joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100881c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x244]
push edi
mov edi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
test ebx, ebx
je 0x10088318
mov eax, dword [edi]
test eax, eax
je 0x10088318
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10088318
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x208
cmp dword [esi + 0x14], 8
jb 0x10088245
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
call edi
lea eax, [esp + 0x34]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10088260
sub eax, edx
lea ecx, [ebp + 0x38]
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10003530
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push ebx
call edi
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100882a2
sub ecx, edx
lea eax, [esp + 0x34]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x50]
call fcn.10003530
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push ebx
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call edi
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e2b24
add esp, 0x230
ret 0xc
Function at 0x1008c0d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faa7f
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, 0x1014814b
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
call fcn.100e5245
push 0
push 0x25
mov ecx, esi
call fcn.100568b0
push esi
cmp eax, 0xffffffff
jne 0x1008c140
mov ecx, edi
call fcn.1001af80
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
jmp 0x1008c231
lea ecx, [ebp - 0x28]
call fcn.1001af80
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1008c159
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x1008c190
push esi
mov ecx, edi
call fcn.1001af80
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.10003460
mov dword [ebp - 4], ebx
jmp 0x1008c22a
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e3747
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x1008c1b7
mov esi, dword [esi]
lea ecx, [ebx + 1]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x1008c1f9
cmp eax, ebx
ja 0x1008c1f9
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008c1e0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10003530
push esi
call fcn.100e2b73
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10018490
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10003460
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 8
Function at 0x1008cfb0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fade4
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1014814b
call fcn.100e5245
push 0x208
lea eax, [ebp - 0x264]
mov dword [ebp - 0x5c], 0x61004d
push 0
push eax
mov dword [ebp - 0x58], 0x720063
mov ebx, 0x6c
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.10003030
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10003030
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c8]
push eax
lea edx, [ebp - 0x2b0]
lea ecx, [ebp - 0x294]
call fcn.100a29d0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b0]
call fcn.10003460
mov byte [ebp - 4], 3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x294]
call fcn.1009d9b0
test al, al
jne 0x1008d124
xor bl, bl
jmp 0x1008d181
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.100a7c00
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
jne 0x1008d147
xor bl, bl
jmp 0x1008d16a
lea eax, [ebp - 0x27c]
cmp esi, eax
je 0x1008d168
cmp dword [ebp - 0x268], 8
push ecx
cmovae eax, dword [ebp - 0x27c]
mov ecx, esi
push eax
call fcn.10003530
mov bl, 1
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x27c]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x294]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 4
Function at 0x10096bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov ecx, 0x101471df
push edi
call fcn.100e5245
cmp dword [ebx + 0x38], 0
je 0x10096be8
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10096c0a
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10096c0c
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10096c91
jg 0x10096c21
test esi, esi
je 0x10096c91
test ecx, ecx
jl 0x10096c6a
jg 0x10096c2b
test eax, eax
je 0x10096c6a
cmp edi, ecx
jg 0x10096c3f
jl 0x10096c35
cmp esi, eax
jae 0x10096c3f
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10096c6d
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10096c91
jg 0x10096c77
test esi, esi
je 0x10096c91
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10096c91
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10096cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x101471df
call fcn.100e5245
cmp dword [edi + 0x38], 0
je 0x10096ce8
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10096d0a
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10096d0c
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10096dac
jg 0x10096d29
test esi, esi
je 0x10096dac
test ecx, ecx
jl 0x10096d76
jg 0x10096d33
test eax, eax
je 0x10096d76
cmp ebx, ecx
jg 0x10096d47
jl 0x10096d3d
cmp esi, eax
jae 0x10096d47
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10096d7d
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10096dac
jg 0x10096d87
test esi, esi
je 0x10096dac
cmp dword [edi + 0x4c], 0
je 0x10096dac
mov ecx, edi
call fcn.100980a0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10097160
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov esi, ecx
mov ecx, 0x101471df
call fcn.100e5245
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
jne 0x1009719a
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100971cd
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100971cd
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100972d3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100971f6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1009722b
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100972d3
cmp eax, 1
jle 0x1009728f
cmp eax, 3
jne 0x100972d3
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.10095db0
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x100972af
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100972d3
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x100972d3
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e2b24
add esp, 0x30
ret 4
Function at 0x10098110
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x101471df
push edi
call fcn.100e5245
cmp dword [esi + 0x38], 0
je 0x100981c8
cmp byte [esi + 0x3d], 0
je 0x100981c8
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10098179
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1009818c
sub eax, 1
je 0x10098190
sub eax, 2
je 0x100981c8
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e2b24
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100981b0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10098179
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e2b24
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.100e2b24
add esp, 0x28
ret
Function at 0x1009bc60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5922
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
mov edi, dword [esi + 8]
test edi, edi
jne 0x1009bca5
xor al, al
jmp 0x1009bd57
mov dword [ebp - 0x14], 0
add edi, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edi
je 0x1009bcc8
mov eax, dword [edi]
test eax, eax
je 0x1009bcc8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1009bd2d
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x1009b4c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x1009bd73
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x1009bd25
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.1009b690
xor bl, bl
mov dword [ebp - 4], 2
test edi, edi
je 0x1009bd4e
mov eax, dword [edi]
test eax, eax
je 0x1009bd47
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x1009bd8b
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1009bd0f
mov bl, 1
jmp 0x1009bd2f

Function at 0x1009c2c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x1014814b
push edi
mov edi, dword [esp + 0x14]
call fcn.100e5245
mov eax, dword [esi]
test eax, eax
je 0x1009c32f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1009c32f
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009c30a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009c32f
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100e2b24
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100e2b24
add esp, 8
ret 4
Function at 0x1009ed00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x1009ed32
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1009ed76
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.100e2b24
add esp, 0x418
ret
cmp eax, 0x208
jae 0x1009ed5e
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1009ed90
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10003530
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.100e2b24
add esp, 0x418
ret

Function at 0x1009fc90
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
push 0x118
lea eax, [esi + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1009fddc
cmp dword [esi + 4], 6
push edi
ja 0x1009fcf0
jne 0x1009fd78
cmp dword [esi + 8], 2
jb 0x1009fd78
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1009fd78
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1009fd78
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1009fd78
movups xmm0, xmmword [0x101163bc]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x101163cc]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1009fd78
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009fd78
cmp word [edi + 2], ax
jbe 0x1009fd78
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1009fdc3
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1009fdc3
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.100e2b24
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.100e2b24
add esp, 0x140
ret
Function at 0x100a2f10
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x101377c8
push 0x100e3724
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10144008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov ecx, 0x1014814b
call fcn.100e5245
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100a2f80
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.100a3060
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x100a2fb7
test bl, bl
jne 0x100a302c
cmp edi, 0x1a
jne 0x100a302c
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100a2fd1
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push 0x10116600
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a3002
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10003530
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.100e2b24
lea esp, [ebp + 0x414]
pop ebp
ret