joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194800
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x101ef110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x10066647
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push str.RegCloseKey
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x10066647
cmp dword [ebp - 0x84], 0
je 0x10066647
test esi, esi
je 0x10066647
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.10092eb0
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x10066638
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.1000de40
add esp, 0xc
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x60], 0x14
cmovae eax, dword [ebp - 0x78]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x7c]
movups xmmword [ebp - 0x5c], xmm0
call dword [ebp - 0x84]
test eax, eax
jne 0x100665e5
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.1016cd8a
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x10066624
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1006661a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10066666
push edx
push ecx
call fcn.101614ae
add esp, 8
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.10093090
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016100c
mov esp, ebp
pop ebp
ret 4
call fcn.10168a09
int3
Function at 0x10066670
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x101ef110]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.101652e0
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100666cc
cmp dword [esp + 4], 6
jb 0x100666cc
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1016100c
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.1016100c
add esp, 0x118
ret
Function at 0x100671e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x101ef110]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x244]
test ebx, ebx
je 0x1006732b
mov eax, dword [ecx]
test eax, eax
je 0x1006732b
push edi
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1006732a
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call fcn.101652e0
add esp, 0xc
mov dword [esp + 0x10], 0x208
cmp dword [esi + 0x14], 8
jb 0x10067259
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
call edi
lea eax, [esp + 0x34]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10067272
sub eax, edx
lea ecx, [ebp + 0x38]
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.100054b0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push ebx
call edi
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100672b4
sub ecx, edx
lea eax, [esp + 0x34]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x50]
call fcn.100054b0
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push ebx
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call edi
pop edi
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1016100c
add esp, 0x230
ret 0xc
Function at 0x100685f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194c88
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x101ef110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.1016101d
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.101652e0
add esp, 0x10
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10068674
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.10015390
test al, al
je 0x100686a1
lea ecx, [ebp - 0x14]
call fcn.100146d0
test al, al
jne 0x100686a1
xor bl, bl
jmp 0x1006873e
lea esi, [edi + 4]
push esi
push 0
call fcn.100928b0
add esp, 8
test al, al
jne 0x100686c7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100686c2
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x1c]
push esi
push 0x1a
call fcn.100928b0
add esp, 8
test al, al
jne 0x100686ed
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100686e8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x34]
push esi
push 2
call fcn.100928b0
add esp, 8
test al, al
jne 0x10068713
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1006870e
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x4c]
push esi
push 0xb
call fcn.100928b0
add esp, 8
test al, al
jne 0x10068739
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10068734
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov byte [edi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10013f20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016100c
mov esp, ebp
pop ebp
ret
Function at 0x100687f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194cd1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x101ef110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edx, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x10068834
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1006884e
mov eax, edx
nop dword [eax]
cmp word [eax], 0x25
je 0x10068883
add eax, 2
sub ecx, 1
jne 0x10068840
push esi
mov ecx, edi
call fcn.10005340
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016100c
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x1006884e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x1006884e
push esi
lea ecx, [ebp - 0x28]
call fcn.10005340
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100688aa
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x10068922
push esi
mov ecx, edi
call fcn.10005340
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10068909
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100688ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100689e2
push edx
push ecx
call fcn.101614ae
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x10068864
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10161a35
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x10068949
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x10068989
cmp eax, dword [ebp - 0x34]
ja 0x10068989
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068970
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100054b0
push esi
call fcn.10161835
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
add esp, 4
mov dword [edi + 0x14], 0
xor eax, eax
movups xmmword [edi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x10068864
call fcn.10168a09
int3
Function at 0x10070c70
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101957fc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101ef110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.10005450
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10005450
push 0x88
push ebx
call fcn.101614ae
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100767c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ba58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101ef110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.10005340
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000dab0
add esp, 4
cmp dword [ebp - 0x18], 2
jbe 0x100768cc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 8
cmovae eax, edx
cmp word [eax], 0x5c
jne 0x1007683e
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 2], 0x5c
jne 0x1007683e
mov bl, 1
jmp 0x10076935
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x2f
jne 0x10076861
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 2], 0x2f
je 0x10076933
push 0x5c
lea eax, [ebp - 0x28]
push 0x2f
push eax
call fcn.1000d8a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
add esp, 0xc
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 4], 0x5c
jne 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
jmp 0x1007691c
jne 0x10076933
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x10076933
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x10076933
push 1
push 0x101c3180
lea ecx, [ebp - 0x28]
call fcn.10008550
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10076933
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
jmp 0x10076935
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10076972
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10076968
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100769a3
push edx
push ecx
call fcn.101614ae
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016100c
mov esp, ebp
pop ebp
ret
call fcn.10168a09
int3
Function at 0x1008ee30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1008ee3b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1008ee50
Function at 0x100928b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101e0dc0
push 0x10164860
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x101ef110]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x434], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1009290a
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.100929f0
mov bl, al
mov byte [ebp - 0x42d], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x1009294d
test bl, bl
jne 0x100929ce
cmp edi, 0x1a
jne 0x100929ce
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10092967
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x42c]
push eax
call fcn.101652e0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x42c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x42c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100929a1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x42c]
push eax
mov ecx, esi
call fcn.100054b0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1016100c
mov esp, ebp
pop ebp
ret
Function at 0x10092eb0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x10198982
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101ef110]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x10092ef4
call fcn.10093090
cmp byte [0x101f3f24], 0
jne 0x10092f07
mov eax, reloc.gdiplus.dll_Ordinal_1
jmp 0x10093066
mov eax, dword [esi]
test eax, eax
jne 0x10092f72
push 8
call fcn.1016101d
mov edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0
push 1
call fcn.1016101d
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call fcn.101652e0
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10092f61
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x10093055
call fcn.10014c90
test al, al
jne 0x10092fb4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.10015390
test al, al
je 0x10093055
mov ecx, dword [esi]
add ecx, 4
call fcn.100146d0
call fcn.10014c90
test al, al
je 0x10093055
push str.Advapi32.dll
lea ecx, [ebp - 0x24]
call fcn.100052e0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x24]
push eax
call fcn.10017fd0
mov ecx, eax
call fcn.10018090
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10093017
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009300d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009308a
push edx
push ecx
call fcn.101614ae
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test edi, edi
je 0x10093055
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10093055
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x10093055
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x10093064
mov dword [eax], reloc.gdiplus.dll_Ordinal_1
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.1016100c
lea esp, [ebp + 0x120]
pop ebp
ret 4
call fcn.10168a09
int3
Function at 0x10095710
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10198d9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ef110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10005450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100957a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10198d9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ef110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10005450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10098bb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019926f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101ef110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10005340
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10005340
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10005340
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10005340
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10005340
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10005340
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1009b210
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x101ef110]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x1009b292
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1009b292
test ecx, ecx
je 0x1009b28e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1009b250
xor eax, eax
jmp 0x1009b297
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1009b2a1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1016100c
add esp, 0xc
ret 0xc
Function at 0x100ab340
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x101ef110]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100ab3a5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100ab380
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100ab3a5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1016100c
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.1016100c
add esp, 8
ret 4