joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101caaf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10275120
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp dword [esi + 0x74], 0
jbe 0x101cab7e
push 0x102b3d90
lea ecx, [esp + 8]
call fcn.100044a0
mov dword [esp + 0x38], 0
lea eax, [esi + 0x64]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.101e8050
add esp, 8
mov byte [esp + 0x38], 1
mov ecx, eax
call fcn.10003840
lea edx, [esp + 4]
push edx
push edi
mov ecx, eax
call fcn.101cc5a0
mov byte [esp + 0x38], 0
lea ecx, [esp + 0xc]
call fcn.10002d20
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 4]
call fcn.10004720
cmp dword [esi + 0x88], 0
jbe 0x101cabe6
push 0x102b3d98
lea ecx, [esp + 8]
call fcn.100044a0
mov dword [esp + 0x38], 2
lea eax, [esi + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.101e8050
add esp, 8
mov byte [esp + 0x38], 3
mov ecx, eax
call fcn.10003840
lea edx, [esp + 4]
push edx
push edi
mov ecx, eax
call fcn.101cc5a0
mov byte [esp + 0x38], 2
lea ecx, [esp + 0xc]
call fcn.10002d20
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 4]
call fcn.10004720
cmp byte [esi + 0x60], 0
je 0x101cac43
push str.true
lea ecx, [esp + 0xc]
call fcn.100044a0
mov dword [esp + 0x38], 4
push str.optional
lea ecx, [esp + 8]
call fcn.100044a0
mov byte [esp + 0x38], 5
lea eax, [esp + 4]
push eax
push edi
lea ecx, [esp + 0x10]
call fcn.101cc5a0
mov byte [esp + 0x38], 4
lea ecx, [esp + 4]
call fcn.10004720
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
call fcn.10004720
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x101d0440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102711ed
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 4]
mov dword [esi], vtable.CDevDriverSnapshot.0
call fcn.10056ab0
xor edi, edi
mov dword [esp + 0x14], edi
lea ecx, [esi + 0x20]
call fcn.10002d80
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x24]
call fcn.10002d80
mov byte [esp + 0x14], 2
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea ecx, [esi + 0x48]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.10002d80
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x4c]
call fcn.10002d80
mov byte [esp + 0x14], 4
mov eax, 0xa
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov byte [esp + 0x14], 5
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x101d0a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10271131
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.10055790
mov dword [esp + 0x30], 1
add eax, 0x18
push eax
mov ecx, esi
call fcn.100047f0
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
lea ecx, [esp + 0xc]
call fcn.10056b10
mov ecx, esi
call fcn.1008ee00
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x101d68a0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x10250060
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.10187400
movzx eax, word [eax + 2]
push 0
push 0
movzx edi, ax
push 3
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
test esi, esi
jne 0x101d6903
push str.Error_retrieving_language_information_size
push 0xc4
push str..XmlDocParser.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10054b00
lea ecx, [esp + 0x14]
call fcn.10002d80
mov dword [esp + 0x24], 0
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x101d6937
push esi
lea ecx, [esp + 0x18]
call fcn.100042e0
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x18]
mov ebp, edx
call fcn.10004360
push esi
push ebp
push 3
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x101d696d
push str.Error_retrieving_language_information
push 0xd5
push str..XmlDocParser.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10054b00
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.102318e6
add esp, 8
push eax
lea ecx, [esp + 0x18]
call fcn.10004360
push str.AbbrevLangName
lea ecx, [esp + 0x1c]
call fcn.100044a0
mov byte [esp + 0x24], 1
mov eax, dword [ebx]
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
mov ecx, ebx
call eax
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x18]
call fcn.10004720
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10004720
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x101da1e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x102524e9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x101da24b
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.100047f0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
jne 0x101da286
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.100047f0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.101da080
add esp, 8
mov dword [esp + 0x18], 1
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.101d9e30
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.101da130
add esp, 8
mov byte [esp + 0x18], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.10054e60
mov byte [esp + 0x18], 1
lea ecx, [esp + 0xc]
call fcn.10004720
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.100047f0
mov dword [esp + 8], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x28]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x101db600
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10250ec9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x103b7524
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10003eb0
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x101db673
push esi
lea ecx, [esp + 0x14]
call fcn.100042e0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10004360
push edi
push esi
call ebp
test eax, eax
je 0x101db6f7
cmp eax, esi
je 0x101db6f7
jb 0x101db691
mov esi, eax
jmp 0x101db650
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x101db6b2
push 0
push 0x84a
push str..FilePath.cpp
push 0x80004005
call fcn.100048f0
push eax
lea ecx, [esp + 0x14]
call fcn.10004360
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10056360
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100563c0
int3
Function at 0x101db820
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10250ec9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x103b7524
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10003eb0
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x101db893
push esi
lea ecx, [esp + 0x14]
call fcn.100042e0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10004360
push esi
push edi
call ebp
test eax, eax
je 0x101db917
cmp eax, esi
je 0x101db917
jb 0x101db8b1
mov esi, eax
jmp 0x101db870
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x101db8d2
push 0
push 0x882
push str..FilePath.cpp
push 0x80004005
call fcn.100048f0
push eax
lea ecx, [esp + 0x14]
call fcn.10004360
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10056360
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100563c0
int3

Function at 0x101db930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10250f11
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.101db710
add esp, 4
mov dword [esp + 0x30], 1
mov esi, dword [esp + 0x38]
push 0x102c5534
push esi
lea ecx, [esp + 0x14]
call fcn.10055a70
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
lea ecx, [esp + 0xc]
call fcn.10056b10
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x101db9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10250f11
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.101db710
add esp, 4
mov dword [esp + 0x30], 1
mov esi, dword [esp + 0x38]
push str.system
push esi
lea ecx, [esp + 0x14]
call fcn.10055a70
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
lea ecx, [esp + 0xc]
call fcn.10056b10
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x101dba30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10250ec9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x103b7524
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10003eb0
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x101dbaa3
push esi
lea ecx, [esp + 0x14]
call fcn.100042e0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10004360
push edi
push esi
call ebp
test eax, eax
je 0x101dbb27
cmp eax, esi
je 0x101dbb27
jb 0x101dbac1
mov esi, eax
jmp 0x101dba80
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x101dbae2
push 0
push 0x8bc
push str..FilePath.cpp
push 0x80004005
call fcn.100048f0
push eax
lea ecx, [esp + 0x14]
call fcn.10004360
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10056360
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100563c0
int3

Function at 0x101dbb40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10250ec9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x103b7524
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10003eb0
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x101dbbb3
push esi
lea ecx, [esp + 0x14]
call fcn.100042e0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10004360
push esi
push edi
call ebp
test eax, eax
je 0x101dbc37
cmp eax, esi
je 0x101dbc37
jb 0x101dbbd1
mov esi, eax
jmp 0x101dbb90
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x101dbbf2
push 0
push 0x8ea
push str..FilePath.cpp
push 0x80004005
call fcn.100048f0
push eax
lea ecx, [esp + 0x14]
call fcn.10004360
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10056360
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100563c0
int3
Function at 0x101dbe30
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x10250fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
push 0
lea eax, [esp + 0x2c]
push eax
call fcn.101db290
mov dword [esp + 0x4c], 0
mov eax, dword [eax + 0x18]
push 0
push 0x10000000
push 3
push 0
push 5
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebx, 2
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x28]
call fcn.10056b10
or ebp, 0xffffffff
cmp esi, ebp
jne 0x101dbeaf
push 0
push 0
call fcn.100563c0
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x101dbec6
push eax
push eax
call fcn.100563c0
mov eax, dword [esp + 0x20]
mov edi, eax
cmp eax, 0x138
jb 0x101dbfa6
push 0
push 0
push 0
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4c], 3
cmp eax, ebp
je 0x101dbef8
test eax, eax
jne 0x101dbf01
push 0
push 0
call fcn.100563c0
push edi
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x18], eax
mov byte [esp + 0x4c], 4
test eax, eax
jne 0x101dbf23
push eax
push eax
call fcn.100563c0
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x101dbf8b
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x40
jb 0x101dbf8b
add edi, 0xffffff08
cmp edi, ecx
jb 0x101dbf8b
cmp dword [ecx + eax], 0x4550
jne 0x101dbf8b
movzx esi, word [ecx + eax + 4]
mov byte [esp + 0x4c], 3
lea ecx, [esp + 0x18]
call fcn.101da460
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x1c]
call fcn.1004c300
mov dword [esp + 0x4c], ebp
lea ecx, [esp + 0x14]
call fcn.101a5820
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov byte [esp + 0x4c], 3
lea ecx, [esp + 0x18]
call fcn.101da460
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x1c]
call fcn.1004c300
mov dword [esp + 0x4c], ebp
lea ecx, [esp + 0x14]
call fcn.101a5820
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x101dbfd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10250fe1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [esi + 0x18]
cmp dword [eax - 0xc], 0
je 0x101dc10c
call fcn.101da560
test al, al
je 0x101dc10c
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.101dab00
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x2c]
mov ecx, 0x102abd94
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101dc05e
test dx, dx
je 0x101dc05a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101dc05e
add eax, 4
add ecx, 4
test dx, dx
jne 0x101dc038
xor eax, eax
jmp 0x101dc063
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x101dc0c8
push 3
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x34]
call fcn.10094bb0
mov byte [esp + 0x38], 1
mov eax, dword [eax]
mov dword [esp + 0xc], 1
mov ecx, 0x102abdf8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101dc0b6
test dx, dx
je 0x101dc0b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101dc0b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x101dc090
xor eax, eax
jmp 0x101dc0bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x101dc0c8
mov bl, 1
jmp 0x101dc0ca
xor bl, bl
mov dword [esp + 0x38], 0
test byte [esp + 0xc], 1
je 0x101dc0e7
and dword [esp + 0xc], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.10004720
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10056b10
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x101dc490
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x10251119
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x14], ebx
call fcn.101d9ea0
test al, al
jne 0x101dc4f4
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.101da900
mov dword [esp + 0x38], ebx
mov ebx, 1
mov dword [esp + 0x10], ebx
mov eax, dword [eax + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov byte [esp + 0xf], 0
cmp eax, 4
jne 0x101dc4f9
mov byte [esp + 0xf], 1
mov dword [esp + 0x38], 0xffffffff
test bl, 1
je 0x101dc516
and ebx, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.10056b10
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x101dc530
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x10251158
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
call fcn.101dc490
test al, al
je 0x101dc574
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.101da900
mov dword [esp + 0x34], 0
mov eax, dword [eax + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov dword [esp + 0x34], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10056b10
test esi, esi
jne 0x101dc5db
add edi, 0x18
push edi
lea ecx, [esp + 0x10]
push str.Failed_to_determine_drive_type_of
push ecx
call fcn.10002820
add esp, 0xc
mov dword [esp + 0x34], 1
mov edx, dword [eax]
push edx
push 0x56
push str..FilePath.cpp
push 0xe0e00095
call fcn.100048f0
cmp esi, 1
jne 0x101dc612
add edi, 0x18
push edi
lea eax, [esp + 0x10]
push str.Invalid_path
push eax
call fcn.10002820
add esp, 0xc
mov dword [esp + 0x34], 2
mov ecx, dword [eax]
push ecx
push 0x5b
push str..FilePath.cpp
push 0x800700a1
call fcn.100048f0
cmp esi, 3
je 0x101dc633
cmp esi, 6
je 0x101dc633
mov eax, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x101dc650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10280a68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call fcn.101dc200
mov dword [esp + 0x14], 0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 8]
call fcn.10004720
cmp esi, 0xffffffff
jne 0x101dc6b4
push 0x247
push str..FilePath.cpp
call fcn.100563c0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x101dc6d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10280a68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call fcn.101dc200
mov dword [esp + 0x14], 0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 8]
call fcn.10004720
cmp esi, 0xffffffff
jne 0x101dc757
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x101dc744
cmp eax, 3
je 0x101dc744
push 0x257
push str..FilePath.cpp
call fcn.100563c0
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x101dc770
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x10251190
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.101dc200
mov dword [esp + 0x2c], 0
mov eax, dword [eax]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x2c], 2
lea ecx, [esp + 0x14]
call fcn.10004720
cmp esi, 0xffffffff
jne 0x101dc7e3
push 0
push 0
call fcn.100563c0
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x101dc7fa
push eax
push eax
call fcn.100563c0
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x29
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincHandles.h
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call fcn.100556a0
add esp, 0xc
push ebp
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov edx, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret