joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102cbb1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102cbd2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x102cc47
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x102cbed
cmp dword [ebp + 0xc], esi
je 0x102cbed
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x102cc47
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x102cc44
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x102cc44
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x102cc2c
mov dword [ebp - 4], eax
jmp 0x102cc44
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01029317
cmp eax, esi
mov dword [ebp - 4], eax
je 0x102cc44
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x102ccc8
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102ccea
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x102cd53
xor esi, esi
cmp dword [ebp + 8], esi
je 0x102cd22
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
test esi, esi
je 0x102cd51
push esi
push edi
push ebx
push dword [ebp + 0xc]
call fcn.01029317
mov eax, esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x102eb0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0102e451
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x102eb3b
mov eax, dword [0x10bedb8]
mov esi, dword [eax + 8]
test esi, esi
jne 0x102eb3b
mov ebx, 0x80070057
jmp 0x102ebb6
mov eax, dword [ebp + 8]
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push esi
call fcn.0102b270
mov edi, eax
test edi, edi
jne 0x102eb60
call fcn.0102d872
mov ebx, eax
test ebx, ebx
jl 0x102ebb5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x102eb75
call fcn.0102d872
mov ebx, eax
test ebx, ebx
jl 0x102ebb5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x102eb8d
call fcn.0102d872
mov ebx, eax
test ebx, ebx
jl 0x102ebb5
mov eax, dword [ebp + 8]
and eax, 0xf
je 0x102eba3
dec eax
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x102eb99
movzx eax, word [esi]
mov ecx, dword [ebp - 4]
push eax
add esi, 2
push esi
call fcn.0102e67e
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x102ee9f
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x102eef6
cmp word [eax], si
je 0x102eef6
push eax
call fcn.0102b341
cmp eax, 0xffffffff
je 0x102eecd
test al, 0x10
jne 0x102eecd
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x102eefb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x102eeef
cmp eax, 3
je 0x102eeef
cmp eax, esi
jle 0x102eeeb
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x102eefb
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x102eefb
mov esi, 0x80070057
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1039a2c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi + 0x78]
xor ebx, ebx
lea ecx, [ebp - 8]
mov dword [ebp - 4], ebx
call fcn.0102f381
cmp dword [esi + 0x10], ebx
je 0x1039a55
cmp dword [esi + 0x14], ebx
jne 0x1039af3
mov eax, dword [ebp + 8]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x7c], eax
call fcn.0102ae7e
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x1039aa2
push ebx
push ebx
push ebx
push ebx
call fcn.0102ae7e
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x1039aa2
mov eax, dword [esi]
push esi
call dword [eax + 4]
lea eax, [esi + 0x1c]
push eax
push ebx
push esi
push 0x10399bd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x1039af2
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x1039ab2
call edi
jmp 0x1039abe
call edi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x1039af2
mov eax, dword [esi + 0x10]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1039ad8
push eax
call edi
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x1039ae5
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x1039af2
push eax
call edi
mov dword [esi + 0x18], ebx
pop edi
mov eax, dword [ebp - 8]
pop esi
cmp eax, ebx
pop ebx
je 0x1039b02
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x104a0ba
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x10ae1e0]
xor eax, dword [ebp + 0x7c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call esi
test eax, eax
jne 0x104a0f5
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
xor eax, eax
xor ecx, ecx
inc eax
cmp dword [ebp - 0x18], eax
pop esi
sete cl
cmp dword [ebp - 0x24], 5
mov dword [0x10bffc0], ecx
jb 0x104a112
mov dword [0x10bffc4], eax
mov ecx, dword [ebp + 0x74]
xor ecx, dword [ebp + 0x7c]
call fcn.01028eec
add ebp, 0x78
leave
ret

Function at 0x104aad2
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104aaa5
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x104ab05
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x104ab05
push dword [ebp + 0x10]
call fcn.0104a3eb
pop ecx
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x104ab0f
Capabilities:
Get file size

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
jne 0x104ab34
push dword [esp + 0x10]
call fcn.0104a3eb
pop ecx
mov esi, eax
mov eax, esi
pop esi
ret

Function at 0x104ab3d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104aaa5
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x104ab85
push edi
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x104ab79
cmp dword [ebp - 4], edi
je 0x104ab84
push dword [ebp + 0x18]
call fcn.0104a3eb
pop ecx
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x104ab8f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104aaa5
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x104abd7
push edi
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x104abcb
cmp dword [ebp - 4], edi
je 0x104abd6
push dword [ebp + 0x18]
call fcn.0104a3eb
pop ecx
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x104b1cb
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x10bfffc], edi
je 0x104b1da
xor eax, eax
pop edi
ret
push esi
mov esi, 0x10c0010
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10bfffc], edi
jne 0x104b227
push 0x10c0000
push edi
push edi
push 0x104b102
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [0x10bfffc], eax
jne 0x104b21a
push dword [esp + 0xc]
call fcn.0104a3eb
pop ecx
mov edi, eax
jmp 0x104b227
push dword [0x10c0008]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
ret

Function at 0x104b8a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10bffc0], edi
jne 0x104b8bb
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x104b8f0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x104b8f0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x104b8fd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10bffc0], edi
jne 0x104b918
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x104b94d
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x104b94d
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x104b95a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10ae1e0]
xor eax, dword [ebp + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x10bffc0], esi
mov dword [ebp - 4], eax
push edi
jne 0x104b994
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, eax
jmp 0x104ba1b
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push 0x105
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push esi
call edi
test eax, eax
je 0x104ba10
push esi
push esi
push 4
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
push esi
call edi
test eax, eax
je 0x104ba10
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, esi
mov ebx, eax
je 0x104ba10
push 0x104
push dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x104ba14
xor eax, eax
jmp 0x104ba1d
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.01028eec
leave
ret

Function at 0x104ba32
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10bffc0], edi
jne 0x104ba4d
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x104ba87
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x104ba80
or eax, 0xffffffff
jmp 0x104ba87
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x104bb02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x104bb30
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x100cf70]
shr eax, 8
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x104bb0d
not eax
ret
Function at 0x104bb77
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10ae1e0]
xor eax, dword [ebp + 4]
push esi
push edi
xor esi, esi
mov edi, ecx
cmp dword [edi], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
je 0x104bbb2
mov eax, dword [edi + 4]
cmp eax, esi
je 0x104bbb2
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x104bbbc
mov esi, 0x80004005
jmp 0x104bc71
push esi
push esi
push 0x200
lea eax, [ebp - 0x208]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x104bc46
cmp dword [edi + 8], 0xffffffff
je 0x104bc18
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x104bc46
mov ecx, dword [ebp - 8]
add eax, ecx
cmp eax, dword [edi + 8]
jbe 0x104bc18
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x104bc46
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x104bc46
push 2
push esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x104bc46
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
dec eax
push eax
lea eax, [ebp - 0x208]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x104bc68
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x104bc58
call esi
mov esi, eax
jmp 0x104bc68
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
mov eax, esi
pop esi
call fcn.01028eec
leave
ret 4

Function at 0x104d73b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x104d750
call edi
mov dword [esi], eax
call edi
sub eax, dword [esi]
pop edi
cmp eax, dword [esp + 8]
pop esi
jb 0x104d761
xor eax, eax
inc eax
jmp 0x104d775
call sub.msvcrt.dll_rand
push 0x64
cdq
pop ecx
idiv ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
ret 8
Function at 0x1065be8
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0x80070005
call fcn.01067b0b
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
push 2
call fcn.01068b15
xor ebx, ebx
test eax, eax
jl 0x1065c4c
lea ecx, [ebp - 0x64]
call fcn.01067057
cmp eax, 4
jne 0x1065c4c
push 0x1f4
lea eax, [ebp - 0x64]
push eax
call fcn.01064ee0
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1065c51
cmp byte [0x10c0c50], bl
je 0x1065c4c
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x10c0c58
call fcn.01065b06
cmp dword [ebp - 4], ebx
jge 0x1065ccb
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 8]
push 0x10643ca
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x1065ccb
mov ecx, 0x10c0c1c
call fcn.01064343
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1065cc4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1065cc4
cmp dword [ebp - 4], ebx
je 0x1065ca2
mov dword [ebp - 4], 0x80070005
jmp 0x1065cc4
cmp byte [0x10c0c50], bl
je 0x1065cc4
lea ecx, [ebp - 0x64]
call fcn.010653ea
test al, al
jne 0x1065cc4
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x10c0c58
call fcn.01065b06
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x64]
call fcn.010288b2
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1065d67
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.0106523e
push dword [ebp + 8]
lea esi, [edi + 0x30]
push esi
mov ecx, edi
call fcn.010655b7
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1065e03
cmp byte [ebp + 0xc], 0
je 0x1065dff
mov ecx, edi
call fcn.0106525b
lea ecx, [ebp - 0x10]
call fcn.0102dcc4
lea ecx, [ebp - 0x70]
call fcn.01067b0b
push dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.010691af
push ebx
push 0x1001f2c
lea ecx, [ebp - 0x70]
call fcn.01067f43
mov esi, eax
test esi, esi
jl 0x1065deb
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x70]
call fcn.01068a5f
mov esi, eax
test esi, esi
jl 0x1065deb
push dword [ebp - 0x10]
call fcn.01065be8
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.010288b2
lea ecx, [ebp - 0x10]
call fcn.0102e62a
mov eax, esi
jmp 0x1065e6b
xor edi, edi
jmp 0x1065e61
push ebx
mov ecx, esi
call fcn.01065321
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x208]
mov ecx, 0x10c0c1c
mov edi, eax
call fcn.01064327
cmp edi, eax
mov ecx, esi
push ebx
jb 0x1065e56
call fcn.01065321
push eax
call fcn.01065be8
mov edi, eax
test edi, edi
jge 0x1065e61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ecx, esi
mov edi, eax
call fcn.01065321
mov dword [eax + 0x208], edi
push ebx
mov ecx, esi
call fcn.01065321
mov edi, dword [eax + 0x20c]
mov ecx, dword [ebp - 4]
call fcn.0106525b
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1066d24
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10ae1e0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], eax
call fcn.0102dcc4
xor ebx, ebx
cmp esi, ebx
je 0x1066edd
mov si, word [esi]
cmp si, 0x41
jb 0x1066d66
cmp si, 0x5a
ja 0x1066d66
movzx edi, si
sub edi, 0x40
jmp 0x1066d6c
movzx edi, si
sub edi, 0x60
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jge 0x1066e02
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push ebx
push 0x1010940
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x1066ea9
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x34]
push ecx
push 0x1c
lea ecx, [ebp - 0x5c]
push ecx
push 0x1c
push ecx
inc esi
push esi
push eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x860
mov dword [ebp - 0x50], 0x440d
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x1066de4
test byte [ebp - 0x44], 1
jne case.default.0x1066de4
movzx eax, byte [ebp - 0x2b]
cmp eax, 9
ja case.default.0x1066de4
jmp dword [eax*4 + 0x1066efd]
mov esi, 0x320
jmp case.0x1066de4.5
xor esi, esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1066ea9
lea eax, [edi + 0x40]
push eax
lea eax, [ebp - 0x40]
push 0x1010930
push eax
call fcn.0102eaf4
add esp, 0xc
test eax, eax
jl 0x1066ea7
push ebx
push ebx
push 3
push ebx
push 2
push ebx
push dword [ebp - 0x40]
call fcn.0102aef6
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x1066ead
push ebx
lea ecx, [ebp - 0x34]
push ecx
push 0x1e0
lea ecx, [ebp - 0x23c]
push ecx
push ebx
push ebx
push 0x70c00
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x1066de4
cmp dword [ebp - 0x34], ebx
jbe case.default.0x1066de4
mov eax, dword [ebp - 0x234]
xor esi, esi
inc esi
cmp eax, esi
je case.0x1066de4.0
jle case.default.0x1066de4
cmp eax, 5
jle case.0x1066de4.2
cmp eax, 0xa
jle case.0x1066de4.0
cmp eax, 0xb
je case.0x1066de4.6
cmp eax, 0xc
jne case.default.0x1066de4
jmp case.0x1066de4.5
push 2
pop esi
jmp case.0x1066de4.5
mov esi, 0x15e
jmp case.0x1066de4.5
mov esi, 0x20d
jmp case.0x1066de4.5
xor esi, esi
cmp esi, ebx
jne 0x1066edf
add edi, 0x40
push edi
lea eax, [ebp - 0x40]
push 0x1010924
push eax
call fcn.0102eaf4
add esp, 0xc
push dword [ebp - 0x40]
call fcn.0102cb4b
push 2
pop esi
cmp eax, esi
je 0x1066edf
cmp eax, 3
je 0x1066ef8
jbe 0x1066edd
cmp eax, 6
jbe 0x1066edf
xor esi, esi
lea ecx, [ebp - 0x40]
call fcn.0102e62a
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.01028eec
leave
ret 4
xor esi, esi
inc esi
jmp 0x1066edf
Function at 0x106a13c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
je 0x106a225
mov edi, dword [ebp + 8]
test edi, edi
je 0x106a225
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10c0dd8]
mov ebx, 0x10c0dcc
cmp eax, 0xea60
jae 0x106a190
push edi
push ebx
call fcn.0102da15
test al, al
je 0x106a190
mov eax, dword [0x10c0dc8]
mov dword [esi], eax
jmp 0x106a22c
push esi
push edi
push 0x1011248
push 0x80000002
call fcn.0106a019
cmp eax, 3
je 0x106a1ab
cmp eax, 2
jne 0x106a1cf
push esi
push edi
push 0x10111d8
push 0x80000001
call fcn.0106a019
cmp eax, 3
je 0x106a1c6
cmp eax, 2
jne 0x106a1cf
mov dword [ebp - 4], 0xc00d0fda
xor eax, eax
test eax, eax
je 0x106a1e2
jle 0x106a1df
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x106a22c
push edi
call fcn.0102bbcd
cmp eax, 5
jae 0x106a22c
push 5
push ebx
lea ecx, [ebp - 0x10]
call fcn.0102dd5c
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x10]
call fcn.0102e67e
mov eax, dword [esi]
mov dword [0x10c0dc8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x10c0dd8], eax
call fcn.0102e62a
jmp 0x106a22c
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x106a2c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x106a39b
cmp dword [ebp + 8], 0
je 0x106a39b
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, 0xea60
cmp eax, dword [0x10c0dec]
mov esi, 0x10c0de0
jae 0x106a317
push dword [ebp + 8]
push esi
call fcn.0102da15
test al, al
je 0x106a317
mov eax, dword [0x10c0ddc]
mov dword [edi], eax
jmp 0x106a3a2
push edi
push dword [ebp + 8]
push 0x1011248
push 0x80000002
call fcn.0106a23b
cmp eax, 3
je 0x106a334
cmp eax, 2
jne 0x106a347
push edi
push dword [ebp + 8]
push 0x10111d8
push 0x80000001
call fcn.0106a23b
test eax, eax
je 0x106a35e
jle 0x106a357
and eax, 0xffff
or eax, 0x80070000
test eax, eax
mov dword [ebp - 4], eax
jl 0x106a3a2
push dword [ebp + 8]
call fcn.0102bbcd
cmp eax, 5
jae 0x106a3a2
push 5
push esi
lea ecx, [ebp - 0x10]
call fcn.0102dd5c
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0102e67e
mov eax, dword [edi]
mov dword [0x10c0ddc], eax
call ebx
lea ecx, [ebp - 0x10]
mov dword [0x10c0dec], eax
call fcn.0102e62a
jmp 0x106a3a2
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8