joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008b310
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f8d14
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1014614a
call fcn.100e3445
push 0x208
lea eax, [ebp - 0x264]
mov dword [ebp - 0x5c], 0x61004d
push 0
push eax
mov dword [ebp - 0x58], 0x720063
mov ebx, 0x6c
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.10003030
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10003030
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c8]
push eax
lea edx, [ebp - 0x2b0]
lea ecx, [ebp - 0x294]
call fcn.100a0bd0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b0]
call fcn.10003460
mov byte [ebp - 4], 3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x294]
call fcn.1009bbb0
test al, al
jne 0x1008b484
xor bl, bl
jmp 0x1008b4e1
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.100a5e00
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
jne 0x1008b4a7
xor bl, bl
jmp 0x1008b4ca
lea eax, [ebp - 0x27c]
cmp esi, eax
je 0x1008b4c8
cmp dword [ebp - 0x268], 8
push ecx
cmovae eax, dword [ebp - 0x27c]
mov ecx, esi
push eax
call fcn.10003530
mov bl, 1
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x27c]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x294]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 4
Function at 0x10094d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov ecx, 0x101451de
push edi
call fcn.100e3445
cmp dword [ebx + 0x38], 0
je 0x10094dc8
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10094dea
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10094dec
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10094e71
jg 0x10094e01
test esi, esi
je 0x10094e71
test ecx, ecx
jl 0x10094e4a
jg 0x10094e0b
test eax, eax
je 0x10094e4a
cmp edi, ecx
jg 0x10094e1f
jl 0x10094e15
cmp esi, eax
jae 0x10094e1f
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10094e4d
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10094e71
jg 0x10094e57
test esi, esi
je 0x10094e71
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10094e71
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10094e90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x101451de
call fcn.100e3445
cmp dword [edi + 0x38], 0
je 0x10094ec8
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10094eea
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10094eec
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10094f8c
jg 0x10094f09
test esi, esi
je 0x10094f8c
test ecx, ecx
jl 0x10094f56
jg 0x10094f13
test eax, eax
je 0x10094f56
cmp ebx, ecx
jg 0x10094f27
jl 0x10094f1d
cmp esi, eax
jae 0x10094f27
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10094f5d
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10094f8c
jg 0x10094f67
test esi, esi
je 0x10094f8c
cmp dword [edi + 0x4c], 0
je 0x10094f8c
mov ecx, edi
call fcn.10096290
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10095350
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov esi, ecx
mov ecx, 0x101451de
call fcn.100e3445
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
jne 0x1009538a
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100953bd
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100953bd
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100954c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100953e6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1009541b
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100954c3
cmp eax, 1
jle 0x1009547f
cmp eax, 3
jne 0x100954c3
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.10093f90
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x1009549f
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100954c3
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x100954c3
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
Function at 0x10096300
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x101451de
push edi
call fcn.100e3445
cmp dword [esi + 0x38], 0
je 0x100963b8
cmp byte [esi + 0x3d], 0
je 0x100963b8
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10096369
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1009637c
sub eax, 1
je 0x10096380
sub eax, 2
je 0x100963b8
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100963a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10096369
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
Function at 0x10099e50
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3b22
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x1014614a
call fcn.100e3445
mov edi, dword [esi + 8]
test edi, edi
jne 0x10099e95
xor al, al
jmp 0x10099f47
mov dword [ebp - 0x14], 0
add edi, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edi
je 0x10099eb8
mov eax, dword [edi]
test eax, eax
je 0x10099eb8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x10099f1d
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x100996b0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x10099f63
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x10099f15
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10099880
xor bl, bl
mov dword [ebp - 4], 2
test edi, edi
je 0x10099f3e
mov eax, dword [edi]
test eax, eax
je 0x10099f37
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10099f7b
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10099eff
mov bl, 1
jmp 0x10099f1f

Function at 0x1009a4c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x1014614a
push edi
mov edi, dword [esp + 0x14]
call fcn.100e3445
mov eax, dword [esi]
test eax, eax
je 0x1009a52f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1009a52f
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009a50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009a52f
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100e0d24
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 8
ret 4
Function at 0x1009cef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov ecx, 0x1014614a
call fcn.100e3445
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x1009cf22
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1009cf66
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.100e0d24
add esp, 0x418
ret
cmp eax, 0x208
jae 0x1009cf4e
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1009cf80
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10003530
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x418
ret

Function at 0x1009de90
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
mov ecx, 0x1014614a
call fcn.100e3445
push 0x118
lea eax, [esi + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1009dfdc
cmp dword [esi + 4], 6
push edi
ja 0x1009def0
jne 0x1009df78
cmp dword [esi + 8], 2
jb 0x1009df78
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1009df78
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1009df78
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1009df78
movups xmm0, xmmword [0x1011416c]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x1011417c]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1009df78
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009df78
cmp word [edi + 2], ax
jbe 0x1009df78
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1009dfc3
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1009dfc3
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x140
ret
Function at 0x100a1110
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x10135300
push 0x100e1924
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10142008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov ecx, 0x1014614a
call fcn.100e3445
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100a1180
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.100a1260
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x100a11b7
test bl, bl
jne 0x100a122c
cmp edi, 0x1a
jne 0x100a122c
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100a11d1
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a1202
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10003530
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.100e0d24
lea esp, [ebp + 0x414]
pop ebp
ret
Function at 0x100a5650
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x100fbe27
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, 0x1014614a
call fcn.100e3445
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x100a5721
lea edi, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x100a5746
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e1947
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, edi
mov dword [ebp], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100a570d
cmp eax, ebx
ja 0x100a570d
xor ecx, ecx
mov ebx, eax
mov dword [edi + eax*2], ecx
mov dword [ebp - 0x10], ebx
jmp 0x100a576e
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x100a5721
push edi
call fcn.100e0d73
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.100e0d24
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x100a57e9
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x100a57e9
mov word [ebp + eax + 4], cx
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x100a57ce
mov esi, dword [ebp - 0x14]
mov ebx, 2
mov eax, dword [ebp - 0x10]
cmp word [esi + ebx - 2], 0
jne 0x100a57c3
cmp ecx, edi
je 0x100a57c3
lea eax, [esi + ecx*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.10003030
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.1003bf20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.10003460
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
lea ecx, [edi + 1]
mov eax, dword [ebp - 0x10]
inc edi
add ebx, 2
cmp edi, eax
jb 0x100a5781
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x100a57e2
push esi
call fcn.100e0d73
add esp, 4
mov al, 1
jmp 0x100a5723
call fcn.100e1736
int3
Function at 0x100a9c70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc919
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10142008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 4
lea esi, [edi + 0x7c]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 6
mov ecx, esi
call fcn.10003460
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
lea esi, [edi + 0x64]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.10003460
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xe
mov ecx, esi
call fcn.10003460
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x12
mov ecx, esi
call fcn.10003460
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x16
mov ecx, esi
call fcn.10003460
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0x1a
mov ecx, edi
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret