joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d03b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x101e33ac
call fcn.10042430
sub esp, 0x224
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 0x14]
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.1003e2c4
and dword [ebp - 4], 0
mov esi, 0x1024005c
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
push dword [esi]
call fcn.1000d240
test eax, eax
je 0x1000d111
and word [ebp - 0x230], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22e]
rep stosd dword es:[edi], eax
push 0
push dword [ebp - 0x10]
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000d111
lea eax, [ebp - 0x230]
push eax
call fcn.10041fde
cmp word [ebp + eax*2 - 0x232], 0x5c
pop ecx
lea eax, [ebp - 0x230]
push eax
jne 0x1000d0d7
call fcn.10041fde
jmp 0x1000d0f3
call fcn.10041fde
mov word [ebp + eax*2 - 0x230], 0x5c
lea eax, [ebp - 0x230]
push eax
call fcn.10041fde
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x230], 0x2a
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
lea edx, [ebp - 0x230]
push edx
push eax
call fcn.10062a70
add esi, 4
cmp esi, str..LNK
jb 0x1000d067
lea esi, [ebx + 4]
mov edi, 0x10240020
mov eax, dword [edi]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.10062a70
add edi, 4
cmp edi, 0x1024005c
jb 0x1000d128
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push str.CSIDL_PROGRAM_FILES
mov ecx, ebx
call fcn.1000d240
test eax, eax
je 0x1000d221
and word [ebp - 0x230], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22e]
rep stosd dword es:[edi], eax
push 0
push dword [ebp - 0x18]
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000d221
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x10]
push eax
call fcn.1005ae80
push 0x5c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1005f1e0
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.1005c900
cmp eax, 0xffffffff
je 0x1000d215
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1005dec0
lea eax, [ebp - 0x14]
push 0x1024011c
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.1005be50
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.1005b8a0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1005b6f0
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.10062b60
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005b6f0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1005b6f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1003e300
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000d30f
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
mov ebx, ecx
cmp dword [esi + 4], edi
jle 0x1000d344
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1000d33e
mov eax, dword [esi]
mov ecx, ebx
push dword [eax + edi*4]
call fcn.1000d2a6
test eax, eax
je 0x1000d34d
inc edi
cmp edi, dword [esi + 4]
jl 0x1000d31f
push 1
pop eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
jmp 0x1000d347

Function at 0x100102a9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10043160
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x100102e1
push 1
pop eax
jmp 0x10010388
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x1001034c
cmp byte [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10010307
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x10010303
cmp byte [edi + 0x2e], 0
je 0x10010364
test al, al
je 0x10010364
push ecx
call fcn.10043160
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10010364
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.10043080
push 0x102409f8
push esi
call fcn.10043080
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.100102a9
add esp, 0x20
mov byte [ebx + esi - 1], 0x2a
and byte [ebx + esi], 0
mov dword [ebp + 8], eax
jmp 0x10010364
push dword [ebp + 0x14]
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov byte [ebx + esi - 1], 0x2a
cmp dword [ebp + 8], 0
je 0x1001037c
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100102e8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001044b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10041fde
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10010483
push 1
pop eax
jmp 0x10010537
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x100104f8
cmp word [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x100104af
mov ax, word [edi + 0x2e]
cmp ax, 0x2e
jne 0x100104aa
cmp word [edi + 0x30], 0
je 0x10010513
test ax, ax
je 0x10010513
push ecx
call fcn.10041fde
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10010513
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.10041f8f
push 0x1023b8d0
push esi
call fcn.10041f8f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.1001044b
add esp, 0x20
mov word [esi + ebx*2 - 2], 0x2a
and word [esi + ebx*2], 0
mov dword [ebp + 8], eax
jmp 0x10010513
push dword [ebp + 0x14]
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov word [esi + ebx*2 - 2], 0x2a
cmp dword [ebp + 8], 0
je 0x1001052b
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001048a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010d10
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10010ea0
push ebx
call fcn.10041fde
test eax, eax
pop ecx
je 0x10010ea0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10010ea0
test al, 1
je 0x10010d58
and al, 0xfe
push eax
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp + 8], 0x10
je 0x10010e84
and word [ebp - 0x660], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x65e]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x660]
push eax
call fcn.10041fb9
lea eax, [ebp - 0x660]
push 0x1023b8d0
push eax
call fcn.10041f8f
and dword [ebp - 0x250], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x24c]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10010e7a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x224]
push 0x10240a2c
push eax
call edi
test eax, eax
je 0x10010e59
lea eax, [ebp - 0x224]
push 0x10240a28
push eax
call edi
test eax, eax
je 0x10010e59
and word [ebp - 0x458], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x458]
push ebx
push eax
call fcn.10041fb9
lea eax, [ebp - 0x458]
push 0x1023944c
push eax
call fcn.10041f8f
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.10041f8f
push dword [ebp + 0xc]
lea eax, [ebp - 0x458]
push eax
call fcn.10010d10
add esp, 0x20
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10010dd3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
jmp 0x10010e8b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10010ea2
cmp dword [ebp + 0xc], eax
je 0x10010ea2
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x10010ea2
xor eax, eax
pop ebx
leave
ret
Function at 0x10010ea5
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10011060
push esi
call fcn.10041fde
test eax, eax
pop ecx
je 0x10011060
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.1000e7cb
add esp, 0x1c
test eax, eax
je 0x10011060
cmp dword [ebp - 4], 0xffffffff
je 0x10011060
test byte [ebp - 4], 1
je 0x10010f07
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 4], 0x10
je 0x10011044
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x666]
mov word [ebp - 0x668], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x668]
push eax
call fcn.10041fb9
lea eax, [ebp - 0x668]
push 0x1023b8d0
push eax
call fcn.10041f8f
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x45c]
mov dword [ebp - 0x460], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10011029
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x434]
push 0x10240a2c
push eax
call edi
test eax, eax
je 0x10011008
lea eax, [ebp - 0x434]
push 0x10240a28
push eax
call edi
test eax, eax
je 0x10011008
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
call fcn.10041fb9
lea eax, [ebp - 0x210]
push 0x1023944c
push eax
call fcn.10041f8f
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.10041f8f
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call fcn.10010ea5
add esp, 0x20
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10010f84
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, ebx
pop edi
jne 0x10011062
cmp dword [ebp + 0xc], ebx
je 0x10011062
push 4
push ebx
push dword [ebp + 8]
jmp 0x10011058
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebx
jne 0x10011062
cmp dword [ebp + 0xc], ebx
je 0x10011062
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x10011062
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x100114d7
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, dword [ebp + 0xc]
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1001150b
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
push edi
jmp 0x100115c8
test bl, 1
je 0x1001151b
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x100115b4
and word [ebp - 0x404], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x402]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
mov ebx, str._s.bak_08X
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.1004244f
and dword [ebp - 4], 0
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0xffffffff
je 0x100115a4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
lea eax, [ebp - 0x404]
push dword [ebp + 0xc]
push ebx
push eax
call fcn.1004244f
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x1001156b
xor eax, eax
jmp 0x100115d0
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp + 0xc]
mov esi, eax
call fcn.10012d79
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100115d5
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, dword [ebp + 0xc]
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10011609
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
push edi
jmp 0x100116c6
test bl, 1
je 0x10011619
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x100116b2
and word [ebp - 0x404], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x402]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
mov ebx, str._s.bak_08X
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.1004244f
and dword [ebp - 4], 0
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0xffffffff
je 0x100116a2
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
lea eax, [ebp - 0x404]
push dword [ebp + 0xc]
push ebx
push eax
call fcn.1004244f
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x10011669
xor eax, eax
jmp 0x100116ce
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp + 0xc]
mov esi, eax
call fcn.10012db3
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10011c5c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
call fcn.10070170
test eax, eax
je 0x10011c79
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
je 0x10011ce2
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x10011ce2
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.10042530
push esi
call fcn.101d42d4
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10011ce2
push esi
push ebx
push edi
call fcn.10042530
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x10011ce2
push esi
xor ebx, ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
call fcn.10034c24
add esp, 0x10
test eax, eax
je 0x10011ce2
push dword [ebp + 0xc]
call fcn.10041fde
pop ecx
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x10011d2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov edi, 0x200
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 1
jne 0x10011d56
mov edi, 0x400
cmp dword [ebp - 4], 2
jne 0x10011d96
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 0x24]
push 0x18
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10011de0
mov edi, dword [ebp - 0x10]
cmp edi, 0x200
jb 0x10011de0
push edi
call fcn.101d42d4
push edi
push ebx
push eax
mov dword [esi], eax
call fcn.10042530
add esp, 0x10
lea eax, [ebp - 0xc]
push ebx
push eax
push edi
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10011dd8
push dword [esi]
call fcn.101d42fd
inc dword [ebp - 4]
pop ecx
cmp dword [ebp - 4], 3
mov dword [esi], ebx
jl 0x10011d4b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10011de8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and word [ebp - 0x210], 0
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x1023ce14
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
xor edi, edi
test esi, esi
je 0x10011e25
cmp esi, 1
jne 0x10011e33
call fcn.10070120
test eax, eax
jne 0x10011e33
push 4
pop edi
jmp 0x10011e9e
lea eax, [ebp - 0x210]
push 0x103
push eax
lea eax, [ebp - 8]
add esi, 0x41
push eax
mov word [ebp - 8], si
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x10011e9c
cmp eax, 0x104
jae 0x10011e9c
lea eax, [ebp - 0x210]
push eax
call fcn.10043705
lea eax, [ebp - 0x210]
mov dword [esp], str.cdrom
push eax
call fcn.10043489
pop ecx
test eax, eax
pop ecx
je 0x10011e83
push 5
pop edi
lea eax, [ebp - 0x210]
push str.floppy
push eax
call fcn.10043489
pop ecx
test eax, eax
pop ecx
je 0x10011e9e
jmp 0x10011e2e
xor edi, edi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10011ea4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
xor eax, eax
cmp ebx, esi
je 0x10012022
cmp dword [ebp + 0x10], 0x200
jne 0x10012022
push edi
push 7
pop ecx
lea edi, [ebp - 0x2a]
mov word [ebp - 0x2c], si
push 0x20
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp + 0x10], esi
call fcn.10042530
mov eax, dword [0x1023fd8c]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [0x1023fd90]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0x41
push 0x10
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 5
test eax, eax
pop edi
je 0x10011ff2
lea eax, [ebp - 0x2c]
push eax
call fcn.10041fde
lea esi, [ebx + 0x36]
push edi
push str.FAT16
push esi
mov dword [ebp + 0xc], eax
call fcn.10052710
add esp, 0x10
test eax, eax
jne 0x10011f8c
cmp dword [ebp + 0xc], edi
jne 0x10011f6b
push edi
lea eax, [ebp - 0x2c]
push 0x10240b10
push eax
call fcn.10042f6b
add esp, 0xc
test eax, eax
je 0x10011f88
cmp dword [ebp + 0xc], 3
jne 0x10011f8c
push 3
lea eax, [ebp - 0x2c]
push 0x10240b08
push eax
call fcn.10042f6b
add esp, 0xc
test eax, eax
jne 0x10011f8c
push 3
jmp 0x10011fef
push edi
push str.FAT12
push esi
call fcn.10052710
add esp, 0xc
test eax, eax
jne 0x10011fbc
cmp dword [ebp + 0xc], 3
jne 0x10011fbc
push 3
lea eax, [ebp - 0x2c]
push 0x10240b08
push eax
call fcn.10042f6b
add esp, 0xc
test eax, eax
je 0x10011f88
push edi
lea eax, [ebx + 0x52]
push str.FAT32
push eax
call fcn.10052710
add esp, 0xc
test eax, eax
jne 0x10011ff2
cmp dword [ebp + 0xc], edi
jne 0x10011ff2
push edi
lea eax, [ebp - 0x2c]
push 0x10240aec
push eax
call fcn.10042f6b
add esp, 0xc
test eax, eax
jne 0x10011ff2
push 2
pop eax
jmp 0x10012021
lea esi, [ebx + 3]
push edi
push str.EXFAT
push esi
call fcn.10052710
add esp, 0xc
test eax, eax
jne 0x1001200c
mov eax, edi
jmp 0x10012021
push 4
push str.NTFS
push esi
call fcn.10052710
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100138e4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2818
call fcn.10042a40
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
je 0x10013a12
push esi
lea eax, [ebp - 0x14]
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
lea eax, [ebp - 0x2818]
push 0x2800
push eax
push 2
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x10013971
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100139f1
mov edi, dword [ebp - 0x14]
push edi
call fcn.101d42d4
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x100139f1
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 8]
push 2
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x100139f1
lea eax, [ebp - 4]
mov byte [ebp - 0x10], bl
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x10]
push 2
push eax
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100139f1
xor esi, esi
cmp dword [ebp - 0x2818], ebx
jbe 0x100139f1
lea edi, [ebp - 0x2814]
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x100139d2
inc esi
add edi, 8
cmp esi, dword [ebp - 0x2818]
jb 0x100139b5
jmp 0x100139f1
mov eax, dword [ebp + esi*8 - 0x2810]
push 1
pop ecx
test al, 8
mov dword [ebp - 0x18], ecx
je 0x100139e8
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
test al, 4
je 0x100139f1
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
cmp dword [ebp - 4], ebx
pop edi
pop esi
je 0x10013a04
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x10013a12
push dword [ebp - 8]
call fcn.101d42fd
pop ecx
mov eax, dword [ebp - 0x18]
pop ebx
leave
ret