joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eea00
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1028212c
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x2b4], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2b4], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x2b0], 7
mov word [ebp - 0x2c4], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100eeb20
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c4]
call fcn.10004d70
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x2ac], ax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x29c], 0
lea edx, [eax + 2]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100eeb80
sub eax, edx
lea ecx, [ebp - 0x2ac]
sar eax, 1
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.10004d70
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c4]
push eax
lea edx, [ebp - 0x2ac]
lea ecx, [ebp - 0x294]
call fcn.10101620
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ac]
call fcn.10004cc0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.10004cc0
lea ecx, [ebp - 0x294]
call fcn.100ff9d0
test al, al
jne 0x100eebf2
xor bl, bl
jmp 0x100eec47
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.1010b330
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
jne 0x100eec15
xor bl, bl
jmp 0x100eec38
lea eax, [ebp - 0x27c]
cmp esi, eax
je 0x100eec36
cmp dword [ebp - 0x268], 8
push ecx
cmovae eax, dword [ebp - 0x27c]
mov ecx, esi
push eax
call fcn.10004d70
mov bl, 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.10004cc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.10004cc0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret 4
Function at 0x100f6440
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10282c4c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10314008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.10004cc0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.10004cc0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.10004cc0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.10004cc0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10004cc0
push 0x88
push ebx
call fcn.1025b427
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100f7140
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x100f7156
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [esp + 8]
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x100f7170
cmp dword [eax + 0x14], 8
jb 0x100f7172
mov eax, dword [eax]
jmp 0x100f7172
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x100f7194
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100f7194
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4

Function at 0x100f71a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10282e68
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test eax, eax
je 0x100f71e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea ecx, [ebp - 0x14]
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1012ca70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x100f720c
add eax, 8
jmp 0x100f720e
xor eax, eax
cmp dword [edi + 0x10], 0
je 0x100f721e
cmp dword [edi + 0x14], 8
jb 0x100f7220
mov edi, dword [edi]
jmp 0x100f7220
xor edi, edi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x100f7241
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100f7241
mov byte [esi + 5], 1
cmp dword [esi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1012cc40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret 4
Function at 0x100f7290
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10282e98
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test eax, eax
je 0x100f72d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1012cb50
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x100f72fd
lea ebx, [eax + 8]
jmp 0x100f72ff
xor ebx, ebx
cmp dword [edi + 0x10], 0
je 0x100f7311
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x100f7313
mov eax, dword [edi]
jmp 0x100f7313
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
test eax, eax
jne 0x100f735c
call ecx
cmp eax, 5
jne 0x100f7356
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x10], 0
je 0x100f7348
cmp dword [edi + 0x14], 8
jb 0x100f734a
mov edi, dword [edi]
jmp 0x100f734a
xor edi, edi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi]
test eax, eax
je 0x100f737a
call ecx
cmp eax, 0xb7
jne 0x100f736f
mov byte [esi + 5], 1
mov ecx, dword [esi]
call fcn.10117750
mov eax, dword [esi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1012cc40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret 4
Function at 0x100f8a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100f8a2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100f8a4e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100f8a50
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100f8ad5
jg 0x100f8a65
test esi, esi
je 0x100f8ad5
test ecx, ecx
jl 0x100f8aae
jg 0x100f8a6f
test eax, eax
je 0x100f8aae
cmp edi, ecx
jg 0x100f8a83
jl 0x100f8a79
cmp esi, eax
jae 0x100f8a83
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x100f8ab1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100f8ad5
jg 0x100f8abb
test esi, esi
je 0x100f8ad5
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100f8ad5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f8af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x100f8b1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100f8b3e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100f8b40
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x100f8be0
jg 0x100f8b5d
test esi, esi
je 0x100f8be0
test ecx, ecx
jl 0x100f8baa
jg 0x100f8b67
test eax, eax
je 0x100f8baa
cmp ebx, ecx
jg 0x100f8b7b
jl 0x100f8b71
cmp esi, eax
jae 0x100f8b7b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x100f8bb1
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x100f8be0
jg 0x100f8bbb
test esi, esi
je 0x100f8be0
cmp dword [edi + 0x4c], 0
je 0x100f8be0
mov ecx, edi
call fcn.100f9db0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f8f50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10314008]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100f8f80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100f8fb1
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100f8fb1
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100f9094
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100f8fda
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100f8fe6
movsx eax, bl
jmp 0x100f9025
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100f9094
cmp eax, 1
jle 0x100f9050
cmp eax, 3
jne 0x100f9094
movsx eax, byte [esp + 0x17]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x100f9070
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100f9094
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x100f9094
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1025b3e6
add esp, 0x30
ret 4
Function at 0x100f9e10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10314008]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100f9ebc
cmp byte [esi + 0x3d], 0
je 0x100f9ebc
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100f9e6d
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100f9e80
sub eax, 1
je 0x100f9e84
sub eax, 2
je 0x100f9ebc
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100f9ea4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100f9e6d
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1025b3e6
add esp, 0x28
ret
Function at 0x100ffc60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10283ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x100ffc9a
xor al, al
jmp 0x100ffe55
call fcn.100ffac0
test al, al
je 0x100ffcaa
mov al, 1
jmp 0x100ffe55
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100ffcb4
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call ebx
test eax, eax
jne 0x100ffd07
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10134450
test al, al
je 0x100ffcf8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004cc0
mov ecx, esi
call fcn.100ffac0
test al, al
jne 0x100ffca3
mov eax, dword [esi + 0x10]
xor edi, edi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x100ffde8
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x100ffd2e
mov eax, dword [esi]
mov edx, 0x2f
cmp dx, word [eax + edi*2]
mov edx, 0x5c
je 0x100ffd51
mov eax, esi
cmp ecx, 8
jb 0x100ffd47
mov eax, dword [esi]
cmp dx, word [eax + edi*2]
jne 0x100ffdde
push edi
push 0
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.10008a20
mov dword [ebp - 4], 1
cmp dword [ebp - 0x30], 0
je 0x100ffdcf
lea ecx, [ebp - 0x40]
call fcn.100ff8f0
test al, al
jne 0x100ffdcf
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
jne 0x100ffdcf
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.10134450
test al, al
je 0x100ffdc3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10004cc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10004cc0
inc edi
cmp edi, dword [ebp - 0x44]
jb 0x100ffd22
mov ecx, esi
call fcn.100ff8f0
test al, al
jne 0x100ffe4e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100ffdfd
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
jne 0x100ffe4e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10134450
test al, al
je 0x100ffe3f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004cc0
mov ecx, esi
call fcn.100ffac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret
Function at 0x10100cb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x10314008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10100cd8
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x10100d1c
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x418
ret
cmp eax, 0x208
jae 0x10100d04
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10100d34
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10004d70
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.1025b3e6
add esp, 0x418
ret
Function at 0x101032f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102844c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x1010332b
xor al, al
jmp 0x101033cf
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x10103347
mov eax, dword [edi]
test eax, eax
je 0x10103347
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x101033ac
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10102d00
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x101033eb
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x101033a4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10102ec0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x101033cd
mov eax, dword [edi]
test eax, eax
je 0x101033c6
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10103403
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1010338e
mov bl, 1
jmp 0x101033ae
Function at 0x1010a570
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x10314008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1010a6b2
cmp dword [esi + 4], 6
push edi
ja 0x1010a5c6
jne 0x1010a64e
cmp dword [esi + 8], 2
jb 0x1010a64e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1010a64e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1010a64e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1010a64e
movups xmm0, xmmword [0x102bb980]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x102bb990]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1010a64e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1010a64e
cmp word [edi + 2], ax
jbe 0x1010a64e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1010a699
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1010a699
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.1025b3e6
add esp, 0x140
ret

Function at 0x1010b0d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x1010b108
mov edx, dword [esp + 4]
test edx, edx
je 0x1010b108
cmp dword [eax], 0xffffffff
je 0x1010b108
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1010b108
mov al, 1
ret 0xc
xor al, al
ret 0xc