joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10094040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x10094060
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 4], 0x100
push eax
push 1
push 0
push 0x10136ae0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100940be
mov edx, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100940be
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0xc
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 0xc
ret

Function at 0x100940d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x14], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10094130
mov eax, dword [esp + 0x14]
lea edx, [esp]
push edx
lea edx, [esp + 8]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10094130
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 8
ret

Function at 0x10094150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x14], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100941ae
mov eax, dword [esp + 0x14]
lea edx, [esp]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100941ae
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 8
ret
Function at 0x10094d00
Capabilities:
Get file version info
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a7b80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp - 0x10], esp
call dword [eax + 4]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x10094e75
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x10094e75
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
push edi
push esi
push eax
push ecx
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10094d80
lea edx, [ebp - 0x24]
push 0x100ae728
push edx
mov dword [ebp - 0x24], eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x14]
lea ecx, [ebp + 8]
push eax
push ecx
push 0x100b78fc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10094dad
cmp dword [ebp - 0x14], 0x34
jne 0x10094dad
mov esi, dword [ebp + 8]
mov ecx, 0xd
lea edi, [ebx + 4]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
push edx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea ecx, [ebp - 0x18]
push 0
push ecx
mov dword [ebp - 0x18], 0
call esi
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, ebx
call fcn.10094c90
test eax, eax
jne 0x10094e42
lea ecx, [ebp - 0x18]
push 1
push ecx
call esi
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, ebx
call fcn.10094c90
test eax, eax
jne 0x10094e42
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 1
push ecx
push eax
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, ebx
call fcn.10094c90
test eax, eax
jne 0x10094e42
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push 1
push ecx
push 9
push edx
push eax
mov ecx, ebx
call fcn.10094c90
test eax, eax
jne 0x10094e42
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10097710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x18]
push edi
push eax
push 0x20019
push 0
mov edi, 1
push 0x10136bd0
push reloc.WS2_32.dll_bind
mov ebx, 3
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call esi
test eax, eax
jne 0x100978ad
mov ecx, dword [esp + 0x128]
lea edx, [esp + 0x20]
push ecx
push 0x10136bc0
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x100978a2
mov eax, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x10136bb0
push eax
call esi
test eax, eax
jne 0x10097897
mov dword [esp + 0x14], edi
mov ecx, 0x41
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push 0x10136ba0
push ecx
mov dword [esp + 0x30], 0x103
call esi
test eax, eax
jne 0x10097897
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x1009788a
mov edi, 0x10136b9c
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x20]
push ecx
push 0x10136b9c
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x10097853
xor ebx, ebx
jmp 0x10097897
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x1009788a
mov edi, 0x10136b9c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x20]
push ecx
push 0x10136b9c
push eax
call esi
add esp, 0xc
test eax, eax
je 0x10097886
mov ebx, 2
jmp 0x10097897
mov eax, dword [esp + 0xc]
sub eax, 2
neg eax
sbb eax, eax
and eax, 2
inc eax
mov ebx, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x118
ret

Function at 0x10097a00
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10097a69
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10097a69
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 8]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x1c
ret
Function at 0x10098fe0
Capabilities:
Query service configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebp, ebp
cmp esi, ebp
je 0x100990dd
mov ebx, dword [esp + 0x18]
cmp dword [ebx], ebp
jne 0x100990dd
push edi
push bind
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x10], edi
jne 0x10099028
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x18]
push bind
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebp
jne 0x1009905c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x20]
push edi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea edx, [esp + 0x1c]
push edx
push ebp
push ebp
push esi
mov dword [esp + 0x2c], ebp
call edi
mov ebp, eax
test ebp, ebp
jne 0x100990c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100990a0
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x20]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [ebx], eax
push ecx
push edx
push eax
push esi
call edi
mov ebp, eax
test ebp, ebp
jne 0x100990c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebx]
test eax, eax
je 0x100990c1
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx], ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x100990f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x334
push ebx
push ebp
push edi
mov ebp, ecx
call fcn.10097a00
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
push ebx
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10099141
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x34c]
pop edi
pop ebp
pop ebx
mov dword [ecx], eax
xor eax, eax
add esp, 0x334
ret 0xc
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x139]
mov byte [esp + 0x138], bl
rep stosd dword es:[edi], eax
push esi
mov esi, dword [esp + 0x348]
stosw word es:[edi], ax
push esi
mov dword [esp + 0x18], 0x128
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + esi - 1]
push 0x10136c3c
cmp cl, 0x5c
push esi
jne 0x10099190
lea edx, [esp + 0x144]
push str._s_s
push edx
jmp 0x1009919d
lea eax, [esp + 0x144]
push 0x100b78d0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10099250
mov esi, dword [esp + 0x350]
mov eax, dword [esp + 0x34c]
lea ecx, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x10099231
mov ecx, 0x40
lea edi, [esp + 0x241]
mov byte [esp + 0x240], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x244]
push 0x104
push edx
push eax
mov ecx, ebp
call fcn.10099280
test eax, eax
je 0x10099231
lea ecx, [esp + 0x240]
lea edx, [esp + 0x13c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x10099249
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1009925f
jmp 0x100991c4
mov ebx, 1
jmp 0x1009925f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x350]
mov dword [edx], eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x334
ret 0xc
Function at 0x10099330
Capabilities:
Check os version

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x110]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 4]
test eax, eax
jne 0x100993f1
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
push 0x10136c60
cmp eax, 5
jb 0x10099385
push 0x10136c50
lea eax, [esp + 0x10]
push 0x104
push eax
jmp 0x10099394
push str.._s
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x100993d7
push eax
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x104
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
je 0x100993eb
call edi
cmp eax, 0x1f
jne 0x100993f1
mov dword [esi], 1
pop edi
pop esi
add esp, 0x104
ret 4
Function at 0x1009acb0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov esi, dword [esp + 0x324]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push esi
xor ebp, ebp
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1009ae54
lea eax, [esp + 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1009ae54
push 0x104
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x20]
push 0x10136830
push edx
call ebp
mov edx, eax
add esp, 0x14
cmp edx, ebx
jne 0x1009ad77
mov dword [esp + 0x10], 1
lea edx, [esp + 0x14]
jmp 0x1009ad8c
add edx, 2
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1009ae44
inc edx
push 0x100b78fc
push edx
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x1009ae24
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esp + 0x10]
mov byte [esi], bl
cmp eax, ebx
lea eax, [esp + 0x14]
push eax
je 0x1009add8
lea ecx, [esp + 0x220]
lea edx, [esp + 0x11c]
push ecx
push 0x100b78d0
push 0x104
push edx
call edi
add esp, 0x14
jmp 0x1009adef
push 0x100b79c8
lea ecx, [esp + 0x120]
push 0x104
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x118]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1009ae0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009ae61
mov byte [esi], 0x5c
inc esi
push 0x100b78fc
push esi
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x1009ada8
mov eax, dword [esp + 0x324]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1009ae44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009ae61
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x310
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x310
ret

Function at 0x1009af10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push 0x10136c68
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.1009acb0
add esp, 4
test eax, eax
je 0x1009af7e
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x1009af90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push 0x10136c84
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.1009acb0
add esp, 4
test eax, eax
je 0x1009affe
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x1009b840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a7eb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x18]
mov dword [esi], 0x100ab0c8
call fcn.1009e420
mov cl, byte [esp + 0xf]
xor eax, eax
mov dword [esp + 0x1c], eax
mov byte [esi + 0x34], cl
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea ecx, [esi + 4]
xor edi, edi
mov ebx, ecx
mov dword [esi], fcn.1009b940
mov edx, 1
push esi
mov dword [ebx], edi
mov byte [esp + 0x20], dl
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [esi + 8], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edx
mov dword [ecx], edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
call fcn.1009b940
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1009b980
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov esi, dword [esp + 0x324]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push esi
xor ebp, ebp
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1009bb24
lea eax, [esp + 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1009bb24
push 0x104
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x20]
push 0x10136830
push edx
call ebp
mov edx, eax
add esp, 0x14
cmp edx, ebx
jne 0x1009ba47
mov dword [esp + 0x10], 1
lea edx, [esp + 0x14]
jmp 0x1009ba5c
add edx, 2
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1009bb14
inc edx
push 0x100b78fc
push edx
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x1009baf4
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esp + 0x10]
mov byte [esi], bl
cmp eax, ebx
lea eax, [esp + 0x14]
push eax
je 0x1009baa8
lea ecx, [esp + 0x220]
lea edx, [esp + 0x11c]
push ecx
push 0x100b78d0
push 0x104
push edx
call edi
add esp, 0x14
jmp 0x1009babf
push 0x100b79c8
lea ecx, [esp + 0x120]
push 0x104
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x118]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1009badf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009bb31
mov byte [esi], 0x5c
inc esi
push 0x100b78fc
push esi
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x1009ba78
mov eax, dword [esp + 0x324]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1009bb14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009bb31
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x310
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x310
ret

Function at 0x1009bb40
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push 0x10136c84
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.1009b980
add esp, 4
test eax, eax
je 0x1009bbae
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x1009d230
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab0e8
push 0x1007e3d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x124], bl
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x158], ebx
push 0x104
push 0x10136f6c
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
cmp dword [ebp - 0x158], ebx
jne 0x1009d2c0
lea ecx, [ebp - 0x25c]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x158], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x154]
rep stosd dword es:[edi], eax
push 1
push ebx
lea ecx, [ebp - 0x154]
push ecx
push ebx
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.imagehlp.dll_MapAndLoad]
cmp eax, ebx
je 0x1009d3c2
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x133], bl
jne 0x1009d39a
mov eax, dword [ebp - 0x148]
mov cx, word [eax + 0x18]
cmp cx, 0x10b
jne 0x1009d32f
add eax, 0x98
jmp 0x1009d33b
cmp cx, 0x20b
jne 0x1009d39a
add eax, 0xa8
mov dword [ebp - 0x26c], eax
mov ecx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [eax + ecx]
cmp edx, dword [ebp - 0x128]
ja 0x1009d394
cmp eax, ebx
je 0x1009d394
cmp ecx, ebx
je 0x1009d394
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x27c], ebx
mov edx, dword [ebp - 0x14c]
add eax, edx
mov dword [ebp - 0x260], eax
lea edx, [ecx + eax]
mov dword [ebp - 0x264], edx
cmp eax, edx
jae 0x1009d39a
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1009d394
lea eax, [ecx + eax + 7]
and al, 0xf8
mov dword [ebp - 0x260], eax
jmp 0x1009d37c
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x1009d3b5
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.imagehlp.dll_UnMapAndLoad]
mov eax, dword [ebp - 0x158]
cmp eax, ebx
je 0x1009d3e0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret