joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ecdd0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189d3f
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], 0
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
push dword [esi + 4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xa0], eax
test eax, eax
jne 0x100ece46
mov dword [ebx], 0xa80356
jmp 0x100ecf66
lea eax, [esi + 0x74]
mov dword [ebp - 0x94], vtable.RC::DM::ISerialization.0
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], vtable.RC::DM::RCProcessToken.0
call fcn.100ee500
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x84]
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x88], eax
lea eax, [esi + 0x80]
push eax
call fcn.100ecfe0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0xd8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa8]
call fcn.100ee500
mov dword [ebp - 0x98], 1
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0xa8]
mov esi, dword [edi]
cmp esi, edi
je 0x100ecf1a
nop dword [eax + eax]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007960
or dword [ebp - 0x98], 2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov edx, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push 0x10
push str.SeDebugPrivilege
call fcn.100268f0
add esp, 8
test eax, eax
je 0x100ecf86
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.100078b0
mov esi, dword [esi]
cmp esi, edi
jne 0x100eced0
mov dword [ebx], 0xa8035a
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 6
call fcn.100e4a30
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xa8]
push 0x28
push eax
mov byte [ebp - 4], 8
call fcn.10161fa4
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.100f6580
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret 8
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xac], esp
push str.SeDebugPrivilege
call fcn.100078f0
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.100eb190
add esp, 0x1c
mov ecx, dword [eax]
mov dword [ebx], ecx
lea ecx, [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov byte [ebp - 4], 3
call fcn.100078b0
jmp 0x100ecf20
Function at 0x100ed070
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189d3f
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], 0
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
push dword [esi + 4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xa0], eax
test eax, eax
jne 0x100ed0e6
mov dword [ebx], 0xa80356
jmp 0x100ed206
lea eax, [esi + 0x74]
mov dword [ebp - 0x94], vtable.RC::DM::ISerialization.0
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], vtable.RC::DM::RCProcessToken.0
call fcn.100ee500
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x84]
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x88], eax
lea eax, [esi + 0x80]
push eax
call fcn.100ecfe0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0xd8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa8]
call fcn.100ee500
mov dword [ebp - 0x98], 1
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0xa8]
mov esi, dword [edi]
cmp esi, edi
je 0x100ed1ba
nop dword [eax + eax]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007960
or dword [ebp - 0x98], 2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov edx, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push 0x10
push str.SeDebugPrivilege
call fcn.100268f0
add esp, 8
test eax, eax
je 0x100ed226
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.100078b0
mov esi, dword [esi]
cmp esi, edi
jne 0x100ed170
mov dword [ebx], 0xa8035a
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 6
call fcn.100e4a30
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xa8]
push 0x28
push eax
mov byte [ebp - 4], 8
call fcn.10161fa4
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.100f6580
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret 8
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xac], esp
push str.SeDebugPrivilege
call fcn.100078f0
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.100eb190
add esp, 0x1c
mov ecx, dword [eax]
mov dword [ebx], ecx
lea ecx, [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov byte [ebp - 4], 3
call fcn.100078b0
jmp 0x100ed1c0
Function at 0x100ed280
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
push eax
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x100ed2fd
cmp dword [ebp - 0x114], 5
jne 0x100ed2fd
cmp dword [ebp - 0x110], 1
jne 0x100ed2fd
push dword [ebp - 0x11c]
mov edx, edi
lea ecx, [ebp - 0x120]
push ebx
call fcn.100eba70
jmp 0x100ed311
push dword [ebp - 0x11c]
mov edx, edi
lea ecx, [ebp - 0x120]
push ebx
call fcn.100eb4a0
mov ecx, dword [eax]
add esp, 8
mov eax, dword [eax + 4]
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
xor ecx, ebp
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.10161f63
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100ee310
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
push 0
push 2
mov dword [ebp - 0x240], ecx
mov byte [ebp - 0x231], bl
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x100ee3e1
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100ee3da
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
cmp dword [ebp - 0x228], edi
je 0x100ee3d4
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x100ee370
mov al, byte [ebp - 0x231]
xorps xmm0, xmm0
movlpd qword [ebp - 0x23c], xmm0
test al, al
je 0x100ee3d8
mov ecx, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
push edx
push edi
lea edx, [ebp - 0x244]
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
cmp dword [eax], 0
jne 0x100ee3d8
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp + 0xc]
jne 0x100ee3d8
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp + 0x10]
jne 0x100ee3d8
mov bl, 1
jmp 0x100ee3da
mov al, 1
jmp 0x100ee38c
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10161f63
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f0480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a570
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add esi, 4
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ecx
cmp dword [esi + 0x10], 0
je 0x100f05b2
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100f04d1
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100f05b2
cmp dword [esi + 0x14], 8
jb 0x100f04e9
mov esi, dword [esi]
lea eax, [ebp - 0x38]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x100f050c
mov dword [ebx], 0xa80035
mov dword [ebx + 4], 2
jmp 0x100f05c0
push dword [ebp - 0x20]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x24]
push eax
call fcn.10143b40
add esp, 0xc
push 0
push 0xf4240
mov dword [ebp - 4], 0
push dword [eax + 4]
push dword [eax]
call fcn.10162a00
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], edx
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.1001d6a0
push dword [ebp - 0x30]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x34]
push eax
call fcn.10143b40
add esp, 0xc
push 0
push 0xf4240
mov dword [ebp - 4], 1
push dword [eax + 4]
push dword [eax]
call fcn.10162a00
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edi, edx
call fcn.1001d6a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + 0x18], esi
mov esi, edx
mov byte [edx + 0x10], 1
mov edx, dword [ebp - 0x40]
mov dword [esi + 0x20], ebx
mov ebx, dword [ebp - 0x44]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edx
mov dword [esi + 0xc], ecx
jmp 0x100f05b7
mov eax, 0xa80038
mov dword [ebx], eax
mov dword [ebx + 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100fd7e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018cfc0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x100fd81a
xor al, al
jmp 0x100fd9d5
call fcn.100fd660
test al, al
je 0x100fd82a
mov al, 1
jmp 0x100fd9d5
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100fd834
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call ebx
test eax, eax
jne 0x100fd887
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1011be90
test al, al
je 0x100fd878
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10009450
mov ecx, esi
call fcn.100fd660
test al, al
jne 0x100fd823
mov eax, dword [esi + 0x10]
xor edi, edi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x100fd968
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x100fd8ae
mov eax, dword [esi]
mov edx, 0x2f
cmp dx, word [eax + edi*2]
mov edx, 0x5c
je 0x100fd8d1
mov eax, esi
cmp ecx, 8
jb 0x100fd8c7
mov eax, dword [esi]
cmp dx, word [eax + edi*2]
jne 0x100fd95e
push edi
push 0
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.1006ec70
mov dword [ebp - 4], 1
cmp dword [ebp - 0x30], 0
je 0x100fd94f
lea ecx, [ebp - 0x40]
call fcn.100fd490
test al, al
jne 0x100fd94f
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
jne 0x100fd94f
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.1011be90
test al, al
je 0x100fd943
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10009450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10009450
inc edi
cmp edi, dword [ebp - 0x44]
jb 0x100fd8a2
mov ecx, esi
call fcn.100fd490
test al, al
jne 0x100fd9ce
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100fd97d
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
jne 0x100fd9ce
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1011be90
test al, al
je 0x100fd9bf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10009450
mov ecx, esi
call fcn.100fd660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret
Function at 0x10100f50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x10207514]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10100f78
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x10100fbc
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.10161f63
add esp, 0x418
ret
cmp eax, 0x208
jae 0x10100fa4
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10100fd4
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.100094b0
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.10161f63
add esp, 0x418
ret
Function at 0x10107c50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101f9648
push 0x1016298b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10207514]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10107cb1
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.10107da0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x10107cf4
test bl, bl
jne 0x10107d7d
cmp edi, 0x1a
jne 0x10107d7d
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10107d16
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10107d50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.100094b0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret
Function at 0x10107fd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187e71
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x10108013
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1010802e
mov eax, edx
nop dword [eax]
cmp word [eax], 0x25
je 0x10108061
add eax, 2
sub ecx, 1
jne 0x10108020
push esi
mov ecx, edi
call fcn.10007960
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1010802e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x1010802e
push esi
lea ecx, [ebp - 0x28]
call fcn.10007960
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10108088
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x101080b7
push esi
mov ecx, edi
call fcn.10007960
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10009450
jmp 0x10108044
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101629ae
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x101080de
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x1010811b
cmp eax, dword [ebp - 0x34]
ja 0x1010811b
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10108102
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100094b0
push esi
call fcn.1016297d
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
add esp, 4
movups xmmword [edi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28]
call fcn.10009450
jmp 0x10108044
Function at 0x101085d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101829c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x1010860b
xor al, al
jmp 0x101086af
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x10108627
mov eax, dword [edi]
test eax, eax
je 0x10108627
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1010868c
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10108170
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x101086cb
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x10108684
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10108330
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x101086ad
mov eax, dword [edi]
test eax, eax
je 0x101086a6
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x101086e3
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1010866e
mov bl, 1
jmp 0x1010868e
Function at 0x1010b390
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018e866
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x10207514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x81c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call edi
mov ebx, eax
test ebx, ebx
je 0x1010b484
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], 0
mov dword [ebp - 4], 0
cmp ebx, 0x3fe
jbe 0x1010b4a2
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101629ae
mov edx, dword [ebp - 0x814]
lea ecx, [ebp - 0x814]
add esp, 4
mov esi, eax
mov dword [ebp - 0x818], esi
call fcn.10008c80
mov dword [eax], esi
test edx, edx
je 0x1010b456
push edx
call fcn.100e5f50
push esi
push ebx
call edi
test eax, eax
je 0x1010b46d
cmp eax, ebx
ja 0x1010b46d
mov ecx, esi
xor edx, edx
mov ebx, eax
mov dword [ecx + eax*2], edx
jmp 0x1010b4d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x1010b484
push eax
call fcn.100e5f50
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10161f63
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x1010b54f
xor edx, edx
mov word [ebp + eax - 0x810], dx
add eax, 2
cmp eax, 0x800
jae 0x1010b54f
mov word [ebp + eax - 0x810], dx
xor eax, eax
xor esi, esi
test ebx, ebx
je 0x1010b531
mov edi, 2
nop dword [eax]
cmp word [ecx + edi - 2], 0
jne 0x1010b529
cmp eax, esi
je 0x1010b529
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x834]
call fcn.100078f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x834]
mov ecx, dword [ebp - 0x81c]
push eax
call fcn.10019bd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x834]
call fcn.10009450
mov ecx, dword [ebp - 0x818]
lea eax, [esi + 1]
inc esi
add edi, 2
cmp esi, ebx
jb 0x1010b4e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x1010b548
push eax
call fcn.100e5f50
mov al, 1
jmp 0x1010b486
call fcn.101628a3
int3

Function at 0x1010b580
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x10207514]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.10161f74
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x1010b5dc
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.10161f63
add esp, 0x120
ret