joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008b250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd7db
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x25c], eax
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ebx
je 0x1008b2a8
mov ecx, esi
call fcn.10006d80
add esi, 0x18
cmp esi, ebx
jne 0x1008b292
mov esi, dword [edi]
mov eax, dword [ebp - 0x25c]
mov dword [edi + 4], esi
mov eax, dword [eax]
test eax, eax
je 0x1008b4a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100c78b8
push eax
call esi
mov ecx, dword [ebp - 0x25c]
push 0x100c95bc
mov dword [ebp - 0x260], eax
push dword [ecx]
call esi
mov ebx, eax
mov eax, dword [ebp - 0x25c]
push 0x100c78d4
push dword [eax]
call esi
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x25c], eax
test ecx, ecx
je 0x1008b4a7
test ebx, ebx
je 0x1008b4a7
test eax, eax
je 0x1008b4a7
xor eax, eax
mov dword [ebp - 0x48], 0x6f0053
mov word [ebp - 0x14], ax
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x258]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], 0x740066
push eax
push 0x80000002
mov dword [ebp - 0x40], 0x610077
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x4d005c
mov dword [ebp - 0x34], 0x630069
mov dword [ebp - 0x30], 0x6f0072
mov dword [ebp - 0x2c], 0x6f0073
mov dword [ebp - 0x28], 0x740066
mov dword [ebp - 0x24], 0x43005c
mov dword [ebp - 0x20], 0x460054
mov dword [ebp - 0x1c], 0x54005c
mov dword [ebp - 0x18], 0x500049
call ecx
test eax, eax
jne 0x1008b4a7
push 0x208
xor esi, esi
lea eax, [ebp - 0x250]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x254], 0x104
lea eax, [ebp - 0x254]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x250]
push eax
push esi
push dword [ebp - 0x258]
call ebx
test eax, eax
jne 0x1008b49b
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x268], 0
mov word [ebp - 0x278], ax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x264], 0
lea edx, [eax + 2]
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008b420
sub eax, edx
lea ecx, [ebp - 0x278]
sar eax, 1
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10006df0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x278]
push eax
mov ecx, edi
call fcn.10017050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.10006d80
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x104
push eax
lea eax, [ebp - 0x250]
inc esi
push eax
push esi
push dword [ebp - 0x258]
call ebx
test eax, eax
je 0x1008b3e0
push dword [ebp - 0x258]
call dword [ebp - 0x25c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret 4
Function at 0x1008bce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [eax]
xor edi, edi
test eax, eax
je 0x1008be51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100c78b8
push eax
call esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x64]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
push 0x100c78d4
push dword [eax]
call esi
mov esi, eax
cmp dword [ebp - 0x58], edi
je 0x1008be51
cmp dword [ebp - 0x68], edi
je 0x1008be51
test esi, esi
je 0x1008be51
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x3c], 0x620079
mov dword [ebp - 0x38], 0x61006f
mov dword [ebp - 0x34], 0x640072
mov dword [ebp - 0x30], 0x4c0020
mov dword [ebp - 0x2c], 0x790061
mov dword [ebp - 0x28], 0x75006f
mov dword [ebp - 0x24], 0x5c0074
mov dword [ebp - 0x20], 0x720050
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x61006f
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x60], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], edi
push eax
push 0x20019
lea ecx, [ebp - 0x60]
call fcn.1009b900
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x1008be27
mov dword [ebp - 0x44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 0x100c936c
push dword [ebp - 0x5c]
movups xmmword [ebp - 0x54], xmm0
call dword [ebp - 0x68]
test eax, eax
jne 0x1008be22
push 0x10
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov edi, eax
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x60]
call fcn.1009ba90
test edi, edi
je 0x1008be3e
mov ecx, dword [ebp - 0x64]
push edi
call fcn.1008be70
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1009ba90
mov eax, edi
jmp 0x1008be53
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret
Function at 0x1008be70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd910
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x1008c046
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100c78b8
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push 0x100c78d4
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x1008c046
cmp dword [ebp - 0x84], 0
je 0x1008c046
test esi, esi
je 0x1008c046
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.1009b900
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x1008c037
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.1001a620
add esp, 0xc
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x60], 0x14
cmovae eax, dword [ebp - 0x78]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x7c]
movups xmmword [ebp - 0x5c], xmm0
call dword [ebp - 0x84]
test eax, eax
jne 0x1008c026
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.10006d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.1009ba90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret 4
Function at 0x1008c070
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x100e6008]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008c0cc
cmp dword [esp + 4], 6
jb 0x1008c0cc
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.100ab466
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.100ab466
add esp, 0x118
ret
Function at 0x1008cb30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x100e6008]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x244]
test ebx, ebx
je 0x1008cc7b
mov eax, dword [ecx]
test eax, eax
je 0x1008cc7b
push edi
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1008cc7a
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x208
cmp dword [esi + 0x14], 8
jb 0x1008cba9
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
call edi
lea eax, [esp + 0x34]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008cbc2
sub eax, edx
lea ecx, [ebp + 0x38]
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10006df0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push ebx
call edi
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008cc04
sub ecx, edx
lea eax, [esp + 0x34]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x50]
call fcn.10006df0
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push ebx
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call edi
pop edi
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ab466
add esp, 0x230
ret 0xc
Function at 0x1008ebb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdf08
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.100ab685
mov dword [ebp - 0x14], eax
push pe_nt_image_headers32
push 0
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008ec34
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.1001f530
test al, al
je 0x1008ec61
lea ecx, [ebp - 0x14]
call fcn.1001ee90
test al, al
jne 0x1008ec61
xor bl, bl
jmp 0x1008ecff
lea esi, [edi + 4]
xor ecx, ecx
mov edx, esi
call fcn.100371e0
test al, al
jne 0x1008ec85
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1008ec80
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x1c]
mov ecx, 0x1a
mov edx, esi
call fcn.100371e0
test al, al
jne 0x1008ecac
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1008eca7
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x34]
mov ecx, 2
mov edx, esi
call fcn.100371e0
test al, al
jne 0x1008ecd3
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1008ecce
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x4c]
mov ecx, 0xb
mov edx, esi
call fcn.100371e0
test al, al
jne 0x1008ecfa
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1008ecf5
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov byte [edi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001e7f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret
Function at 0x1008edb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdf51
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edx, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x1008edf4
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1008ee0e
mov eax, edx
nop dword [eax]
cmp word [eax], 0x25
je 0x1008ee43
add eax, 2
sub ecx, 1
jne 0x1008ee00
push esi
mov ecx, edi
call fcn.10006af0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x1008ee0e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x1008ee0e
push esi
lea ecx, [ebp - 0x28]
call fcn.10006af0
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1008ee6a
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x1008ee99
push esi
mov ecx, edi
call fcn.10006af0
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10006d80
jmp 0x1008ee24
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100abe76
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x1008eec0
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x1008eefd
cmp eax, dword [ebp - 0x34]
ja 0x1008eefd
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008eee4
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10006df0
push esi
call fcn.100ab477
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
add esp, 4
movups xmmword [edi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28]
call fcn.10006d80
jmp 0x1008ee24
Function at 0x1008fcb0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be0dc
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x2b4], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2b4], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x2b0], 7
mov word [ebp - 0x2c4], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008fdd0
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c4]
call fcn.10006df0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x2ac], ax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x29c], 0
lea edx, [eax + 2]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008fe30
sub eax, edx
lea ecx, [ebp - 0x2ac]
sar eax, 1
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.10006df0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c4]
push eax
lea edx, [ebp - 0x2ac]
lea ecx, [ebp - 0x294]
call fcn.10018350
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ac]
call fcn.10006d80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.10006d80
lea ecx, [ebp - 0x294]
call fcn.100169f0
test al, al
jne 0x1008fea2
xor bl, bl
jmp 0x1008fef7
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.1001da40
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
jne 0x1008fec5
xor bl, bl
jmp 0x1008fee8
lea eax, [ebp - 0x27c]
cmp esi, eax
je 0x1008fee6
cmp dword [ebp - 0x268], 8
push ecx
cmovae eax, dword [ebp - 0x27c]
mov ecx, esi
push eax
call fcn.10006df0
mov bl, 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.10006d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.10006d80
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab466
mov esp, ebp
pop ebp
ret 4
Function at 0x10095420
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1009542b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10095440
Function at 0x1009b900
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x100bedf2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100e6008]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x1009b944
call fcn.1009ba90
cmp byte [0x100e7cf0], 0
jne 0x1009b957
mov eax, 0x80000001
jmp 0x1009ba6c
mov eax, dword [esi]
test eax, eax
jne 0x1009b9c2
push 8
call fcn.100ab685
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 1
call fcn.100ab685
mov dword [edi + 4], eax
push pe_nt_image_headers32
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1009b9b1
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1009ba5b
call fcn.1001f3b0
test al, al
jne 0x1009b9fc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.1001f530
test al, al
je 0x1009ba5b
mov ecx, dword [esi]
add ecx, 4
call fcn.1001ee90
call fcn.1001f3b0
test al, al
je 0x1009ba5b
push str.Advapi32.dll
lea ecx, [ebp - 0x28]
call fcn.10006a90
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
call fcn.1001c550
mov ecx, eax
call fcn.1001c610
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10006d80
test edi, edi
je 0x1009ba5b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1009ba5b
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x1009ba5b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1009ba6a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.100ab466
lea esp, [ebp + 0x120]
pop ebp
ret 4
Function at 0x1009d490
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf0bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100e6008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10006d80
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10006d80
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10006d80
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10006d80
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10006d80
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10006d80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1009d520
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf0bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100e6008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10006d80
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10006d80
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10006d80
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10006d80
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10006d80
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10006d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a0800
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf55f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100e6008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10006af0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10006af0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10006af0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10006af0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10006af0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10006af0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100a2960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100e6008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x100a29e2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x100a29e2
test ecx, ecx
je 0x100a29de
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x100a29a0
xor eax, eax
jmp 0x100a29e7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100a29f1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ab466
add esp, 0xc
ret 0xc