
push edi
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
mov word [ebp - 0x14], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x105b59d
push edi
lea eax, [ebp - 0x28]
push eax
push 0x1e0
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x70c00
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x105b56a
mov eax, dword [ebp - 0x28]
xor edx, edx
push 0x18
pop ecx
div ecx
xor edx, edx
cmp eax, edi
jbe 0x105b570
xor ecx, ecx
lea ecx, [ecx + ecx*2]
mov ecx, dword [ebp + ecx*8 - 0x204]
cmp ecx, edi
je 0x105b558
cmp ecx, 0xb
je 0x105b55d
cmp ecx, 0xc
je 0x105b558
mov dword [ebp - 0x2c], 1
jmp 0x105b560
cmp ecx, 0xb
jne 0x105b560
mov dword [ebp - 0x20], esi
inc edx
movzx ecx, dx
cmp ecx, eax
jb 0x105b537
jmp 0x105b570
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 1
je 0x105b5a8
jmp 0x105b59d
cmp eax, 4
jne 0x105b58f
cmp word [ebp - 0x20], di
jne 0x105b59d
mov dword [ebp - 0x20], esi
jmp 0x105b59d
cmp eax, 3
jne 0x105b59d
cmp word [ebp - 0x24], di
jne 0x105b59d
mov dword [ebp - 0x24], esi
inc esi
cmp si, 0x5a
jbe 0x105b4cb
mov ecx, dword [ebp - 4]
xor eax, eax
mov ax, 0x5a
cmp ax, si
pop edi
sbb eax, eax
not eax
and eax, esi
pop esi
pop ebx
call fcn.01078836
leave
ret
Function at 0x105bb97
Capabilities:
Get common file path
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa24
mov eax, dword [0x10e607c]
push ebx
push edi
push 4
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0105b941
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xa18], eax
je 0x105bd1e
xor eax, eax
mov ecx, 0x200
lea edi, [ebp - 0xa10]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa10]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jge 0x105bbf6
xor eax, eax
jmp 0x105bd24
cmp word [ebp - 0xa10], bx
mov dword [ebp - 0xa1c], ebx
je 0x105bd1e
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xa14], eax
push dword [ebp - 0xa14]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x105bcef
push 0x104
push dword [ebp - 0xa14]
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call dword [sym.imp.msvcrt.dll_wcsncpy]
lea eax, [ebp - 0x210]
push eax
call edi
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp - 0x210]
push 0x10055f4
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x1c
push ebx
push ebx
mov dword [ebp - 0xa20], 0x43
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea eax, [ebx + ebx]
push eax
call sub.MFC42u.dll_operatornew
test eax, eax
pop ecx
mov dword [ebp - 0xa24], eax
je 0x105bcc0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0xa24]
cmp word [eax + 2], 0x3a
jne 0x105bcb9
mov cx, word [eax]
mov word [ebp - 0xa20], cx
push eax
call sub.MFC42u.dll_operatordelete
pop ecx
mov ax, word [ebp - 0xa20]
cmp word [ebp - 0x210], ax
je 0x105bce4
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.0105b645
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 0
je 0x105bd1e
xor ebx, ebx
push dword [ebp - 0xa14]
call edi
pop ecx
mov ecx, dword [ebp - 0xa1c]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0xa1c], eax
lea eax, [ebp + eax*2 - 0xa10]
cmp word [eax], bx
mov dword [ebp - 0xa14], eax
jne 0x105bc1b
mov eax, dword [ebp - 0xa18]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01078836
leave
ret 8

Function at 0x105bd37
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10e607c]
and word [ebp - 6], 0
push esi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100c938
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x105bd82
cmp eax, esi
ja 0x105bd82
push 2
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.0105b750
jmp 0x105bd84
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret
Function at 0x105bd94
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10e607c]
and word [ebp - 6], 0
push esi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100c938
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x105bddf
cmp eax, esi
ja 0x105bddf
push 2
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.0105b941
jmp 0x105bde1
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret

Function at 0x105be4c
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10e607c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], eax
mov esi, 0x105
push esi
lea eax, [ebp - 0x41c]
push eax
xor ebx, ebx
push 0x100c99c
mov word [ebp - 0x214], bx
mov word [ebp - 8], bx
call edi
cmp eax, ebx
je 0x105bf70
cmp eax, esi
ja 0x105bf70
push 1
lea eax, [ebp - 0x41c]
push eax
call fcn.0105b645
cmp eax, ebx
je 0x105bf70
push esi
lea eax, [ebp - 0x41c]
push eax
push 0x100c980
call edi
mov edi, eax
cmp edi, ebx
je 0x105bf70
cmp edi, esi
ja 0x105bf70
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x105bf70
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x210]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x41c]
push eax
call esi
pop ecx
cmp eax, ebx
pop ecx
lea eax, [ebp - 0x210]
ja 0x105bf16
lea eax, [ebp - 0x41c]
push eax
call esi
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x105bf6c
lea eax, [ebp - 0x210]
push eax
call esi
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp - 0x210]
push 0x100c974
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x10
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.0105b645
mov edi, eax
mov eax, edi
jmp 0x105bf72
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret

Function at 0x105bf84
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10e607c]
and word [ebp - 8], 0
push esi
mov dword [ebp - 4], eax
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
push 0x100c9c0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x105c010
cmp eax, esi
ja 0x105c010
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x105bfd6
and word [eax], 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp - 0x210]
push 0x100c974
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x10
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.0105b645
jmp 0x105c012
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret