joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017aa3
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
push 0x10004690
mov edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.1002ec9d
cmp dword [edi + 0x654], 2
pop ecx
je 0x10017b36
cmp dword [edi + 0x4fc], esi
je 0x10017b36
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10004620
call fcn.1002ec9d
pop ecx
call esi
mov ecx, dword [edi + 0x4fc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.1001ec2b
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
mov ebx, eax
push 0x10004570
call fcn.1002ec9d
cmp dword [ebp - 4], 0xfffffffc
pop ecx
pop ecx
je 0x10017b1d
cmp dword [ebp - 4], 0xfffffff0
jne 0x10017b36
sub ebx, dword [ebp - 0x10]
inc dword [ebp - 8]
cmp ebx, 0x3e8
jae 0x10017b31
cmp dword [ebp - 8], 0xa
jl 0x10017ada
xor eax, eax
inc eax
jmp 0x10017b38
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001eefd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001ef56
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001ef48
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1001ef44
cmp esi, eax
jae 0x1001ef48
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1001ef36
cmp esi, eax
jb 0x1001ef4c
xor eax, eax
jmp 0x1001ef55
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1001f525
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x68
mov eax, 0x10044a64
call fcn.10030946
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
mov byte [ebp - 0x24], 0x30
mov byte [ebp - 0x23], 0x31
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0x33
mov byte [ebp - 0x20], 0x34
mov byte [ebp - 0x1f], 0x35
mov byte [ebp - 0x1e], 0x36
mov byte [ebp - 0x1d], 0x37
mov byte [ebp - 0x1c], 0x38
mov byte [ebp - 0x1b], 0x39
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x42
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0x16], 0x45
mov byte [ebp - 0x15], 0x46
call fcn.10023ff5
mov eax, dword [ebp + 8]
lea eax, [eax + eax + 0x12]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
cmp eax, edi
je 0x1001f5a5
push eax
call fcn.1002fc7d
pop ecx
mov dword [esi + 0x14], edi
push dword [esi + 0x18]
call fcn.1002fc8d
pop ecx
mov dword [esi + 0x14], eax
cmp eax, edi
jne 0x1001f5ca
mov dword [ebp - 0x6c], 0xffffff37
push 0x10045c78
lea eax, [ebp - 0x6c]
push eax
call fcn.100303d8
push dword [esi + 0x18]
push edi
push eax
call fcn.10030b00
mov ebx, dword [esi + 0x14]
mov edi, ebx
mov esi, 0x10007a94
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x68]
add ebx, 0xc
mov byte [ebx], 0x22
movzx eax, byte [edi + 0xc]
shr eax, 4
mov al, byte [ebp + eax - 0x24]
add esp, 0xc
inc ebx
mov byte [ebx], al
movzx eax, byte [edi + 0xc]
and eax, 0xf
mov al, byte [ebp + eax - 0x24]
inc ebx
mov byte [ebx], al
mov eax, dword [edi + 0x3c]
mov esi, dword [eax]
inc ebx
cmp esi, dword [edi + 0x3c]
je 0x1001f677
cmp dword [esi + 8], 0
jne 0x1001f62b
mov dword [ebp - 0x70], 0xffffff37
push 0x10045c78
lea eax, [ebp - 0x70]
jmp 0x1001f5c4
and dword [ebp - 0x60], 0
mov ecx, dword [esi + 8]
call fcn.1001ee17
cmp dword [ebp - 0x60], eax
jge 0x1001f673
mov ecx, dword [esi + 8]
call fcn.1001f033
mov ecx, dword [ebp - 0x60]
movzx eax, byte [eax + ecx]
shr eax, 4
mov al, byte [ebp + eax - 0x24]
mov byte [ebx], al
mov ecx, dword [esi + 8]
inc ebx
call fcn.1001f033
mov ecx, dword [ebp - 0x60]
movzx eax, byte [eax + ecx]
and eax, 0xf
mov al, byte [ebp + eax - 0x24]
mov byte [ebx], al
inc ebx
inc dword [ebp - 0x60]
jmp 0x1001f62f
mov esi, dword [esi]
jmp 0x1001f60f
mov byte [ebx], 0x22
inc ebx
mov byte [ebx], 0xd
mov byte [ebx + 1], 0xa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.10024012
mov eax, dword [ebp - 0x64]
call fcn.100309b1
ret 4
Function at 0x1002ac1e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 4
mov edi, ecx
inc eax
pop esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x22c], esi
cmp dword [edi], ebx
je 0x1002ad87
call fcn.1002a5b8
mov dword [ebp - 0x220], eax
cmp eax, ebx
je 0x1002accf
lea ecx, [ebp - 0x228]
push ecx
push esi
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0x1000d190
push eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], esi
call sub.WINSPOOL.DRV_GetPrinterDataW
test eax, eax
jne 0x1002acc4
cmp dword [ebp - 0x224], ebx
jne 0x1002acb4
mov dword [ebp - 0x210], ebx
push dword [ebp - 0x220]
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x1002ad81
push dword [ebp - 0x220]
call sub.WINSPOOL.DRV_ClosePrinter
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.10030b00
add esp, 0xc
push 0x1000d160
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1001525b
test eax, eax
je 0x1002ad07
xor eax, eax
inc eax
jmp 0x1002ad87
mov eax, dword [edi]
push dword [eax + 4]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1002a6e7
lea eax, [ebp - 0x214]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002ad81
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x1000d190
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ad75
cmp dword [ebp - 0x21c], ebx
jne 0x1002ad75
mov dword [ebp - 0x210], ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10030883
leave
ret
Function at 0x1002ad9b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
jne 0x1002adbf
xor eax, eax
jmp 0x1002ae31
push ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x1002ae00
mov ecx, 0x1000d11c
lea eax, [esi + 0xc74]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002adf7
test dx, dx
je 0x1002adf3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002adf7
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002add1
xor eax, eax
jmp 0x1002adfc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.default.0x1002ae13
xor ecx, ecx
cmp ebx, ecx
je 0x1002aea7
mov eax, dword [ebp + 8]
dec eax
cmp eax, 7
ja case.default.0x1002ae13
jmp dword [eax*4 + 0x1002af1b]
push dword [ebx + 0x10]
push dword [ebp + 0x10]
push edi
call fcn.1001525b
test eax, eax
je 0x1002af10
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10030883
leave
ret 0xc
push dword [ebp + 0x10]
mov ecx, esi
push edi
call fcn.1002a990
jmp 0x1002ae30
push dword [ebp + 0x10]
push edi
push 0x1000d238
jmp 0x1002ae62
push dword [ebp + 0x10]
push edi
push 0x1000d218
push 0x1000d1f4
jmp 0x1002ae84
push ecx
push 0x23
push edi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x1002ae30
push dword [ebp + 0x10]
push edi
push 0x1000d1e0
push 0x1000d0ec
mov ecx, esi
call fcn.1002aa00
jmp 0x1002ae30
push dword [ebp + 0x10]
mov ecx, esi
push edi
call fcn.1002aac6
jmp 0x1002ae30
push dword [ebp + 0x10]
mov ecx, esi
push edi
call fcn.1002af40
jmp 0x1002ae30
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.10030b00
mov eax, dword [ebp + 8]
add esp, 0xc
dec eax
je case.default.0x1002ae13
dec eax
je case.default.0x1002ae13
dec eax
je 0x1002aeda
dec eax
jne 0x1002aef0
push 0x1000d1c4
jmp 0x1002aedf
push 0x1000d1a8
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.1001525b
add esi, 0xc74
push esi
push dword [ebp + 0x10]
push edi
call fcn.1002a6e7
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.1002a6e7
xor eax, eax
inc eax
jmp 0x1002ae30
Function at 0x1002af40
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp dword [ebx], 0
push esi
mov dword [ebp - 0x210], eax
je 0x1002b039
test eax, eax
je 0x1002b039
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 6
call fcn.1002ad9b
test eax, eax
je 0x1002b039
push edi
mov edi, 0x1000d134
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
push 0x1000d154
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
mov eax, dword [ebx]
test eax, eax
je 0x1002afcc
mov eax, dword [eax + 4]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
lea eax, [ebx + 0xc14]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1002a6e7
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x210]
call fcn.1001525b
pop edi
test eax, eax
jne 0x1002b039
push dword [ebp - 0x210]
mov ecx, ebx
call fcn.1002a655
test eax, eax
jne 0x1002b034
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
inc eax
jmp 0x1002b03b
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10030883
leave
ret 8
Function at 0x1002e482
Capabilities:
Link many functions at runtime

Disassembly:
push 0x234
mov eax, 0x100457cc
call fcn.10030946
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x23c], eax
test eax, eax
jne 0x1002e4aa
mov eax, 0x80070057
jmp 0x1002e64b
push 0x208
call fcn.1002fc8d
pop ecx
mov dword [ebp - 0x240], eax
test eax, eax
je 0x1002e646
mov edi, 0x1000d5a4
push edi
mov ebx, 0x104
push ebx
push eax
call fcn.1001525b
push dword [ebp - 0x23c]
push ebx
mov ebx, dword [ebp - 0x240]
push ebx
push edi
push 0x1000d590
push 0x1000d0ec
call fcn.10042f4d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1002e510
push ebx
call fcn.1002fc7d
pop ecx
mov eax, 0x80004005
jmp 0x1002e64b
xor edi, edi
push edi
push edi
push edi
push edi
push 0x100
lea eax, [ebp - 0x21c]
push eax
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x23c]
call fcn.10031fa3
add esp, 0x24
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], edi
call fcn.1002e456
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 1
call fcn.1002e3fc
push ebx
lea ecx, [ebp - 0x238]
call fcn.1002e3fc
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x1002e57f
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x1002e5a7
push ebx
call fcn.1002fc7d
pop ecx
push edi
push 1
lea ecx, [ebp - 0x238]
call fcn.1002df82
jmp 0x1002e506
push edi
push 1
lea ecx, [ebp - 0x238]
call fcn.1002df82
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 2
push dword [esi + 4]
call edi
push 4
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push 6
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push 7
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push 9
push dword [esi + 4]
mov dword [esi + 0x2c], eax
call edi
push 0x13
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push 0xb
push dword [esi + 4]
mov dword [esi + 0x28], eax
call edi
push 0xd
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push 0xf
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
push 0x11
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
push 0x14
push dword [esi + 4]
mov dword [esi + 0x24], eax
call edi
push ebx
mov dword [esi + 0x30], eax
call fcn.1002fc7d
pop ecx
xor eax, eax
jmp 0x1002e64b
mov eax, 0x8000ffff
call fcn.100309b1
ret 4
Function at 0x1002ebee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x10053d68], esi
jne 0x1002ec95
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1000d61c
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002ec95
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x1000d608
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ec95
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
setne al
mov dword [0x10053d6c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1000d5cc
push 0x104
push 0x10053b60
call fcn.1001e1eb
add esp, 0x10
push 0x10053b48
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x10053d68], 1
pop esi
leave
ret
Function at 0x1002ee3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x1002efd7
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000d990
push eax
call edi
push 0x1000d980
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x1000d96c
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push 0x1000d950
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push 0x1000d938
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push 0x1000d920
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push 0x1000d904
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push 0x1000d8ec
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push 0x1000d8e0
push dword [esi]
mov dword [esi + 0x24], eax
call edi
push 0x1000d8c8
push dword [esi]
mov dword [esi + 0x28], eax
call edi
push 0x1000d8b0
push dword [esi]
mov dword [esi + 0x2c], eax
call edi
push 0x1000d894
push dword [esi]
mov dword [esi + 0x30], eax
call edi
push 0x1000d87c
push dword [esi]
mov dword [esi + 0x34], eax
call edi
push 0x1000d864
push dword [esi]
mov dword [esi + 0x38], eax
call edi
push 0x1000d84c
push dword [esi]
mov dword [esi + 0x3c], eax
call edi
push 0x1000d834
push dword [esi]
mov dword [esi + 0x40], eax
call edi
push 0x1000d828
push dword [esi]
mov dword [esi + 0x44], eax
call edi
push 0x1000d80c
push dword [esi]
mov dword [esi + 0x48], eax
call edi
push 0x1000d7f0
push dword [esi]
mov dword [esi + 0x4c], eax
call edi
push 0x1000d7d0
push dword [esi]
mov dword [esi + 0x50], eax
call edi
push 0x1000d7b0
push dword [esi]
mov dword [esi + 0x54], eax
call edi
push 0x1000d794
push dword [esi]
mov dword [esi + 0x58], eax
call edi
push 0x1000d778
push dword [esi]
mov dword [esi + 0x5c], eax
call edi
push 0x1000d754
push dword [esi]
mov dword [esi + 0x60], eax
call edi
push 0x1000d730
push dword [esi]
mov dword [esi + 0x64], eax
call edi
push 0x1000d70c
push dword [esi]
mov dword [esi + 0x68], eax
call edi
push 0x1000d6e8
push dword [esi]
mov dword [esi + 0x6c], eax
call edi
push 0x1000d6cc
push dword [esi]
mov dword [esi + 0x70], eax
call edi
push 0x1000d6b0
push dword [esi]
mov dword [esi + 0x74], eax
call edi
push 0x1000d698
push dword [esi]
mov dword [esi + 0x78], eax
call edi
push 0x1000d67c
push dword [esi]
mov dword [esi + 0x7c], eax
call edi
mov dword [esi + 0x80], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x1002f33d
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x1002f344
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x1002f3b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1002f3c2
call fcn.1002f351
lea eax, [esi + 4]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi], eax
pop esi
mov eax, ecx
pop ebp
ret 0x14
Function at 0x1002f7bf
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.1002f700
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10030b00
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1002f832
cmp dword [ebp - 0x94], 5
jb 0x1002f853
jmp 0x1002f84f
cmp dword [ebp - 0x88], 1
jne 0x1002f853
cmp dword [ebp - 0x94], 4
ja 0x1002f84f
jne 0x1002f853
cmp dword [ebp - 0x90], 0
jbe 0x1002f853
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1000d9b4
call fcn.1002f573
test eax, eax
jge 0x1002f874
mov byte [0x10053b40], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10030883
leave
ret

Function at 0x1002fd1c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x1002fe1d
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1002fd61
xor eax, eax
jmp 0x1002feb8
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x1002fd7c
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x10053e78], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x10053e80], esi
mov dword [0x10053e84], ecx
mov dword [0x10053e88], edx
mov dword [0x10053e7c], eax
call fcn.100343e8
pop ecx
test eax, eax
je 0x1002fd5a
call fcn.10033a23
test eax, eax
jne 0x1002fdc8
call fcn.1003444d
jmp 0x1002fd5a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10055a78], eax
call fcn.1003424a
mov dword [0x10053e60], eax
call fcn.10033ba2
test eax, eax
jge 0x1002fded
call fcn.100336b1
jmp 0x1002fdc1
call fcn.10034156
test eax, eax
jl 0x1002fe16
call fcn.10033e34
test eax, eax
jl 0x1002fe16
push 0
call fcn.100333a0
pop ecx
test eax, eax
jne 0x1002fe16
inc dword [0x10053e58]
jmp 0x1002feb5
call fcn.10033de1
jmp 0x1002fde6
xor edi, edi
cmp eax, edi
jne 0x1002fe58
cmp dword [0x10053e58], edi
jle 0x1002fd5a
dec dword [0x10053e58]
cmp dword [0x10053eb4], edi
jne 0x1002fe42
call fcn.1003351b
cmp dword [ebp + 0x10], edi
jne 0x1002feb5
call fcn.10033de1
call fcn.100336b1
call fcn.1003444d
jmp 0x1002feb5
cmp eax, 2
jne 0x1002fea9
call fcn.10033682
push 0x214
push 1
call fcn.10032e23
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x1002fd5a
push esi
push dword [0x10052770]
push dword [0x10053ec4]
call fcn.100335fc
pop ecx
call eax
test eax, eax
je 0x1002fe9d
push edi
push esi
call fcn.100336f3
pop ecx
jmp 0x1002feb4
push esi
call fcn.100325d0
pop ecx
jmp 0x1002fd5a
cmp eax, 3
jne 0x1002feb5
push edi
call fcn.100339b0
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10030883
leave
ret 0xc
Function at 0x10032e95
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100526d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.10033319
pop ecx
test eax, eax
je 0x10032eca
push esi
push esi
push esi
push esi
push esi
call fcn.1003185a
add esp, 0x14
push 4
pop eax
call fcn.1003b5a0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10032fe6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec edi
neg edi
sbb edi, edi
and edi, 0x103
inc edi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], esi
jne 0x10032f5f
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1000db24
call esi
test eax, eax
jne 0x10032f36
push 0x1000db08
call esi
test eax, eax
je 0x10032f5f
push 0x1000daf0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032f5f
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
call eax
cmp eax, 1
jne 0x10032f5f
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x10032f5f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx - 1]
push esi
push dword [ebp - 8]
call fcn.10032e69
add esp, 0xc
test eax, eax
jl 0x10032fe6
not esi
and dword [ebp - 8], esi
je 0x10032f91
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.10032e69
add esp, 0xc
test eax, eax
jl 0x10032fe6
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x10032f9c
mov dword [ebp - 8], eax
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 0x14]
sub esi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x10032fb0
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp esi, ebx
jb 0x10032fe6
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10032fe6
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10032fe6
xor eax, eax
inc eax
jmp 0x10032fe8
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030883
leave
ret
Function at 0x10033a23
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1000db70
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x10033a75
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000dbdc
push edi
call esi
push 0x1000dbd0
push edi
mov dword [0x10053ebc], eax
call esi
push 0x1000dbc4
push edi
mov dword [0x10053ec0], eax
call esi
push 0x1000dbbc
push edi
mov dword [0x10053ec4], eax
call esi
mov dword [0x10053ec8], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x10053ebc], ebx
je 0x10033a9b
cmp dword [0x10053ec0], ebx
je 0x10033a9b
cmp dword [0x10053ec4], ebx
je 0x10033a9b
cmp dword [0x10053ec8], ebx
jne 0x10033abf
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x10053ec0], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x10053ebc], 0x10033674
mov dword [0x10053ec4], esi
mov dword [0x10053ec8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1005276c], eax
cmp eax, 0xffffffff
je 0x10033b32
push dword [0x10053ec0]
push eax
call esi
test eax, eax
je 0x10033b32
call fcn.1003352f
push dword [0x10053ebc]
call fcn.10033576
push dword [0x10053ec0]
mov dword [0x10053ebc], eax
call fcn.10033576
push dword [0x10053ec4]
mov dword [0x10053ec0], eax
call fcn.10033576
push dword [0x10053ec8]
mov dword [0x10053ec4], eax
call fcn.10033576
add esp, 0x10
mov dword [0x10053ec8], eax
call fcn.1003a520
test eax, eax
jne 0x10033b38
call fcn.100336b1
xor eax, eax
pop edi
pop esi
pop ebx
ret
push fcn.10033860
push dword [0x10053ebc]
call fcn.100335fc
pop ecx
call eax
mov dword [0x10052770], eax
cmp eax, 0xffffffff
je 0x10033b2d
push 0x214
push 1
call fcn.1003b950
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x10033b2d
push esi
push dword [0x10052770]
push dword [0x10053ec4]
call fcn.100335fc
pop ecx
call eax
test eax, eax
jne 0x10033b8b
push esi
call fcn.100325d0
pop ecx
jmp 0x10033b2d
push ebx
push esi
call fcn.100336f3
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x10033b34