joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018ae0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc2f8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2938
call fcn.100d1260
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2944], ecx
mov dword [ebp - 0x14], 0x43297
mov dword [ebp - 0x2824], 0xffffffff
mov dword [ebp - 0x1c], 0x2800
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10018b44
mov eax, 0x800432b1
jmp 0x10018ce6
mov dword [ebp - 4], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2824], eax
cmp dword [ebp - 0x2824], 0xffffffff
jne 0x10018b80
mov eax, 0x8004329e
jmp 0x10018ce6
mov dword [ebp - 0x14], 0x43297
mov dword [ebp - 0x2828], 0
push 0
lea ecx, [ebp - 0x2828]
push ecx
push 0x2800
lea edx, [ebp - 0x2820]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x282c], eax
cmp dword [ebp - 0x282c], 0
jne 0x10018be0
mov dword [ebp - 0x14], 0x800432c3
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x293c], ecx
push 0x1014f068
lea edx, [ebp - 0x293c]
push edx
call fcn.100cb4c0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2828]
push ecx
lea edx, [ebp - 0x2820]
push edx
mov eax, dword [ebp - 0x2824]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x282c], eax
cmp dword [ebp - 0x282c], 0
jne 0x10018c38
mov dword [ebp - 0x14], 0x800432a5
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2940], ecx
push 0x1014f068
lea edx, [ebp - 0x2940]
push edx
call fcn.100cb4c0
cmp dword [ebp - 0x2828], 0x2800
je 0x10018b87
mov eax, dword [ebp - 0x2824]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2824], 0xffffffff
push 0x104
push 0
lea ecx, [ebp - 0x2938]
push ecx
call fcn.100cac20
add esp, 0xc
push 0
push 0x104
lea edx, [ebp - 0x2938]
push edx
call fcn.10090ea0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2944]
call sym.PfMgrApi.dll_public:_long_int___thiscall_CITProfileDbController::Initialize_char_const___struct__IntelDbCryptoInfo___
mov dword [ebp - 0x2948], eax
mov edx, dword [ebp - 0x2948]
mov dword [ebp - 0x14], edx
jmp 0x10018cdc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10019fa0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc42d
mov eax, dword fs:[0]
push eax
mov eax, 0x1794
call fcn.100d1260
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x17a0], ecx
mov dword [ebp - 0x168c], 0x43297
mov dword [ebp - 0x1688], 0x103
push 0x104
push 0
lea eax, [ebp - 0x1794]
push eax
call fcn.100cac20
add esp, 0xc
lea ecx, [ebp - 0x1688]
push ecx
lea edx, [ebp - 0x1794]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1001a032
mov eax, dword [ebp - 0x1688]
push eax
push str.ItAdminTool
lea ecx, [ebp - 0x1794]
push ecx
call fcn.10003f80
add esp, 0xc
lea edx, [ebp - 0x1794]
push edx
push 0
lea ecx, [ebp - 0x1684]
call sym.PfMgrApi.dll_public:_void___thiscall_CITProfileDbController::constructor_class_CEvTraceLogger___char_const__
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1684]
call sym.PfMgrApi.dll_public:_long_int___thiscall_CITProfileDbController::Initialize_void_
mov dword [ebp - 0x168c], eax
cmp dword [ebp - 0x168c], 0x43297
je 0x1001a090
mov eax, dword [ebp - 0x168c]
mov dword [ebp - 0x1798], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1684]
call sym.PfMgrApi.dll_public_virtual:_void___thiscall_CITProfileDbController::destructor_void_
mov eax, dword [ebp - 0x1798]
jmp 0x1001a0c9
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1684]
call sym.PfMgrApi.dll_public:_long_int___thiscall_CITProfileDbController::ItAdminToolExportDb_char_const__
mov dword [ebp - 0x168c], eax
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x179c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1684]
call sym.PfMgrApi.dll_public_virtual:_void___thiscall_CITProfileDbController::destructor_void_
mov eax, dword [ebp - 0x179c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.100cb090
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1001c448
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
je 0x1001c460
mov eax, dword [0x10112acc]
push eax
push 0x800432aa
mov ecx, dword [ebp - 0x10]
add ecx, 4
call sym.PfMgrApi.dll_protected:_long_int___thiscall_CProfileDbControllerBase::LogEvTrace_unsigned_long_int__char__const
jmp 0x1001c465
mov eax, 0x43297
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f0b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x230], 0
push 0x220
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.100cac20
add esp, 0xc
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x240], 0x43297
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x1001f150
mov eax, 0x8004329e
jmp 0x1001f1e0
mov dword [ebp - 0x238], 0x224
mov dword [ebp - 0x234], 0
push 0
lea edx, [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1001f1a5
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x234]
je 0x1001f1af
mov dword [ebp - 0x240], 0x80043298
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x230]
mov dword [ecx], edx
cmp dword [ebp - 0x244], 0xffffffff
je 0x1001f1da
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x244], 0xffffffff
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc76b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x10172eb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], 0x80043298
cmp dword [ebp + 8], 0
je 0x1001f98a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1001f994
mov eax, 0x8004329e
jmp 0x1001fbaf
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 0x1b4], 0
je 0x1001f9ec
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1b4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
je 0x1001f9d8
push 1
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
jmp 0x1001f9df
mov dword [ebp - 0x58], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x1b4], 0
push 0x118
call fcn.100aaa85
add esp, 4
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 0
je 0x1001fa2d
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x1010]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.10029cd0
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
jmp 0x1001fa34
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
mov dword [edx + 0x1b4], eax
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 0x1b4], 0
jne 0x1001fa60
mov eax, 0x80043298
jmp 0x1001fbaf
mov edx, dword [ebp - 0x50]
mov ecx, dword [edx + 0x1b4]
call fcn.10031a50
mov ecx, dword [ebp - 0x50]
call fcn.10025f10
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x1b4]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0
je 0x1001faa7
push 1
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
jmp 0x1001faae
mov dword [ebp - 0x6c], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x1b4], 0
mov dword [ebp - 0x14], 0x43297
jmp 0x1001fba5
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100235b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcb21
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x430
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x14], 0x400
cmp dword [ebp + 8], 0
jne 0x1002362e
push 0xa3e
push 0x1011713c
push 0x10117168
call fcn.100cb557
add esp, 0xc
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffff
jne 0x1002367b
mov dword [ebp - 0x438], 0xffffffff
push 0x1015198c
lea edx, [ebp - 0x438]
push edx
call fcn.100cb4c0
mov dword [ebp - 0x1c], 0
mov eax, 1
test eax, eax
je 0x10023728
mov dword [ebp - 0x424], 0
push 0
lea ecx, [ebp - 0x424]
push ecx
push 0x400
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x100236e5
mov dword [ebp - 0x43c], 0xffffffff
push 0x1015198c
lea ecx, [ebp - 0x43c]
push ecx
call fcn.100cb4c0
cmp dword [ebp - 0x424], 0x400
je 0x100236f3
jmp 0x10023728
mov dword [ebp - 0x18], 0
jmp 0x10023705
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x424]
jae 0x10023723
mov ecx, dword [ebp - 0x18]
movsx edx, byte [ebp + ecx - 0x420]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x100236fc
jmp 0x10023682
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x42c], 0xffffffff
jmp 0x1002376f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 4
Function at 0x10025b50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x10025b7d
push 0xec6
push 0x1011759c
push 0x101175c8
call fcn.100cb557
add esp, 0xc
push 1
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.1001ffa0
test eax, eax
jne 0x10025b9e
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x10025bb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x114], 1
cmp dword [ebp + 8], 0
jne 0x10025bf0
push 0xedd
push str..ITProfileMgrPvt.cpp
push 0x10117624
call fcn.100cb557
add esp, 0xc
push 1
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x228]
call fcn.1001ffa0
test eax, eax
je 0x10025c0f
mov eax, 1
jmp 0x10025d59
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10025d54
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.100cac20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cac20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.100cad54
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
push 0x10117654
lea edx, [ebp - 0x110]
push edx
call fcn.10003fe0
add esp, 0xc
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10025ca3
xor eax, eax
jmp 0x10025d59
mov eax, dword [ebp - 0x118]
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.100cad54
add esp, 0xc
mov edx, 1
test edx, edx
je 0x10025d54
lea eax, [ebp - 0x224]
push eax
push 0x10117658
push 0
call fcn.10003fe0
add esp, 0xc
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10025cf2
jmp 0x10025d54
push 0x1011765c
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.100cb017
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.100cb017
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x228]
call fcn.10025b50
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10025d4f
mov eax, dword [ebp - 0x114]
jmp 0x10025d59
jmp 0x10025cbe
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 4
Function at 0x10026140
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
push 0x103
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.10025a90
push 0
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.1001ffa0
test eax, eax
jne 0x100261a6
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 0x1010]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10031720
add esp, 8
jmp 0x100261ed
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.100d13f0
add esp, 8
mov ecx, dword [0x10115924]
push ecx
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.100cb017
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret

Function at 0x10026200
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
push 0x103
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.10025a90
mov ecx, dword [ebp - 0x21c]
movzx edx, byte [ecx + 0x108]
test edx, edx
je 0x1002626c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx + 0x1010]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.10031720
add esp, 8
jmp 0x100262bf
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.100d13f0
add esp, 8
mov eax, dword [0x10115924]
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cb017
add esp, 0xc
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x108], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret
Function at 0x100315c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c0]
call fcn.100163e0
cmp dword [ebp + 8], 0
jne 0x100315fb
push 0xece
push 0x1011ba60
push str.NULL___pszDriveLetter
call fcn.100cb557
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x10031618
push 0xecf
push 0x1011bab8
push str.NULL___pszRetUniqId
call fcn.100cb557
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0x2b8]
push edx
call fcn.100cac20
add esp, 0xc
mov eax, dword [str.B49CC9EFA08C]
push eax
push 0x64
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.100cad54
add esp, 0xc
mov dword [ebp - 0x10], 0x103
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0x103
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1003168e
mov dword [ebp - 0x14], 0x82f8d8cc
mov ecx, dword [ebp - 0x14]
push ecx
push 0x1011bb0c
lea edx, [ebp - 0x40]
push edx
call fcn.100cd213
add esp, 0xc
lea eax, [ebp - 0x2b8]
push eax
call fcn.10033180
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.100cac20
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10003fa0
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100cb090
add esp, 4
mov edx, dword [ebp + 0x10]
sub edx, eax
push edx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10003fc0
add esp, 0x10
lea ecx, [ebp - 0x2c0]
call fcn.100164c0
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret
Function at 0x10035800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.100cac20
add esp, 0xc
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.100cac20
add esp, 0xc
push 0
push 0x2b
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x100359c8
lea eax, [ebp - 0x110]
push eax
push 0x103
lea ecx, [ebp - 0x218]
push ecx
call fcn.100cad54
add esp, 0xc
push str.IntelWirelessCommon_
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.100cb017
add esp, 0xc
mov eax, dword [ebp + 8]
and eax, 1
je 0x100358e5
lea ecx, [ebp - 0x218]
push ecx
push 0x103
lea edx, [ebp - 0x110]
push edx
call fcn.100cad54
add esp, 0xc
push 0x1011bc84
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.100cb017
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp + 8]
and edx, 2
jne 0x100358f5
mov eax, dword [ebp + 8]
and eax, 4
je 0x10035936
lea ecx, [ebp - 0x218]
push ecx
push 0x103
lea edx, [ebp - 0x110]
push edx
call fcn.100cad54
add esp, 0xc
push 0x1011bc94
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.100cb017
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp + 8]
and edx, 4
je 0x1003597f
lea eax, [ebp - 0x218]
push eax
push 0x103
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cad54
add esp, 0xc
push 0x1011bca4
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.100cb017
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 8]
and ecx, 8
je 0x100359c8
lea edx, [ebp - 0x218]
push edx
push 0x103
lea eax, [ebp - 0x110]
push eax
call fcn.100cad54
add esp, 0xc
push 0x1011bcb4
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cb017
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret
Function at 0x10054f70
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10054ff0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10054fe6
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret

Function at 0x10057b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ffdab
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x10172eb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x43297
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 0xc], 0
jne 0x10057b7a
mov eax, 0x800432b1
jmp 0x10057c79
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10057b92
mov eax, 0x8004329e
jmp 0x10057c79
mov dword [ebp - 4], 0
push 0x12c
call fcn.100aaa85
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], 0
je 0x10057bce
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10069620
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
jmp 0x10057bd5
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x10057bf5
mov eax, 0x800432b4
jmp 0x10057c79
mov edx, dword [ebp + 0xc]
push edx
call fcn.1008d9a0
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.100698f0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
je 0x10057c45
push 1
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
jmp 0x10057c4c
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x14], 0
je 0x10057c59
mov eax, 0x800432a7
jmp 0x10057c79
jmp 0x10057c6f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret