joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10151d70
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x11c
push ebx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
mov ebx, dword [esp + 0x12c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
mov cl, byte [esp + 0x12b]
mov dword [esp + 0xc], eax
mov dl, byte [esp + 0x12a]
mov dword [esp + 0x10], eax
mov byte [esp + 0xa], cl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x128]
mov byte [esp + 0xc], ah
mov byte [esp + 0xd], al
xor eax, eax
xor ecx, ecx
mov al, bh
mov byte [esp + 0xb], dl
mov byte [esp + 0x11], al
mov eax, dword [esp + 0x130]
mov dl, byte [esp + 0x134]
mov cl, ah
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x138]
xor ecx, ecx
mov byte [esp + 0x17], al
mov cl, ah
and eax, 0xff0f
mov byte [esp + 0x15], cl
cmp eax, 0x60d
mov byte [esp + 8], 0xfd
mov byte [esp + 9], 0x81
mov byte [esp + 0xe], 8
mov byte [esp + 0xf], 2
mov byte [esp + 0x10], 0
mov byte [esp + 0x12], bl
mov byte [esp + 0x16], dl
mov ecx, 0x200
jne 0x10151e32
cmp dl, 1
jne 0x10151e32
mov ecx, 0x400
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0x13c]
push edx
push eax
push ecx
lea ecx, [esp + 0x14]
push 0x10
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.10152440
mov al, byte [esp + 0x30]
add esp, 0x18
test al, al
jne 0x10151e6a
pop edi
xor eax, eax
pop ebx
add esp, 0x11c
ret
mov al, byte [esp + 0x19]
test al, al
je 0x10151ec6
mov eax, dword [esp + 0x134]
and ebx, 0xffff
and eax, 0xff
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x134]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x130]
push ebx
push eax
push str._VDR_BadTFindRead_:_RowAddress__0x_lx__SearchTimes__0x_lx__JumpOffset0x_lx__Flag_d_..._fail__ECC_error__..._n
push ecx
call fcn.1003399c
add esp, 0x18
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov eax, 3
pop ebx
add esp, 0x11c
ret
pop edi
mov eax, 1
pop ebx
add esp, 0x11c
ret
Function at 0x101524b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
xor eax, eax
mov ecx, ebp
push esi
push edi
lea edi, [esp + 0x1c]
mov dword [ecx], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [ecx + 4], eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x138]
mov dword [esp + 0x10], ebx
cmp eax, 0xffffffff
je 0x1015263d
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 3
push 0x50
call fcn.10152090
add esp, 0x10
test eax, eax
je 0x1015263d
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x134]
mov ecx, 0x14
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x130]
cmp al, bl
mov word [esi], 0x2c
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], al
mov byte [esi + 7], 0x18
mov byte [esi + 8], bl
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0xf
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], 0x30
jbe 0x1015257f
mov ecx, dword [esp + 0x128]
and eax, 0xff
lea edx, [esi + 0x1c]
mov edi, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
dec edi
jne 0x10152576
mov edx, dword [esp + 0x138]
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0x50
push esi
push 0x50
push esi
push 0x4d014
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov cl, byte [esi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp], al
mov byte [ebp + 1], cl
mov dl, byte [esi + 0x32]
cmp cl, bl
mov byte [ebp + 2], dl
jne 0x101525d8
cmp eax, ebx
je 0x101525dc
mov eax, dword [esp + 0x10]
push eax
call fcn.10034678
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
cmp eax, ebx
jne 0x101525ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x20]
push str._WriteCMD_:_Cmd_fail._Windows_Error_Code_ld_n
push ecx
mov dword [ebp + 4], eax
call fcn.1003399c
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
call edi
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 2]
mov cl, byte [esi + 0x22]
push eax
xor edx, edx
mov dl, byte [esi + 0x1d]
xor eax, eax
mov al, byte [esi + 0x1c]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str._WriteCMD_:_Cmd_fail_0x_x_0x_x_0x_x_._ScsiStatus0x_x_n
push ecx
call fcn.1003399c
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call fcn.10034678
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x101526c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push ebx
push ebp
mov ebx, eax
mov ebp, ecx
push esi
and ebx, 0xffff
and ebp, 0xff
push edi
mov edi, dword [edx + 0x68]
shl ebx, 9
shl ebp, 9
test ax, ax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edi
jne 0x10152706
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
test cl, cl
je 0x1015270e
cmp ebp, edi
jbe 0x10152710
mov ebp, edi
mov eax, dword [esp + 0x30]
mov cx, word [edx + 0x78]
and eax, 0xff
mov dl, cl
and dl, 0x70
mov dword [esp + 0x34], ecx
mov al, byte [eax + 0x10248e14]
cmp dl, al
jae 0x10152740
movzx ax, al
and ecx, 0xff8f
or ecx, eax
mov dword [esp + 0x34], ecx
push edi
call fcn.101d175d
mov ecx, dword [esp + 0x3c]
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov al, byte [ecx + 0x7c]
mov dword [esp + 0x28], ebp
cmp al, 5
jne 0x10152762
mov dword [esp + 0x28], edi
test ebx, ebx
je 0x10152880
jmp 0x10152778
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp ebp, ebx
rep stosb byte es:[edi], al
jbe 0x10152792
mov ebp, ebx
mov ecx, dword [esp + 0x38]
mov al, byte [ecx + 0x10b]
test al, al
jne 0x10152853
mov al, byte [esp + 0x30]
test al, al
je 0x101527d1
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x2c]
push edx
push ecx
mov ecx, dword [esp + 0x30]
push esi
shr eax, 9
push eax
push ecx
call sym.ITEuDllvMgr.dll_VDR_ReadPage
add esp, 0x18
mov ebx, eax
jmp 0x101527fe
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x38]
push edx
push ecx
mov ecx, dword [esp + 0x30]
push esi
shr eax, 9
push eax
push ecx
push eax
mov ebx, 1
call sym.ITEuDllvMgr.dll_VDR_ReadBlock
add esp, 0x1c
test eax, eax
jne 0x101527fe
xor ebx, ebx
mov edi, dword [esp + 0x2c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp ebx, 1
rep movsb byte es:[edi], byte [esi]
jne 0x10152869
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
sub eax, ebp
inc esi
add edx, ebp
test eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], edx
jne 0x1015276c
mov esi, dword [esp + 0x14]
push esi
call fcn.101d1786
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
call fcn.101d1786
add esp, 4
mov eax, 0x36
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
push eax
call fcn.101d1786
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x24]
push esi
call fcn.101d1786
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10153f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
push ebx
push ebp
mov ebp, dword [esp + 0x54]
push esi
push edi
mov ebx, 1
push ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
call sym.ITEuDllvMgr.dll_VDR_CheckSYSReady
mov ecx, 0x10
or eax, 0xffffffff
lea edi, [esp + 0x1c]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
call sym.ITEuDllvMgr.dll_VDR_ReadSysAddr
add esp, 0xc
test eax, eax
je 0x101540db
mov esi, dword [esp + 0x64]
mov cl, byte [esi + 8]
and cl, 0xc0
cmp cl, 0x40
jne 0x10153f7b
mov al, byte [esi + 0x7c]
cmp al, 3
je 0x10153f64
cmp al, 4
je 0x10153f64
cmp al, 6
jb 0x10153f7b
push ebp
push ebx
push ebx
call sym.ITEuDllvMgr.dll_VDR_ConfigFlag4SAMReliable
add esp, 0xc
test eax, eax
je 0x101540db
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x38]
cmp cl, 0xff
je 0x101540db
mov eax, dword [esp + 0x3c]
cmp al, 0xff
je 0x101540db
cmp cl, 0xcc
je 0x101540db
cmp al, 0xcc
je 0x101540db
mov edi, dword [esp + 0x6c]
push edi
push eax
push ecx
push esi
push ebp
call sym.ITEuDllvMgr.dll_GetLastestPage
add esp, 0x14
test eax, eax
jne 0x10153fc3
mov dword [esp + 0x10], eax
jmp 0x101540b2
push esi
push edi
call sym.ITEuDllvMgr.dll_SDKFAddress2RawAddress
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x10153fe1
mov dword [esp + 0x10], 0
jmp 0x101540b2
mov eax, dword [esi + 0x68]
mov dx, word [esi + 0x78]
push eax
mov word [esp + 0x70], dx
call fcn.101d175d
mov cl, byte [esi + 0xe]
mov ebp, eax
mov al, byte [esi + 0x7c]
add esp, 4
test al, al
mov byte [esp + 0x64], cl
jne 0x1015400b
mov byte [esp + 0x64], 4
mov ecx, dword [esi + 0x68]
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x68]
xor edi, edi
cmp eax, edi
mov eax, dword [esp + 0x5c]
push eax
je 0x10154054
movzx cx, byte [0x10248e1d]
mov edx, dword [esp + 0x70]
or ecx, edx
mov edx, dword [esp + 0x68]
push ecx
push esi
push ebp
push edx
push ebx
call sym.ITEuDllvMgr.dll_VDR_ReadPage
add esp, 0x18
cmp al, 1
je 0x10154078
jmp 0x10154074
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
movzx dx, byte [esp + 0x68]
push ecx
push esi
push ebp
push edx
push ebx
push eax
call sym.ITEuDllvMgr.dll_VDR_ReadBlock
add esp, 0x1c
test eax, eax
jne 0x10154078
mov dword [esp + 0x10], edi
cmp byte [esp + 0x64], 6
jb 0x10154084
mov byte [esp + 0x64], 6
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
and ecx, 0xff
mov esi, ebp
shl ecx, 9
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.101d1786
mov ebp, dword [esp + 0x60]
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x101540cf
push ebp
push 0
push 1
call sym.ITEuDllvMgr.dll_VDR_ConfigFlag4SAMReliable
add esp, 0xc
test eax, eax
jne 0x101540cf
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret
Function at 0x101540f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, eax
and ebp, 0xffff
push esi
shl ebp, 9
test ax, ax
push edi
mov dword [esp + 0x1c], ebp
jne 0x1015411c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
and eax, 0xff
mov cx, word [esi + 0x78]
mov al, byte [eax + 0x10248e14]
mov dl, cl
and dl, 0x70
mov dword [esp + 0x18], ecx
cmp dl, al
jae 0x10154150
movzx ax, al
and ecx, 0xff8f
or ecx, eax
mov dword [esp + 0x18], ecx
mov bl, byte [esi + 8]
xor dl, dl
and bl, 0xc0
lea ecx, [esp + 0x20]
lea edi, [esi + 0x8c]
mov al, byte [edi]
cmp bl, 0x40
mov byte [ecx], al
jne 0x1015417c
mov al, byte [esi + 0x7c]
cmp al, 3
je 0x1015417a
cmp al, 4
je 0x1015417a
cmp al, 6
jb 0x1015417c
mov byte [ecx], dl
inc dl
inc edi
inc ecx
cmp dl, 0x20
jb 0x10154162
mov cl, byte [esp + 0x20]
mov al, byte [esp + 0x21]
cmp cl, al
jne 0x101541a0
xor al, al
lea ecx, [esp + 0x20]
mov byte [ecx], al
inc al
inc ecx
cmp al, 0x20
jb 0x10154197
mov edx, dword [esi + 0x68]
mov dword [esp + 0x10], 0x1000
push edx
call fcn.101d175d
mov ebx, eax
mov al, byte [esi + 0x7c]
add esp, 4
cmp al, 5
mov byte [esp + 0x4c], 8
jne 0x101541c9
mov al, byte [esi + 0xe]
mov byte [esp + 0x4c], al
test ebp, ebp
mov byte [esp + 0x14], 0
je 0x101542d0
jmp 0x101541e0
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esi + 0x68]
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x10], ebp
jbe 0x101541ff
mov dword [esp + 0x10], ebp
mov al, byte [esi + 0x7c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x10154211
and eax, 0xff
jmp 0x1015421e
and eax, 0xff
xor ecx, ecx
mov cl, byte [esp + eax + 0x20]
mov eax, ecx
mov ecx, dword [esp + 0x48]
add eax, ecx
mov cl, byte [esp + 0x54]
test cl, cl
je 0x1015424a
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x50]
push ecx
push esi
push ebx
push edx
push eax
call sym.ITEuDllvMgr.dll_VDR_ReadPage
add esp, 0x18
mov ebp, eax
jmp 0x10154276
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x18]
push ecx
push edx
movzx cx, byte [esp + 0x54]
mov edx, dword [esp + 0x54]
push esi
push ebx
push ecx
push eax
push edx
mov ebp, 1
call sym.ITEuDllvMgr.dll_VDR_ReadBlock
add esp, 0x1c
test eax, eax
jne 0x10154276
xor ebp, ebp
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x50]
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebp, 1
rep movsb byte es:[edi], byte [esi]
jne 0x101542d4
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov cl, byte [esp + 0x14]
mov edx, dword [esp + 0x50]
sub eax, esi
inc cl
add edx, esi
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], cl
mov dword [esp + 0x50], edx
jne 0x101541d8
push ebx
call fcn.101d1786
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebp, dword [esp + 0x50]
push ebx
call fcn.101d1786
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x10157570
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1015757d
xor eax, eax
pop esi
ret
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
jbe 0x101575a0
mov cl, byte [eax + esi]
mov dl, cl
and edx, 0xf
mov dl, byte [edx + 0x10248e20]
xor dl, cl
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jb 0x10157588
pop edi
mov eax, 1
pop esi
ret

Function at 0x10158bd0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x48
lea eax, [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x54]
push esi
push eax
push 0
call sym.ITEuDllvMgr.dll_VDR_ReadWriteLUNConfig
add esp, 0xc
test eax, eax
jne 0x10158bf3
pop esi
pop ebx
add esp, 0x48
ret
mov ebx, dword [esp + 0x38]
cmp bx, 8
jae 0x10158c05
pop esi
xor eax, eax
pop ebx
add esp, 0x48
ret
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
call fcn.10157bb0
add esp, 0xc
test eax, eax
jne 0x10158c1f
pop esi
pop ebx
add esp, 0x48
ret
lea edx, [esp + 8]
lea eax, [esp + 0x54]
push edx
push eax
push 3
push 0x1000
call fcn.10152090
add esp, 0x10
test eax, eax
jne 0x10158c42
pop esi
pop ebx
add esp, 0x48
ret
push edi
mov edi, dword [esp + 0x58]
mov ecx, 0x400
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x58]
push esi
mov word [eax], 0
mov edx, dword [str.Capacity]
lea ecx, [eax + 2]
mov dword [eax + 2], edx
mov edx, dword [0x1027ee70]
mov dword [ecx + 4], edx
mov dl, byte [0x1027ee74]
mov word [eax + 0x20], 0
mov word [eax + 0x22], bx
mov byte [ecx + 8], dl
mov word [eax + 0x80], 0xffff
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
push eax
push 8
push ecx
call sym.ITEuDllvMgr.dll_VDR_WriteLUNData
add esp, 0x10
test eax, eax
pop edi
jne 0x10158cb9
mov edx, dword [esp + 8]
push edx
call fcn.10034678
add esp, 4
xor eax, eax
pop esi
pop ebx
add esp, 0x48
ret
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0xc]
push esi
push eax
push 8
push ecx
call sym.ITEuDllvMgr.dll_VDR_ReadLUNData
add esp, 0x10
test eax, eax
jne 0x10158ce7
mov edx, dword [esp + 8]
push edx
call fcn.10034678
add esp, 4
xor eax, eax
pop esi
pop ebx
add esp, 0x48
ret
mov eax, dword [esp + 8]
push eax
call fcn.10034678
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x10159620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
mov esi, dword [esp + 0x3c]
mov ecx, 6
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [esi + 8]
mov cx, word [esi + 0x22]
test al, 0xc0
mov dword [esp + 0x20], ecx
je 0x10159666
and ecx, 0xffff
mov eax, 0x55555556
add ecx, 2
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x20], edx
mov cl, byte [esi + 0x131]
neg cl
sbb ecx, ecx
xor al, al
and ecx, 0x1c0
xor ebp, ebp
add ecx, 0x40
mov byte [esp + 0x14], al
mov dword [esp + 0x1c], ecx
mov ecx, 0x20000
mov dword [esp + 0x18], ecx
mov byte [esp + 0x38], al
xor edi, edi
jmp 0x101596a2
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
mov al, byte [esp + 0x14]
mov dl, byte [esi + 0x10b]
test dl, dl
jne 0x10159803
cmp ecx, ebp
jae 0x101596f8
mov cl, byte [esi + 0x131]
test cl, cl
jne 0x10159803
cmp byte [esp + 0x38], 1
je 0x10159803
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x10159803
mov al, byte [esp + 0x38]
xor ebp, ebp
xor edi, edi
inc al
mov dword [esp + 0x18], 0x20000
mov dword [esp + 0x1c], 0x3d
mov byte [esp + 0x38], al
jmp 0x101596fe
test edi, edi
mov esi, ecx
jne 0x10159700
mov esi, ebp
lea edx, [esp + 0x12]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x19]
push ecx
push edx
push esi
push eax
call sym.ITEuDllvMgr.dll_RawAddress2CCBAddress
mov cx, word [esp + 0x38]
add esp, 0x18
cmp word [esp + 0x12], cx
jae 0x101597ca
mov eax, dword [esp + 0x34]
xor edx, edx
mov dword [esp + 0x28], edx
push eax
mov word [esp + 0x30], dx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x2c]
mov ax, word [edx + 0x78]
push ecx
push eax
push 6
push 0x200
push esi
call sym.ITEuDllvMgr.dll_VDR_ReadSpare
add esp, 0x18
test eax, eax
je 0x101597ca
mov cl, byte [esp + 0x28]
xor al, al
cmp cl, 0x52
jne 0x10159771
mov al, 1
cmp byte [esp + 0x29], 0x4f
jne 0x1015977a
inc al
cmp byte [esp + 0x2a], 0x4f
jne 0x10159783
inc al
cmp byte [esp + 0x2b], 0x54
jne 0x1015978c
inc al
cmp byte [esp + 0x2d], 0x68
jne 0x10159795
inc al
cmp al, 3
jb 0x101597ca
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0x24]
and eax, 0xff
mov byte [eax + ebx + 0x18], cl
mov cx, word [esp + 0x12]
mov dword [ebx + eax*4 + 4], edx
mov word [ebx + eax*2], cx
mov word [ebx + eax*2 + 0x14], 0
mov dword [ebx + eax*4 + 0xc], esi
inc byte [esp + 0x14]
mov al, byte [esp + 0x14]
cmp al, 2
je 0x10159803
test edi, edi
je 0x101597e8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edi, edi
sub eax, edx
mov dword [esp + 0x18], eax
jmp 0x101597f3
mov eax, dword [esp + 0x1c]
mov edi, 1
add ebp, eax
cmp ebp, 0x10000
jbe 0x10159696
mov al, byte [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1016c1a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0xa50
mov ecx, 0x100
xor eax, eax
push ebx
mov ebx, dword [esp + 0xa58]
push ebp
push edi
lea edi, [esp + 0x25c]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x260]
push eax
call fcn.10033da9
lea ecx, [esp + 0x264]
push 0x1028bc0c
push ecx
call fcn.10033d7f
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x25c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1016c2d8
mov edi, dword [esp + 0xa68]
push esi
mov esi, dword [esp + 0xa68]
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1016c2c4
mov edx, dword [esp + 0x10]
and edx, 0x10
cmp dl, 0x10
je 0x1016c24f
mov eax, dword [esp + 0x30]
mov edx, dword [esi]
mov ecx, dword [esp + 0x2c]
add edx, eax
mov dword [esi], edx
mov edx, dword [esi + 4]
adc edx, ecx
mov dword [esi + 4], edx
mov eax, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x1c], eax
jmp 0x1016c210
lea eax, [esp + 0x3c]
push 0x1026e6f4
push eax
call fcn.100340ae
add esp, 8
test eax, eax
je 0x1016c210
lea ecx, [esp + 0x3c]
push 0x1026e6f8
push ecx
call fcn.100340ae
add esp, 8
test eax, eax
je 0x1016c210
lea edx, [esp + 0x660]
push ebx
push edx
call fcn.10033da9
lea eax, [esp + 0x668]
push 0x1028bc08
push eax
call fcn.10033d7f
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x670]
push ecx
push edx
call fcn.10033d7f
push edi
lea eax, [esp + 0x67c]
push esi
push eax
call fcn.1016c1a0
add esp, 0x24
jmp 0x1016c210
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa50
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa50
ret
Function at 0x1016c2f0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x650
test eax, eax
jne 0x1016c305
add esp, 0x650
ret
push ebx
push esi
push edi
push eax
lea eax, [esp + 0x260]
push eax
call fcn.10033da9
lea ecx, [esp + 0x264]
push 0x1028bc0c
push ecx
call fcn.10033d7f
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x25c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x1016c3e2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x10]
push ecx
push ebx
call ebp
test eax, eax
je 0x1016c3da
mov edx, dword [esp + 0x10]
and edx, 0x10
cmp dl, 0x10
je 0x1016c3a4
lea eax, [esp + 0x3c]
add esi, 2
push eax
call fcn.10033dce
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
add esp, 4
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov edi, edx
mov ecx, 0xf
cdq
idiv ecx
test edx, edx
je 0x1016c3a0
inc edi
add esi, edi
jmp 0x1016c352
lea edx, [esp + 0x3c]
push 0x1026e6f4
push edx
call fcn.100340ae
add esp, 8
test eax, eax
je 0x1016c352
lea eax, [esp + 0x3c]
push 0x1026e6f8
push eax
call fcn.100340ae
add esp, 8
test eax, eax
je 0x1016c352
lea ecx, [esp + 0x3c]
add esi, 2
push ecx
jmp 0x1016c372
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov eax, dword [esp + 0x664]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
imul ecx, edx
shl esi, 5
mov eax, esi
xor edx, edx
div ecx
xor edx, edx
mov edi, eax
mov eax, esi
div ecx
test edx, edx
je 0x1016c40d
inc edi
mov eax, edi
pop edi
pop esi
imul eax, ecx
pop ebx
add esp, 0x650
ret