joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f2de985
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2de9ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x7f2deb38
mov eax, dword [ebp + 8]
cmp eax, 0xffff
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, 0x7f2d2c28
jbe 0x7f2dea6d
push eax
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2de9fc
mov eax, dword [0x7f307088]
imul eax, esi
test eax, eax
je 0x7f2de9fc
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2dea00
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x7f2dea70
xor eax, eax
cmp dword [0x7f307acc], eax
mov dword [ebp - 0xc], eax
jne 0x7f2dea1e
cmp byte [0x7f30708d], al
mov dword [ebp - 8], eax
je 0x7f2dea25
mov dword [ebp - 8], 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2dea39
mov eax, dword [0x7f307084]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push ebx
push ecx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push dword [ebp - 8]
push eax
call edi
cmp dword [ebp - 0xc], 0
jne 0x7f2dea69
test eax, eax
je 0x7f2dea69
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2dea70
push 0x7b
jmp 0x7f2dea61
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2deb26
push eax
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2deab6
mov eax, dword [0x7f307088]
imul eax, esi
test eax, eax
je 0x7f2deab6
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp + 8], esp
jmp 0x7f2deaba
and dword [ebp + 8], 0
xor eax, eax
cmp dword [ebp + 8], eax
je 0x7f2deb29
cmp dword [0x7f307acc], eax
mov dword [ebp - 8], eax
jne 0x7f2dead7
cmp byte [0x7f30708d], al
mov dword [ebp - 0xc], eax
je 0x7f2deade
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2deaf2
mov eax, dword [0x7f307084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push ebx
push ecx
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push eax
call edi
cmp dword [ebp - 8], 0
jne 0x7f2deb22
test eax, eax
je 0x7f2deb22
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2deb29
push 0x7b
jmp 0x7f2deb1a
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2ded58
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2ded7a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x7f2dee42
mov edi, dword [ebp + 8]
cmp edi, 0xffff
jbe 0x7f2dee29
push edi
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2dedc0
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, ebx
je 0x7f2dedc0
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
jmp 0x7f2dedc2
xor edi, edi
cmp edi, ebx
je 0x7f2dee2f
cmp dword [0x7f307acc], ebx
mov dword [ebp - 4], ebx
jne 0x7f2dedda
cmp byte [0x7f30708d], 0
je 0x7f2deddf
mov ebx, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2dedf3
mov eax, dword [0x7f307084]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push 0x7f2d2c28
push ecx
push edi
push esi
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 4], 0
jne 0x7f2dee21
test eax, eax
je 0x7f2dee21
push 0
jmp 0x7f2dee23
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp edi, ebx
jne 0x7f2dee38
cmp dword [ebp + 8], ebx
je 0x7f2dee38
xor eax, eax
jmp 0x7f2dee42
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7f2dee4c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2dee72
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x7f2df012
mov eax, dword [ebp + 8]
cmp eax, 0xffff
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jbe 0x7f2def2b
push eax
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2deebe
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, edi
je 0x7f2deebe
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2deec1
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x7f2def33
cmp dword [0x7f307acc], edi
mov dword [ebp - 8], edi
jne 0x7f2deeda
cmp byte [0x7f30708d], 0
je 0x7f2deedf
mov edi, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2deef3
mov eax, dword [0x7f307084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push 0x7f2d2c28
push ecx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x7f2def27
test eax, eax
je 0x7f2def27
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7f2def2e
push 0x7b
jmp 0x7f2def1d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jne 0x7f2def3f
cmp dword [ebp + 8], edi
je 0x7f2def3f
xor eax, eax
jmp 0x7f2df012
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2deff2
push eax
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2def85
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, edi
je 0x7f2def85
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp + 8], esp
jmp 0x7f2def88
mov dword [ebp + 8], edi
cmp dword [ebp + 8], edi
je 0x7f2deffa
cmp dword [0x7f307acc], edi
mov dword [ebp - 8], edi
jne 0x7f2defa1
cmp byte [0x7f30708d], 0
je 0x7f2defa6
mov edi, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2defba
mov eax, dword [0x7f307084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push 0x7f2d2c28
push ecx
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x7f2defee
test eax, eax
je 0x7f2defee
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7f2deff5
push 0x7b
jmp 0x7f2defe4
mov dword [ebp + 8], eax
cmp dword [ebp + 8], edi
jne 0x7f2df003
cmp dword [ebp + 0xc], edi
jne 0x7f2def38
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2df27f
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2df2a2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
jmp 0x7f2df317
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2df307
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2df2e7
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2df2e7
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2df2e9
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2df307
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x7f2df3bd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2df3ef
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x7f2df470
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2df454
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2df434
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2df434
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2df436
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2df454
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x7f2df9de
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2df9fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x7f2dfab3
mov edi, dword [ebp + 8]
cmp edi, 0xffff
jbe 0x7f2dfaac
push edi
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2dfa43
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, ebx
je 0x7f2dfa43
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
jmp 0x7f2dfa45
xor edi, edi
cmp edi, ebx
je 0x7f2dfaac
cmp dword [0x7f307acc], ebx
mov dword [ebp - 4], ebx
jne 0x7f2dfa5d
cmp byte [0x7f30708d], 0
je 0x7f2dfa62
mov ebx, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2dfa76
mov eax, dword [0x7f307084]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push 0x7f2d2c28
push ecx
push edi
push esi
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 4], 0
jne 0x7f2dfaa4
test eax, eax
je 0x7f2dfaa4
push 0
jmp 0x7f2dfaa6
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7f2dfabd
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x7f307090]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp + 0x198], eax
xor edi, edi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x1a4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
cmp dword [ebp + 0x1a8], ebx
mov dword [ebp - 0x7c], eax
jne 0x7f2dd54f
cmp eax, ebx
jne 0x7f2dd462
xor eax, eax
jmp 0x7f2dd581
push dword [eax + 0x18]
call esi
cmp eax, ebx
mov dword [ebp - 0x78], eax
je 0x7f2dd540
push ebx
push ebx
lea ecx, [ebp - 0x80]
push ecx
push eax
push 0x208
lea eax, [ebp - 0x70]
push eax
call fcn.7f2dbf3d
cmp eax, ebx
jge 0x7f2dd49a
and eax, 0xffff
mov edi, eax
mov dword [ebp - 0x74], edi
jmp 0x7f2dd534
mov eax, dword [ebp - 0x80]
dec eax
cmp byte [eax], 0x5c
je 0x7f2dd4aa
lea ecx, [ebp - 0x70]
cmp eax, ecx
jae 0x7f2dd49d
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov byte [eax + 1], bl
lea eax, [ebp - 0x70]
push eax
push ebx
mov edi, 0x7f2d214c
push edi
push eax
call esi
test eax, eax
lea eax, [ebp - 0x70]
push eax
jne 0x7f2dd4fe
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x7f2dd4e3
mov byte [ebp - 0x70], 0x2e
mov byte [ebp - 0x6f], 0x5c
mov byte [ebp - 0x6e], bl
lea eax, [ebp - 0x70]
push eax
push ebx
push edi
push eax
call esi
test eax, eax
jne 0x7f2dd4fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x7f2dd534
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x1a4]
call fcn.7f2dd1a6
mov edi, eax
cmp edi, ebx
jne 0x7f2dd527
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x7f2dd534
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x7c]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x7c]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x7f2dd565
push eax
call fcn.7f2daf20
push dword [ebp + 0x1a4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x1a4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp edi, ebx
sete al
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
pop ebx
call fcn.7f2fd123
add ebp, 0x19c
leave
ret 8
jmp 0x7f2dd410
cmp dword [0x7f307acc], 0
je 0x7f2dfaf5
cmp dword [0x7f3078fc], 0
jne 0x7f2dfae2
push 0x7f2d2c74
call fcn.7f2d3fba
test eax, eax
mov dword [0x7f3078fc], eax
je 0x7f2dfae8
jmp dword [0x7f3079dc]
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret 8
jmp 0x7f2dd8c4
Function at 0x7f2dfafa
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
cmp dword [0x7f307acc], 0
je 0x7f2dfb2e
mov eax, dword [0x7f3079dc]
test eax, eax
jne 0x7f2dfb1f
push 0x7f2d2c88
call fcn.7f2d3fba
test eax, eax
mov dword [0x7f3079dc], eax
je 0x7f2dfb21
jmp eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret 8
jmp 0x7f2dd410
Function at 0x7f2dfe7f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x7f307090]
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
mov dword [ebp + 0x394], eax
je 0x7f2dfeba
push dword [ebp + 0x3a4]
push dword [ebp + 0x3a0]
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
jmp 0x7f2e0067
cmp dword [ebp + 0x3a0], ebx
mov dword [ebp - 0x74], ebx
jne 0x7f2dfed4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7f2e0067
mov eax, dword [ebp + 0x3a4]
cmp eax, 1
je 0x7f2dfeeb
cmp eax, 2
je 0x7f2dfeeb
push 0x3ec
jmp 0x7f2dfec7
and eax, 1
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x70]
push eax
push 1
push ebx
push 0x7f2d2d10
push OleUIChangeIconA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x7f2dff13
push 0x3f1
jmp 0x7f2dfec7
push esi
push edi
push 0x40
pop ecx
xor eax, eax
push 0x40
lea edi, [ebp + 0x294]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp + 0x194]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp + 0x294]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, 0x100
jmp 0x7f2e0008
test eax, eax
jne 0x7f2e007d
cmp dword [ebp + 0x3a4], 6
jae 0x7f2dffcb
cmp byte [ebp + 0x294], 0x30
jl 0x7f2dffcb
cmp byte [ebp + 0x294], 0x39
jg 0x7f2dffcb
cmp dword [ebp - 0x7c], eax
je 0x7f2dff8c
cmp byte [ebp + 0x194], al
je 0x7f2dffcb
xor eax, eax
push 0xff
mov ecx, 0x80
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x294]
push eax
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x6c]
push eax
call dword [ebp + 0x3a0]
cmp eax, 1
jne 0x7f2e0059
inc dword [ebp - 0x74]
push 0x40
pop ecx
xor eax, eax
push 0x40
lea edi, [ebp + 0x294]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp + 0x194]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp + 0x294]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
mov dword [ebp + 0x3a4], esi
mov dword [ebp - 0x78], esi
call ebx
cmp eax, 0x103
jne 0x7f2dff5c
push 0x7f2d2d04
call dword [ebp + 0x3a0]
test eax, eax
je 0x7f2e0059
push 0x7f2d2cf8
call dword [ebp + 0x3a0]
test eax, eax
je 0x7f2e0059
cmp dword [ebp - 0x7c], 0
je 0x7f2e004e
call fcn.7f2d41eb
test eax, eax
je 0x7f2e0059
push 0x7f2d2cec
call dword [ebp + 0x3a0]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x394]
pop ebx
call fcn.7f2fd123
add ebp, 0x398
leave
ret 8
push 0x3f1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x7f2e0065
Function at 0x7f2e01ac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e01d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x7f2e02c7
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e0201
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
cmp eax, edi
je 0x7f2e0201
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2e0204
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e0269
push ebx
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e0246
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, edi
je 0x7f2e0246
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e0248
xor ebx, ebx
cmp ebx, edi
je 0x7f2e026d
mov eax, dword [0x7f307088]
imul eax, esi
push edi
push edi
push eax
push ebx
push esi
push dword [ebp + 8]
push edi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, edi
jne 0x7f2e0272
cmp dword [ebp + 8], edi
jne 0x7f2e027c
cmp dword [ebp + 0x10], edi
jbe 0x7f2e0280
cmp dword [ebp - 4], edi
jne 0x7f2e0280
xor eax, eax
jmp 0x7f2e02c7
mov ecx, dword [0x7f307088]
imul ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
push dword [ebp + 0x10]
mov edx, ecx
push dword [ebp - 4]
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, dword [ebp + 0x10]
ja 0x7f2e02c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp - 4]
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2e0d6f
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2e0d90
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x7f2e0e26
mov eax, dword [0x7f307088]
shl eax, 4
push eax
mov dword [ebp - 4], eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e0dbd
cmp dword [ebp - 4], 0
je 0x7f2e0dbd
mov eax, dword [ebp - 4]
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e0dbf
xor ebx, ebx
xor eax, eax
test ebx, ebx
je 0x7f2e0e26
mov ecx, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edi, eax
test edi, edi
je 0x7f2e0e1c
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
cmp ecx, eax
jb 0x7f2e0e0e
push ecx
push dword [ebp + 8]
inc eax
push eax
push ebx
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esi], eax
jmp 0x7f2e0e24
push 0x6f
mov dword [esi], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2e0e24
mov eax, dword [ebp + 8]
mov word [eax], 0x30
mov eax, edi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7f2e139b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e13b9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x7f2e142e
mov eax, dword [0x7f307088]
mov ebx, dword [ebp + 8]
imul eax, ebx
inc eax
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e13ec
mov eax, esi
imul eax, ebx
inc eax
cmp eax, edi
je 0x7f2e13ec
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
test edi, edi
jne 0x7f2e13f4
xor eax, eax
jmp 0x7f2e142e
imul esi, ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x7f2e141f
push ebx
push dword [ebp + 0xc]
inc eax
push eax
push edi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e142e
dec eax
jmp 0x7f2e142e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x7f2e142e
test ebx, ebx
jbe 0x7f2e142e
and word [ecx], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e162d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2e1653
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x7f2e16cb
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e16b8
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e1698
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e1698
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e169a
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2e16b8
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x7f2e17de
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2e17f8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x7f2e1864
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e185d
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e183d
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e183d
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e183f
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2e185d
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4