joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015957
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
cmp ebx, edi
jne 0x1015954
mov eax, 0x80070057
jmp 0x1015aaf
mov eax, dword [ebx]
push 0xc
pop ecx
mov dword [ebp + 8], ecx
cmp eax, edi
je 0x1015981
mov dword [ebp - 8], ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1015966
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
add eax, 0xc
mov dword [ebp + 8], eax
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x10159a9
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1015991
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
add dword [ebp + 8], eax
mov dword [ebp - 0x10], eax
push esi
push dword [ebp + 8]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x10159fd
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x10159da
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x10159f0
call edi
test eax, eax
jle 0x10159ec
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10159f5
mov edi, 0x80004005
test edi, edi
jl 0x1015a98
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
test eax, eax
je 0x1015a24
push dword [ebx]
add eax, esi
push dword [ebp - 0xc]
push eax
call fcn.01015773
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jl 0x1015a98
test ecx, ecx
je 0x1015a3c
push dword [ebx + 4]
add ecx, esi
push dword [ebp - 0x10]
push ecx
call fcn.01015773
mov edi, eax
test edi, edi
jl 0x1015a98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x14]
push 0
push 0x4a
push dword [eax + 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1015a65
xor edi, edi
jmp 0x1015a98
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x1015a7d
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x1015a93
call edi
test eax, eax
jle 0x1015a8f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1015a98
mov edi, 0x80004005
test esi, esi
je 0x1015aac
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x1015d63
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], 0x80004005
cmp ecx, ebx
jne 0x1015d61
mov eax, 0x80070057
jmp 0x1015e9f
push edi
cmp dword [esi], ebx
jne 0x1015d83
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
mov ecx, esi
call fcn.01015928
mov dword [ebp - 4], eax
jmp 0x1015e9b
push ecx
call fcn.0101492d
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x1015e9b
push 0x10
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, ebx
je 0x1015e78
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1015e6d
lea eax, [ebp - 0x30]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
push 1
mov dword [ebp - 8], eax
call edi
mov edi, eax
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
cmp eax, ebx
je 0x1015e64
push eax
push dword [esi + 0x34]
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
push dword [esi + 0x34]
mov dword [esi + 0x30], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
push 0xcc0020
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ebx
push ebx
push dword [ebp + 8]
push edi
push dword [ebp - 8]
push ebx
push ebx
push dword [esi + 0x34]
call dword [sym.imp.GDI32.dll_StretchBlt]
test eax, eax
jne 0x1015e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1015e5c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1015e64
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1015e8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1015e8c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
push 1
push ebx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10164a2
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, dword [ebp + 8]
mov word [esi + 0x24], ax
cmp edi, ebx
je 0x10164fd
mov eax, dword [edi + 4]
mov dword [esi + 0x20], eax
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x10164a3
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.01014328
test eax, eax
jl 0x10164a3
mov ax, word [ebp + 8]
mov word [esi + 0x24], ax
cmp dword [edi + 0xc], ebx
je 0x10164d0
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10164c5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10164c5
mov dword [esi + 0x28], ebx
push dword [edi + 0xc]
call fcn.0101492d
mov dword [esi + 0x28], eax
cmp dword [edi + 0x10], ebx
je 0x10164fd
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10164f2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10164f2
mov dword [esi + 0x14], ebx
push dword [edi + 0x10]
call fcn.0101492d
mov dword [esi + 0x14], eax
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x1016562
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x10163ae
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1016562
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 4]
call edi
cmp dword [esi], ebx
jne 0x1016557
push 0x3e8
push dword [ebp + 8]
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1016579
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1016576
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1018515
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x250]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x254], ebx
call fcn.0100b756
add esp, 0xc
cmp esi, ebx
jne 0x1018523
mov eax, 0x80070057
jmp 0x10185f8
push edi
lea eax, [ebp - 0x254]
push eax
push 0x1004a0c
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
mov dword [ebp - 0x260], eax
call fcn.010125e3
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x25c], eax
mov edi, 0xffff
mov esi, 0x80070000
jne 0x1018591
call ebx
test eax, eax
jle 0x101856a
and eax, edi
or eax, esi
test eax, eax
jge 0x101857e
call ebx
test eax, eax
jle 0x1018576
and eax, edi
or eax, esi
mov dword [ebp - 0x258], eax
jmp 0x1018588
mov dword [ebp - 0x258], 0x80004005
cmp dword [ebp - 0x258], 0
jl 0x10185dc
lea eax, [ebp - 0x228]
push eax
call fcn.0101492d
mov ecx, dword [ebp - 0x264]
mov dword [ecx], eax
test eax, eax
je 0x10185b2
and dword [ebp - 0x258], 0
jmp 0x10185dc
call ebx
test eax, eax
jle 0x10185be
and eax, edi
or eax, esi
test eax, eax
jge 0x10185d2
call ebx
test eax, eax
jle 0x10185ca
and eax, edi
or eax, esi
mov dword [ebp - 0x258], eax
jmp 0x10185dc
mov dword [ebp - 0x258], 0x80004005
cmp dword [ebp - 0x25c], 0
pop edi
je 0x10185f2
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b8d5
leave
ret

Function at 0x10190ff
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
cmp esi, edi
jne 0x101911a
mov eax, 0x80070057
jmp 0x1019177
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [esi], edi
call fcn.01018bfd
mov ebx, eax
cmp ebx, edi
jl 0x101916c
mov eax, dword [ebp - 8]
call fcn.01018e92
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.01018f4c
mov ebx, eax
cmp ebx, edi
jl 0x1019156
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x101916c
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
call fcn.01018b46
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x101923e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x10191a8
mov eax, 0x80070057
jmp 0x1019259
push edi
lea eax, [ebp - 0xc]
push eax
mov dword [esi], ebx
call fcn.0101c250
cmp eax, ebx
mov dword [ebp + 0x10], eax
jl 0x1019216
cmp dword [ebp - 0xc], ebx
jl 0x10191d5
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.010190fb
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jl 0x1019216
cmp dword [ebp - 8], ebx
je 0x1019209
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
lea edi, [ebp + 0xc]
stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 8]
push eax
mov dword [ebp + 0xc], 1
call fcn.0101cba9
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jl 0x1019216
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.0101ce2c
cmp dword [ebp + 0x10], ebx
jl 0x1019226
mov dword [ebp + 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 4], ebx
je 0x1019247
push dword [ebp - 4]
push ebx
call edi
push eax
call esi
test eax, eax
je 0x1019247
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x1019255
push dword [ebp - 8]
push ebx
call edi
push eax
call esi
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10192a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
mov eax, dword [esp + 0x18]
or eax, eax
jne 0x1019292
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
div ecx
mov edx, ebx
jmp 0x10192d3
mov ecx, eax
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 0x10192a0
div ebx
mov esi, eax
mul dword [esp + 0x18]
mov ecx, eax
mov eax, dword [esp + 0x14]
mul esi
add edx, ecx
jb 0x10192ce
cmp edx, dword [esp + 0x10]
ja 0x10192ce
jb 0x10192cf
cmp eax, dword [esp + 0xc]
jbe 0x10192cf
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
ret 0x10
Function at 0x10195b3
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x1019652
cmp dword [ebp + 0x10], edi
jle 0x10195c7
cmp dword [ebp + 0xc], edi
je 0x1019652
cmp dword [ebp + 0x10], edi
jl 0x1019652
test dword [ebp + 0x14], 0xfffffffd
jne 0x1019652
push 0x10193d4
push 8
push 0x163
push 0x1007010
push dword [ebp + 8]
call fcn.0101e434
add esp, 0x14
cmp eax, edi
je 0x1019652
mov ecx, dword [eax + 4]
imul ecx, ecx, 0xc
mov edx, 0x1005f60
add ecx, edx
test byte [ebp + 0x14], 2
jne 0x1019613
push ecx
call fcn.010193ef
test eax, eax
jne 0x1019652
mov eax, dword [ecx + 8]
imul eax, eax, 0xc
add eax, edx
mov eax, dword [eax + 4]
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
cmp si, di
jne 0x1019623
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp dword [ebp + 0xc], edi
je 0x101964e
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0101947b
test eax, eax
jge 0x101964e
push 0x7a
jmp 0x1019654
mov eax, esi
jmp 0x101965c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x101a59a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
test ebx, ebx
je 0x101a5a8
cmp ebx, 0x7fffffff
jbe 0x101a5ad
mov eax, 0x80070057
mov esi, dword [ebp + 8]
test eax, eax
jl 0x101a5c5
lea edi, [ebp + 0xc]
mov edx, ebx
mov eax, esi
call fcn.0101a8bc
mov edx, dword [ebp + 0xc]
jmp 0x101a5c7
xor edx, edx
test eax, eax
jl 0x101a618
mov ecx, ebx
sub ecx, edx
lea eax, [esi + edx*2]
mov dword [ebp + 0xc], 0
je 0x101a607
mov esi, ecx
sub esi, ebx
lea edi, [esi + edx + 0x7fffffff]
mov esi, dword [ebp + 0x10]
sub esi, eax
test edi, edi
je 0x101a603
movzx edx, word [esi + eax]
test dx, dx
je 0x101a603
mov word [eax], dx
inc eax
inc eax
dec ecx
dec edi
test ecx, ecx
jne 0x101a5eb
test ecx, ecx
jne 0x101a610
dec eax
dec eax
mov dword [ebp + 0xc], 0x8007007a
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x101a6de
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x218], esi
call fcn.0100b756
add esp, 0xc
push 7
xor eax, eax
and dword [esi], eax
pop ecx
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
or dword [ebp - 0x238], 0xffffffff
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101a6f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x101a6e9
mov dword [ebp - 0x210], eax
jmp 0x101a7b8
and eax, 0xffff
or eax, 0x80070000
jmp 0x101a6de
push 0x100802c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101a58f
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x101a7b8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x101a753
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100801c
push ebx
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x101a76f
push 0x1008008
push ebx
call esi
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x101a791
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a767
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x101a7ac
push 0x1007ff8
push ebx
call esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x101a753
push 0x1007fe8
push ebx
call esi
mov dword [ebp - 0x224], eax
jmp 0x101a74f
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
push 8
mov dword [eax], ebx
pop ecx
lea esi, [ebp - 0x238]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x101a7b7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.0100b8d5
leave
ret 8
Function at 0x101a91f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, eax
xor eax, eax
test edx, edx
je 0x101a906
cmp edx, dword [ebp + 0xc]
jbe 0x101a90b
mov eax, 0x80070057
test eax, eax
jl 0x101a919
mov eax, dword [ebp + 8]
call fcn.0101a8bc
jmp 0x101a91c
and dword [edi], 0
pop edi
pop ebp
ret 8
Function at 0x101c744
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
je 0x101c805
cmp dword [ebp + 0xc], ebx
je 0x101c805
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 8
push 8
push dword [eax + 0x18]
call edi
mov esi, eax
cmp esi, ebx
jne 0x101c706
mov dword [ebp - 4], 0xc0000017
jmp 0x101c7f5
mov ebx, dword [sym.imp.ntdll.dll_NtQueryObject]
lea eax, [ebp - 8]
push eax
push 8
push esi
push 1
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jge 0x101c77f
cmp dword [ebp - 8], 0
je 0x101c7fc
cmp dword [ebp - 8], 8
jb 0x101c7fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
push dword [ebp - 8]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call edi
mov esi, eax
test esi, esi
je 0x101c6fa
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push 1
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jl 0x101c7e0
mov eax, dword fs:[0x18]
movzx ecx, word [esi]
mov eax, dword [eax + 0x30]
inc ecx
inc ecx
push ecx
push 8
push dword [eax + 0x18]
call edi
mov edi, eax
test edi, edi
jne 0x101c7a2
mov dword [ebp - 4], 0xc0000017
cmp dword [ebp - 4], 0
jl 0x101c7c7
movzx eax, word [esi]
shr eax, 1
push eax
push dword [esi + 4]
inc eax
push eax
push edi
call fcn.0101c638
mov dword [ebp - 4], eax
test eax, eax
jl 0x101c7c7
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor edi, edi
test edi, edi
je 0x101c7e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
pop edi
pop esi
jmp 0x101c80a
mov dword [ebp - 4], 0xc0000004
jmp 0x101c7e0
mov eax, 0xc000000d
pop ebx
leave
ret 8
Function at 0x101c9e4
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov edi, 0xffff
mov esi, 0x80070000
cmp dword [0x1023a18], ebx
jne 0x101c91e
push 0x10098d0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1023a18], eax
test eax, eax
jne 0x101c91e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jle 0x101c901
and eax, edi
or eax, esi
test eax, eax
jge 0x101c911
call ebx
test eax, eax
jle 0x101c90d
and eax, edi
or eax, esi
mov ebx, eax
jmp 0x101c916
mov ebx, 0x80004005
test ebx, ebx
jl 0x101c9e5
push 0
push 0xea60
push dword [0x1023a18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x101c971
cmp eax, 0x80
je 0x101c971
cmp eax, 0x102
je 0x101c96c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jle 0x101c955
and eax, edi
or eax, esi
test eax, eax
jge 0x101c965
call ebx
test eax, eax
jle 0x101c961
and eax, edi
or eax, esi
mov ebx, eax
jmp 0x101c971
mov ebx, 0x80004005
jmp 0x101c971
mov ebx, 0x80070102
xor eax, eax
cmp ebx, eax
jl 0x101c9e5
cmp dword [0x1023a1c], eax
jne 0x101c9d6
push 0x1009890
push LoadLibraryW
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor ecx, ecx
cmp eax, ecx
je 0x101c9af
push ecx
push LoadLibraryW
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [0x1023a1c], eax
test eax, eax
jne 0x101c9d6
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jle 0x101c9c1
and eax, edi
or eax, esi
test eax, eax
jge 0x101c9d1
call ebx
test eax, eax
jle 0x101c9cd
and eax, edi
or eax, esi
mov ebx, eax
jmp 0x101c9d6
mov ebx, 0x80004005
test ebx, ebx
jl 0x101c9e5
mov eax, dword [ebp + 8]
mov ecx, dword [0x1023a1c]
mov dword [eax], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x101cb8f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov esi, 0x1009594
lea edi, [ebp - 0xc]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x14], ebx
cmp ecx, ebx
je 0x101cb8e
xor edi, edi
inc edi
cmp dword [ebp + 8], 2
je 0x101ca5e
cmp dword [ebp + 8], edi
jne 0x101cb8e
cmp eax, ebx
je 0x101cb8e
xor ecx, ecx
cmp dword [ebp + 8], 2
mov word [eax], cx
jne 0x101ca73
mov ebx, edi
lea eax, [ebp - 0x14]
push eax
call fcn.0101c8bd
mov esi, eax
test esi, esi
jl 0x101cb82
lea eax, [ebp - 0x10]
push eax
call fcn.01012906
test eax, eax
je 0x101ca9d
mov ax, word [ebp - 0x10]
mov word [ebp - 0xc], ax
jmp 0x101cab9
push 0x1009a10
push 0x2000000
push 0x1023a14
mov esi, 0x800705aa
call fcn.0100a7e5
add esp, 0xc
test esi, esi
jl 0x101cb82
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
je 0x101cb2c
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x61]
movzx eax, ax
jne 0x101caf7
cmp cx, 0x19
ja 0x101caeb
sub eax, 0x20
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax*4 - 0x104], edi
jmp 0x101cb0b
cmp cx, 0x19
ja 0x101cb00
sub eax, 0x20
mov ecx, dword [ebp - 0x14]
and dword [ecx + eax*4 - 0x104], 0
push dword [ebp - 0x18]
movzx eax, word [ebp - 0x10]
push eax
push 0x1009970
push 0x4000000
push 0x1023a14
call fcn.0100a7e5
add esp, 0x14
jmp 0x101cb74
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x101cb48
and eax, edi
or eax, esi
test eax, eax
jge 0x101cb58
call ebx
test eax, eax
jle 0x101cb54
and eax, edi
or eax, esi
mov esi, eax
jmp 0x101cb5d
mov esi, 0x80004005
push 0x1009910
push 0x2000000
push 0x1023a14
call fcn.0100a7e5
add esp, 0xc
test esi, esi
jl 0x101cb82
mov ax, word [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov word [ecx], ax
push dword [ebp - 0x14]
call fcn.0101c9f3
mov eax, esi
jmp 0x101cb93
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b8d5
leave
ret 0xc