joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102a12b
Capabilities:
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.01039d9c
lea ebx, [esi + 0x130]
xor edi, edi
push edi
mov ecx, ebx
call fcn.01038d96
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push edi
push 1
push edi
mov dword [esi], 0x1001f1c
call ebp
push edi
push edi
push 1
push edi
mov dword [esi + 0x18], eax
call ebp
mov dword [esi + 0x1c], eax
push 0x104
lea eax, [esi + 0x28]
push edi
push eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call sub.ole32.dll_CoInitialize
add esp, 0xc
mov dword [esi + 0x12c], edi
mov ecx, esi
mov dword [esi + 0x168], 2
push ebx
call fcn.0103a066
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x102a38f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 1
mov ebx, ecx
pop esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 8], esi
call fcn.01037a1e
mov eax, dword [ebp + 8]
cmp eax, esi
jne 0x102a3c2
and dword [ebp - 8], 0
mov dword [ebp - 4], esi
jmp 0x102a4dc
cmp eax, esi
mov edi, 0x104
jle 0x102a443
mov ecx, dword [ebp + 0xc]
add ecx, 4
dec eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov cl, byte [eax]
cmp cl, 0x2f
je 0x102a3f7
cmp cl, 0x2d
je 0x102a3f7
push edi
push eax
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x102a43a
movsx eax, byte [eax + 1]
push eax
call dword [0x10011cc]
sub eax, 0x68
pop ecx
je 0x102a434
sub eax, 0xc
je 0x102a42b
dec eax
dec eax
je 0x102a422
dec eax
je 0x102a419
mov dword [ebp - 4], esi
jmp 0x102a43a
or dword [ebx + 0x12c], 8
jmp 0x102a43a
or dword [ebx + 0x12c], 4
jmp 0x102a43a
or dword [ebx + 0x12c], 2
jmp 0x102a43a
or dword [ebx + 0x12c], esi
add dword [ebp + 8], 4
dec dword [ebp + 0xc]
jne 0x102a3d8
cmp byte [ebx + 0x28], 0
lea esi, [ebx + 0x28]
jne 0x102a45c
and dword [ebp - 8], 0
mov dword [ebp - 4], 1
jmp 0x102a4dc
push 0x5c
push esi
call dword [0x10011c8]
pop ecx
test eax, eax
pop ecx
jne 0x102a4be
push 0x3a
push esi
call dword [0x10011c8]
pop ecx
test eax, eax
pop ecx
jne 0x102a4be
and byte [ebp - 0x128], al
lea eax, [ebp - 0x128]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x24]
push eax
call fcn.01037cb7
push 0x1001f84
lea ecx, [ebp - 0x24]
call fcn.01037dec
push esi
lea ecx, [ebp - 0x24]
call fcn.01037dec
push edi
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x128]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x128]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [ebp - 4], 0
je 0x102a4f5
add ebx, 0x130
push 0x1001340
push ebx
call fcn.01038b2a
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
call fcn.01037a70
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x102b92c
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
je 0x102b959
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [esi + 0x10]
and dword [edi + 4], 0
mov dword [edi + 8], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x102b956
mov dword [eax + 4], edi
mov dword [esi + 0x10], edi
pop edi
pop esi
ret 4

Function at 0x102bf83
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi], 0x1002590
test eax, eax
je 0x102bfaf
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x102bfa7
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0xc], eax
and dword [esi + 4], 0
and dword [esi + 8], 0
add esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
pop esi
ret

Function at 0x102c0f8
Capabilities:
Get system information on windows
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
mov dword [esi + 0x1cc], edi
mov dword [esi + 0x1c4], edi
mov dword [esi + 0x1c8], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
pop eax
mov dword [esi + 0x238], edi
push edi
push edi
push 1
push edi
mov dword [esi + 0x200], eax
mov dword [esi + 0x204], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1d0], eax
call ebx
cmp dword [esi + 0x1d0], edi
mov dword [esi + 0x1d4], eax
je 0x102c159
cmp eax, edi
jne 0x102c167
push 0xffffffffffffffff
push 0x10027c0
mov ecx, esi
call fcn.01039de1
push 0x14
lea eax, [esi + 0x1d8]
push edi
push eax
call sub.ole32.dll_CoInitialize
mov eax, dword [esi + 0x1d0]
add esp, 0xc
mov dword [esi + 0x1e8], eax
lea eax, [esi + 0x1ec]
push 0x14
push edi
push eax
call sub.ole32.dll_CoInitialize
mov eax, dword [esi + 0x1d4]
add esp, 0xc
mov dword [esi + 0x1fc], eax
lea eax, [esi + 0x208]
push 0x14
push edi
push eax
call sub.ole32.dll_CoInitialize
add esp, 0xc
lea eax, [esi + 0x21c]
push 0x1c
push edi
push eax
call sub.ole32.dll_CoInitialize
mov ebx, dword [esp + 0x1c]
add esp, 0xc
cmp ebx, edi
je 0x102c20b
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x81
inc eax
push 0x100278c
push 0x40
push eax
call fcn.0102bb5a
cmp eax, edi
mov dword [esi + 0x1c4], eax
je 0x102c1fd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x102c20b
push 8
push 0x1002778
mov ecx, esi
call fcn.01039de1
pop edi
pop esi
pop ebx
ret 4
Function at 0x102c211
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x1c8], ebx
je 0x102c22f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
lea edi, [esi + 0x1c4]
push ebx
push ebx
push dword [edi]
call fcn.0102bdaf
mov eax, dword [esi + 0x1d0]
mov dword [edi], ebx
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, 0x10027cc
je 0x102c269
push eax
call ebx
push 0xffffffffffffffff
push ebp
mov ecx, esi
call fcn.01039de1
and dword [esi + 0x1d0], 0
mov eax, dword [esi + 0x1d4]
lea edi, [esi + 0x1d4]
test eax, eax
je 0x102c289
push eax
call ebx
push 0xffffffffffffffff
push ebp
mov ecx, esi
call fcn.01039de1
and dword [edi], 0
mov ecx, dword [esi + 0x1cc]
add esi, 0x1cc
test ecx, ecx
je 0x102c29f
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [esi], 0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x102c5aa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 4], eax
cmp dword [esi + 0x1c8], eax
je 0x102c68d
cmp dword [esi + 0x1d4], eax
je 0x102c68d
cmp dword [ebp + 8], eax
je 0x102c68d
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
call ebx
push dword [esi + 0x1d4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esi + 0x1ec]
push 0x14
push 0
push edi
call sub.ole32.dll_CoInitialize
mov eax, dword [esi + 0x1d4]
add esp, 0xc
mov dword [esi + 0x1fc], eax
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c8]
call dword [sym.imp.KERNEL32.dll_HeapSize]
test eax, eax
mov dword [ebp + 8], eax
jne 0x102c664
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp eax, 0x3e5
jne 0x102c664
lea eax, [ebp - 4]
push 1
push eax
push edi
push dword [esi + 0x1c8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0102d15c
cmp dword [ebp + 8], 0
jne 0x102c678
push 0xffffffffffffffff
push 0x100287c
jmp 0x102c671
cmp dword [ebp + 8], 0
jne 0x102c678
push 0xffffffffffffffff
push 0x1002870
mov ecx, esi
call fcn.01039de1
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x102c684
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push 0
call ebx
mov eax, dword [ebp + 8]
jmp 0x102c68f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102c696
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1c8], edi
mov dword [ebp - 4], edi
je 0x102c775
cmp dword [esi + 0x1d4], edi
je 0x102c775
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
and dword [esi + 0x214], edi
mov dword [ebp - 0xc], eax
mov eax, 0x3e8
cmp dword [ebp + 0x14], eax
ja 0x102c6e3
mov eax, dword [ebp + 0x14]
push 0
mov ecx, esi
mov dword [esi + 0x218], eax
call fcn.0102ca0c
cmp dword [ebp + 0xc], edi
jbe 0x102c750
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push eax
mov eax, dword [ebp + 0xc]
sub eax, edi
mov ecx, esi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call fcn.0102c5aa
cmp dword [ebp - 8], 0
jne 0x102c728
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x204]
jae 0x102c750
jmp 0x102c72c
and dword [ebp - 4], 0
add edi, dword [ebp - 8]
call ebx
cmp eax, dword [ebp - 0xc]
jb 0x102c73b
sub eax, dword [ebp - 0xc]
jmp 0x102c743
or ecx, 0xffffffff
sub ecx, dword [ebp - 0xc]
add eax, ecx
cmp eax, dword [ebp + 0x14]
jb 0x102c74b
mov eax, dword [ebp + 0x14]
sub dword [ebp + 0x14], eax
jne 0x102c6f2
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x102c759
mov dword [eax], edi
cmp dword [ebp + 0xc], edi
jbe 0x102c76b
push 0x1002890
push esi
call fcn.01039f6c
pop ecx
pop ecx
xor eax, eax
cmp eax, edi
sbb eax, eax
neg eax
jmp 0x102c777
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x102c77e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 4], eax
cmp dword [esi + 0x1c8], eax
je 0x102c861
cmp dword [esi + 0x1d0], eax
je 0x102c861
cmp dword [ebp + 8], eax
je 0x102c861
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
call ebx
push dword [esi + 0x1d0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esi + 0x1d8]
push 0x14
push 0
push edi
call sub.ole32.dll_CoInitialize
mov eax, dword [esi + 0x1d0]
add esp, 0xc
mov dword [esi + 0x1e8], eax
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c8]
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
mov dword [ebp + 8], eax
jne 0x102c838
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp eax, 0x3e5
jne 0x102c838
lea eax, [ebp - 4]
push 1
push eax
push edi
push dword [esi + 0x1c8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0102d15c
cmp dword [ebp + 8], 0
jne 0x102c84c
push 0xffffffffffffffff
push 0x100287c
jmp 0x102c845
cmp dword [ebp + 8], 0
jne 0x102c84c
push 0xffffffffffffffff
push 0x10028a0
mov ecx, esi
call fcn.01039de1
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x102c858
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push 0
call ebx
mov eax, dword [ebp + 8]
jmp 0x102c863
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102c86a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1c8], edi
je 0x102c94f
cmp dword [esi + 0x1d0], edi
je 0x102c94f
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov dword [ebp - 0xc], eax
mov eax, 0x7d0
xor ecx, ecx
cmp dword [ebp + 0x14], eax
mov dword [ebp - 4], ecx
mov dword [esi + 0x208], ecx
mov dword [esi + 0x20c], ecx
ja 0x102c8bf
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, esi
mov dword [esi + 0x210], eax
call fcn.0102ca0c
cmp dword [ebp + 0xc], edi
jbe 0x102c92b
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push eax
mov eax, dword [ebp + 0xc]
sub eax, edi
mov ecx, esi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call fcn.0102c77e
cmp dword [ebp - 8], 0
jne 0x102c903
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x200]
jae 0x102c92b
jmp 0x102c907
and dword [ebp - 4], 0
add edi, dword [ebp - 8]
call ebx
cmp eax, dword [ebp - 0xc]
jb 0x102c916
sub eax, dword [ebp - 0xc]
jmp 0x102c91e
or ecx, 0xffffffff
sub ecx, dword [ebp - 0xc]
add eax, ecx
cmp eax, dword [ebp + 0x14]
jb 0x102c926
mov eax, dword [ebp + 0x14]
sub dword [ebp + 0x14], eax
jne 0x102c8cd
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x102c934
mov dword [eax], edi
test edi, edi
jne 0x102c945
push 0x10028ac
push esi
call fcn.01039f6c
pop ecx
pop ecx
xor eax, eax
cmp eax, edi
sbb eax, eax
neg eax
jmp 0x102c951
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x102ca0c
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 8], 0
je 0x102ca33
push 0x14
lea eax, [esi + 0x208]
push dword [esp + 0xc]
push eax
call fcn.0103e456
add esp, 0xc
mov eax, dword [esi + 0x1c8]
test eax, eax
je 0x102ca61
lea ecx, [esi + 0x208]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xffffffffffffffff
push 0x10028bc
mov ecx, esi
call fcn.01039de1
xor eax, eax
cmp dword [esi + 4], eax
sete al
pop esi
ret 4

Function at 0x102ca65
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 8], 0
je 0x102ca8c
push 0x1c
lea eax, [esi + 0x21c]
push dword [esp + 0xc]
push eax
call fcn.0103e456
add esp, 0xc
mov eax, dword [esi + 0x1c8]
test eax, eax
je 0x102caba
lea ecx, [esi + 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0xffffffffffffffff
push 0x10028cc
mov ecx, esi
call fcn.01039de1
xor eax, eax
cmp dword [esi + 4], eax
sete al
pop esi
ret 4
Function at 0x102cb0a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push 0
mov dword [ebp - 0xc], 0x1002924
mov dword [ebp - 8], 0x1002920
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c8]
test eax, eax
je 0x102cb92
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x102cb84
mov eax, dword [ebp - 4]
push 1
mov edx, eax
pop ecx
shr edx, 7
and edx, ecx
push dword [ebp + edx*4 - 0xc]
mov edx, eax
shr edx, 6
and edx, ecx
push dword [ebp + edx*4 - 0xc]
mov edx, eax
shr edx, 5
and edx, ecx
shr eax, 4
push dword [ebp + edx*4 - 0xc]
and eax, ecx
push dword [ebp + eax*4 - 0xc]
push 0x10028fc
push esi
call fcn.01039f6c
add esp, 0x18
push 0xffffffffffffffff
push 0x10028e8
mov ecx, esi
call fcn.01039de1
pop esi
leave
ret

Function at 0x102cb95
Capabilities:
Get system information on windows

Disassembly:
push ecx
push ebp
push esi
push edi
push 0xfffffffffffffffd
pop edi
mov esi, ecx
push 0
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x102cbb9
mov eax, edi
jmp 0x102cc98
push ebx
mov ebx, dword [esi + 0x238]
xor edi, edi
test ebx, ebx
je 0x102cc1b
push ebp
call fcn.0103e450
pop ecx
mov edi, eax
push ebx
call fcn.0103e450
cmp eax, edi
pop ecx
jae 0x102cbe2
push dword [esi + 0x238]
jmp 0x102cbe3
push ebp
call fcn.0103e450
pop ecx
mov edi, eax
push edi
push ebp
push dword [esi + 0x238]
call dword [0x10011dc]
add esp, 0xc
test eax, eax
jne 0x102cc1b
push dword [esi + 0x238]
call fcn.0103e450
pop ecx
xor ecx, ecx
cmp edi, eax
setne cl
dec ecx
dec ecx
mov dword [esp + 0x10], ecx
jmp 0x102cc89
mov esi, 0x101f058
mov ebx, dword [esi]
test ebx, ebx
je 0x102cc7e
push ebp
call fcn.0103e450
pop ecx
mov edi, eax
push ebx
call fcn.0103e450
cmp eax, edi
pop ecx
jae 0x102cc3e
push dword [esi]
jmp 0x102cc3f
push ebp
call fcn.0103e450
pop ecx
mov edi, eax
push edi
push ebp
push dword [esi]
call dword [0x10011dc]
add esp, 0xc
test eax, eax
jne 0x102cc7e
push dword [esi]
call fcn.0103e450
cmp edi, eax
pop ecx
je 0x102cc72
cmp dword [esp + 0x1c], 0
jne 0x102cc72
or dword [esp + 0x10], 0xffffffff
jmp 0x102cc7e
mov eax, dword [esi + 4]
cmp eax, 2
mov dword [esp + 0x10], eax
jne 0x102cc89
add esi, 8
cmp esi, 0x101f0b8
jb 0x102cc20
mov eax, dword [esp + 0x20]
test eax, eax
je 0x102cc93
mov dword [eax], edi
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
Function at 0x102cc9f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
push ebx
mov dword [ebp - 4], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x28
lea eax, [ebp - 0x34]
push ebx
push eax
call sub.ole32.dll_CoInitialize
add esp, 0xc
xor esi, esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
push 0x27
pop eax
sub eax, esi
push eax
lea eax, [esi + esi*4]
lea eax, [ebp + eax*8 - 0x34]
push eax
call fcn.0102c86a
test eax, eax
je 0x102cd76
add esi, dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
mov byte [ebp + esi - 0x34], bl
je 0x102cd7f
cmp byte [ebp - 0x34], bl
je 0x102cd1c
lea eax, [ebp - 0x34]
push 0x10
push eax
call fcn.0103e450
pop ecx
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
call fcn.0103a20d
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x34]
push ebx
push eax
mov dword [ebp - 8], ebx
call fcn.0102cb95
cmp eax, 0xfffffffe
mov dword [ebp - 4], eax
je 0x102cd3c
cmp eax, 2
jne 0x102cd6b
mov eax, dword [ebp - 8]
sub esi, eax
lea eax, [ebp + eax - 0x34]
push esi
push eax
lea eax, [ebp - 0x34]
push eax
call dword [0x10011e4]
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, edi
mov byte [ebp + esi - 0x34], bl
push eax
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.0102cb95
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x102cd9f
jmp 0x102cccb
mov dword [ebp - 4], 0xfffffffb
jmp 0x102cd9f
cmp dword [ebp - 4], 0xffffffff
jne 0x102cd98
push ebx
lea eax, [ebp - 0x34]
push 1
push eax
mov ecx, edi
call fcn.0102cb95
mov dword [ebp - 4], eax
jmp 0x102cd9f
mov dword [ebp - 4], 0xfffffffc
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x102cdc2
mov eax, dword [ebp + 0x10]
dec eax
cmp esi, eax
jb 0x102cdb0
mov esi, eax
lea eax, [ebp - 0x34]
push esi
push eax
push edi
call dword [0x10011e4]
add esp, 0xc
mov byte [esi + edi], bl
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102ce23
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, ebx
call fcn.0102cad2
test eax, eax
je 0x102cf31
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov edi, 0x101f0bc
mov ecx, ebx
call fcn.0102cad2
test eax, eax
je 0x102cf31
push dword [edi - 4]
mov ecx, ebx
call fcn.0102cabe
test eax, eax
je 0x102cf31
mov dword [ebp - 4], 1
mov esi, 0x101f0d8
lea ecx, [ebp - 0x28]
call fcn.01037a1e
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
push dword [esi]
call fcn.0102cdcc
push dword [edi]
push dword [edi - 4]
push dword [ebp - 0x24]
push 0x1002944
push ebx
call fcn.01039f6c
add esp, 0x14
push 0x3e8
push 0
push dword [esi]
call fcn.0103e450
pop ecx
push eax
mov ecx, ebx
push dword [esi]
call fcn.0102c696
test eax, eax
je 0x102cef9
mov eax, dword [esi]
push 0
push 0
mov dword [ebx + 0x238], eax
push dword [edi]
mov ecx, ebx
call fcn.0102cc9f
test eax, eax
je 0x102cef0
and dword [ebp - 4], 0
push 0x1002930
push ebx
call fcn.01039f6c
pop ecx
pop ecx
and dword [ebx + 0x238], 0
jmp 0x102cefd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.01037a70
add esi, 4
cmp esi, 0x101f0dc
jb 0x102ce7e
cmp dword [ebp - 4], 0
jne 0x102cf35
inc dword [ebp - 8]
add edi, 8
cmp edi, 0x101f0dc
jb 0x102ce51
mov eax, dword [ebp - 0xc]
jmp 0x102cf3f
xor eax, eax
jmp 0x102cf48
mov eax, dword [ebp - 8]
mov eax, dword [eax*8 + 0x101f0b8]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x102cf4d
Capabilities:
Get system information on windows

Disassembly:
push ecx
push ebp
push esi
push 0xfffffffffffffffd
pop esi
push 0
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x102cf6b
mov eax, esi
jmp 0x102cfe0
push edi
push ebx
push ebp
call fcn.0103e450
pop ecx
mov ebx, eax
mov esi, 0x101f058
mov eax, dword [esi]
test eax, eax
je 0x102cfcf
push eax
call fcn.0103e450
cmp eax, ebx
pop ecx
jae 0x102cf98
push dword [esi]
call fcn.0103e450
pop ecx
mov edi, eax
jmp 0x102cf9a
mov edi, ebx
lea eax, [ebx + ebp]
push edi
sub eax, edi
push eax
push dword [esi]
call dword [0x10011dc]
add esp, 0xc
test eax, eax
jne 0x102cfcf
push dword [esi]
call fcn.0103e450
cmp edi, eax
pop ecx
jne 0x102cfca
mov eax, dword [esi + 4]
cmp eax, 2
mov dword [esp + 0x10], eax
jne 0x102cfda
jmp 0x102cfcf
or dword [esp + 0x10], 0xffffffff
add esi, 8
cmp esi, 0x101f0b8
jb 0x102cf7b
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x102cfe6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 8], 0xfffffffb
call fcn.01037a1e
lea ecx, [ebp - 0x40]
call fcn.01037a1e
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x102d026
mov ecx, esi
call fcn.0102cad2
test eax, eax
jne 0x102d03d
lea ecx, [ebp - 0x40]
call fcn.01037a70
lea ecx, [ebp - 0x24]
call fcn.01037a70
xor eax, eax
jmp 0x102d155
mov ecx, esi
call fcn.0102cb0a
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
push edi
call fcn.0102cdcc
push dword [ebp + 0xc]
push dword [esi + 0x220]
push dword [ebp - 0x3c]
push 0x1002974
push esi
call fcn.01039f6c
add esp, 0x14
push dword [ebp + 0xc]
push ebx
push edi
call fcn.0103e450
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0102c696
test eax, eax
je 0x102d13d
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov byte [ebp - 0x440], bl
mov dword [ebp - 4], ebx
push eax
mov edi, 0x3ff
lea eax, [ebp - 0x440]
push edi
push eax
mov ecx, esi
call fcn.0102c86a
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x102d11a
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x102d11a
mov byte [ebp + eax - 0x440], bl
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x24]
call fcn.01037dec
push dword [ebp - 0x20]
mov ecx, esi
call fcn.0102cf4d
cmp eax, ebx
je 0x102d11a
cmp eax, 1
je 0x102d11a
cmp eax, 3
jne 0x102d108
push dword [ebp + 0xc]
push ebx
push dword [0x101f100]
call fcn.0103e450
pop ecx
push eax
mov ecx, esi
push dword [0x101f100]
call fcn.0102c696
test eax, eax
je 0x102d11a
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov byte [ebp - 0x440], bl
mov dword [ebp - 4], ebx
push eax
jmp 0x102d09b
cmp dword [ebp - 0x18], ebx
jne 0x102d12e
push 0x1002960
push esi
call fcn.01039f6c
pop ecx
pop ecx
jmp 0x102d13d
push 0x10
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.0103a20d
lea ecx, [ebp - 0x40]
call fcn.01037a70
lea ecx, [ebp - 0x24]
call fcn.01037a70
xor eax, eax
cmp dword [ebp - 8], ebx
setge al
pop edi
pop esi
pop ebx
leave
ret 8