joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c210
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.101ffde0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1007c352
cmp dword [esi + 4], 6
push edi
ja 0x1007c266
jne 0x1007c2ee
cmp dword [esi + 8], 2
jb 0x1007c2ee
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1007c2ee
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1007c2ee
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1007c2ee
movups xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x102849b4]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1007c2ee
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007c2ee
cmp word [edi + 2], ax
jbe 0x1007c2ee
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1007c339
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.101ffde0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1007c339
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.101e7040
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.101e7040
add esp, 0x140
ret

Function at 0x1007dd00
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102393e4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1000879d
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.1000879d
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.1000879d
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.1000879d
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.1000879d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100844b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.101ffde0
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008452e
cmp dword [esp + 0x14], 6
jb 0x1008452e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, reloc.WS2_32.dll_accept
call fcn.10084320
add esp, 0xc
test al, al
je 0x1008452e
cmp word [esi], 0
jne 0x10084586
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, accept
call fcn.10084320
add esp, 0xc
test al, al
je 0x1008455a
cmp word [esi], 0
jne 0x10084586
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, reloc.WS2_32.dll_accept
call fcn.10084320
add esp, 0xc
test al, al
je 0x1008459b
cmp word [esi], 0
je 0x1008459b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
Function at 0x10084b00
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023a09b
mov eax, dword fs:[0]
push eax
mov eax, 0x285c
call fcn.101e8780
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2218]
push ebx
push eax
call fcn.101ffde0
add esp, 0xc
mov eax, 0x22
mov word [ebp - 0x2218], ax
test esi, esi
je 0x10084d14
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x10084d14
push esi
call edi
cmp eax, 0xffa
jge 0x10084d14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2218]
push eax
call esi
push 0x10284164
lea eax, [ebp - 0x2218]
push eax
call esi
push str.Shell32.dll
lea ecx, [ebp - 0x2868]
call fcn.10005e0a
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2868]
push eax
call fcn.1008ec20
mov ecx, eax
call fcn.1008ece0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2868]
call fcn.10005e05
test esi, esi
je 0x10084d14
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x284c], eax
test eax, eax
je 0x10084d14
lea ecx, [ebp - 0x2848]
call fcn.100845b0
xor edi, edi
lea esi, [ebp - 0x2848]
nop dword [eax]
cmp word [esi], 0
je 0x10084c34
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x284c]
cmp eax, 0x20
ja 0x10084c42
inc edi
add esi, 0x210
cmp edi, 3
jl 0x10084c10
jmp 0x10084c64
imul ebx, edi, 0x210
cmp dword [ebp + ebx - 0x2640], 0
mov ebx, dword [ebp + ebx - 0x263c]
jne 0x10084c5c
add ebx, 0x10
test ebx, ebx
jne 0x10084d10
mov edi, dword [ebp - 0x284c]
lea eax, [ebp - 0x2218]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x10084d0b
mov dword [ebp - 0x2850], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x284c], str._programfiles_Internet_Exploreriexplore.exe
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.101ffde0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x103
push eax
push dword [ebp + esi*4 - 0x2850]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10084d01
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x218]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x10084d0b
inc esi
cmp esi, 2
jb 0x10084ca0
mov eax, ebx
jmp 0x10084d16
mov ebx, 0x10
mov eax, ebx
jmp 0x10084d16
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
Function at 0x10085b40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023a1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x10085b86
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1009ec50
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x10085baf
lea ebx, [esi + 8]
jmp 0x10085bb1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.100086fc
test al, al
jne 0x10085bc7
mov ecx, dword [ebp - 0x18]
call fcn.10008714
jmp 0x10085bc9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10085bea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10085bea
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x10085c13
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10085c28
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.101e74c0
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 4
Function at 0x10085c60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023a1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x10085ca3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1009ed10
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x10085cd0
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x10085cd7
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.100086fc
test al, al
jne 0x10085ceb
mov ecx, ebx
call fcn.10008714
jmp 0x10085ced
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x10085d3e
call ecx
cmp eax, 5
jne 0x10085d38
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.100086fc
test al, al
jne 0x10085d28
mov ecx, ebx
call fcn.10008714
jmp 0x10085d2a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x10085d5c
call ecx
cmp eax, 0xb7
jne 0x10085d51
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.1009b210
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x10085d82
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10085d97
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.101e74c0
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 4
Function at 0x1008d500
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b1fb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x1008d539
call fcn.1008d6a0
cmp byte [0x102d301c], 0
jne 0x1008d54c
mov eax, reloc.WS2_32.dll_accept
jmp 0x1008d67c
mov eax, dword [esi]
test eax, eax
jne 0x1008d5cc
push 8
call fcn.101e74f1
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.101e74f1
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.101ffde0
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008d5bb
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008d66b
call fcn.1009a930
test al, al
jne 0x1008d606
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.1009ae90
test al, al
je 0x1008d66b
mov ecx, dword [esi]
add ecx, 4
call fcn.1009a450
call fcn.1009a930
test al, al
je 0x1008d66b
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.10005e0a
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.1008ec20
mov ecx, eax
call fcn.1008ece0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10005e05
test edi, edi
je 0x1008d66b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008d66b
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x1008d66b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008d67a
mov dword [eax], reloc.WS2_32.dll_accept
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 4
Function at 0x10090870
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b7af
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.10090fe0
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10005e05
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10005e05
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10005e05
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10005e05
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10005e05
mov eax, dword [ebp + 8]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100915c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b99f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10005e05
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10005e05
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10005e05
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10005e05
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10005e05
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10092740
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023bb3f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10008e48
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10008e48
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10008e48
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10008e48
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10008e48
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10008e48
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10096ae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10096b62
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10096b62
test ecx, ecx
je 0x10096b5e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10096b20
xor eax, eax
jmp 0x10096b67
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10096b71
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101e7040
add esp, 0xc
ret 0xc

Function at 0x10099d10
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.101e74f1
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.101ffde0
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x10099d6c
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.101e7040
add esp, 0x120
ret
Function at 0x1009c930
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x1009c968
mov edx, dword [esp + 4]
test edx, edx
je 0x1009c968
cmp dword [eax], 0xffffffff
je 0x1009c968
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009c968
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x1009c9a0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x1009ca03
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1009ca03
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009c9de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009ca03
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.101e7040
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.101e7040
add esp, 8
ret 4
Function at 0x1009cc30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push 0x20c
lea eax, [esp + 0x1c]
mov ebp, ecx
push 0
push eax
call fcn.101ffde0
add esp, 0xc
lea eax, [esp + 0x18]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1009ce34
push ebx
xor eax, eax
push esi
mov word [esp + 0x22a], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1009ccdd
mov esi, edi
cmp eax, 8
jb 0x1009ccb0
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1009ce19
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1009ce4c
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1009cd33
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1009cd33
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1009cd45
or ecx, 0xffffffff
jmp 0x1009cd4d
cmp ecx, 0x1000
jb 0x1009cd76
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1009ce51
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1009cd87
test ecx, ecx
je 0x1009cd85
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1009cd87
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1009cdf8
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1009cde6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ce51
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1009ce19
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.101e7040
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
xor al, al
pop ebp
xor ecx, esp
call fcn.101e7040
add esp, 0x224
ret
call fcn.1000604b
call fcn.102086be
int3
Function at 0x1009ce60
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102377e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x1009ce97
xor al, al
jmp 0x1009cefa
and esi, 0xffffb1af
push esi
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1009ceb2
mov al, 1
jmp 0x1009cefa
lea ecx, [ebp - 0x28]
call fcn.1000879d
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.1009e820
test al, al
je 0x1009cee7
push esi
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1009cee7
mov bl, 1
jmp 0x1009cee9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret

Function at 0x1009cf20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102377e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009cf9e
lea ecx, [ebp - 0x28]
call fcn.1000879d
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.1009e820
test al, al
je 0x1009cf8d
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret