joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10026be0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ab64
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.NtDll.dll
call ebx
push str.kernel32.dll
mov dword [esi + 0x30], eax
call ebx
push 0x100a027c
mov dword [esi + 0x34], eax
call ebx
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x38], eax
test ecx, ecx
pop ebx
je 0x1000abb6
mov edx, dword [esi + 0x34]
test edx, edx
je 0x1000abb6
test eax, eax
je 0x1000abb6
push str.NtQuerySystemInformation
push ecx
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x30]
push str.NtQueryInformationProcess
push eax
call edi
mov ecx, dword [esi + 0x38]
push str.EnumProcesses
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 0x38]
push str.GetModuleFileNameExA
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x38]
push str.GetModuleFileNameExW
push eax
call edi
mov dword [esi + 0x20], eax
call fcn.10026c30
test eax, eax
je 0x1000ab15
mov ecx, dword [esi + 0x34]
push str.ProcessIdToSessionId
push ecx
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1000abb6
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1000abb6
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000abb6
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1000abb6
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000abb6
mov dword [esi + 0x3c], 1
call fcn.10026c30
test eax, eax
je 0x1000abb6
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x1000abb6
mov dword [esi + 0x3c], 0
jmp 0x1000abb6
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x34], eax
je 0x1000abb6
push str.CreateToolhelp32Snapshot
push eax
call edi
mov edx, dword [esi + 0x34]
push str.Process32First
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x34]
push str.Process32Next
push eax
call edi
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x1000abb6
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1000abb6
test eax, eax
je 0x1000abb6
mov dword [esi + 0x40], 1
mov eax, dword [esi + 0x34]
test eax, eax
je 0x1000abd6
push str.GetLongPathNameA
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.GetLongPathNameW
push ecx
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x1000abeb
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x1000abeb
mov ecx, esi
call fcn.1000abf0
pop edi
pop esi
ret

Function at 0x1000ac70
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, dword [0x100a930c]
test eax, eax
jne 0x1000ac8f
push 1
push 0x100a0294
push 0xffffffffffffffff
call fcn.10046ab0
add esp, 0xc
mov dword [0x100a930c], eax
ret
Function at 0x1000b7d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x30c
push ebp
push esi
mov esi, dword [esp + 0x318]
push edi
test esi, esi
mov ebp, ecx
je 0x1000b9d0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000b9d0
mov ecx, 0x40
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push esi
push eax
call fcn.10015d80
mov al, byte [esp + 0x18]
add esp, 0xc
cmp al, 0x5c
jne 0x1000b940
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xc
lea ecx, [esp + 0x10]
push 0x100a0344
push ecx
stosb byte es:[edi], al
call fcn.1001cc80
add esp, 0xc
test eax, eax
jne 0x1000b8ee
mov edi, 0x100a0334
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x11d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x120], 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1000b9d0
cmp eax, 0x104
jb 0x1000b939
pop edi
pop esi
pop ebp
add esp, 0x30c
ret 8
push 4
lea eax, [esp + 0x10]
push 0x100a032c
push eax
call fcn.1001cc80
add esp, 0xc
test eax, eax
jne 0x1000b940
lea ecx, [esp + 0x10]
push 0x103
lea edx, [esp + 0x114]
push ecx
push edx
call fcn.10015d80
lea eax, [esp + 0x11c]
push 0x103
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.10015d80
add esp, 0x18
jmp 0x1000b940
mov esi, dword [esp + 0x31c]
lea edx, [esp + 0xc]
push 0x104
push edx
mov ecx, ebp
call fcn.1000bbc0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 4]
test eax, eax
je 0x1000b9b9
lea eax, [esp + 0xc]
push 0x7e
push eax
call fcn.10015ec0
add esp, 8
test eax, eax
je 0x1000b9b9
lea ecx, [esp + 0x214]
push 0x104
lea edx, [esp + 0x10]
push ecx
push edx
call dword [ebp + 4]
test eax, eax
jbe 0x1000b9b9
cmp eax, 0x104
jae 0x1000b9b9
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0x214]
dec eax
push eax
push ecx
jmp 0x1000b9c7
mov edx, dword [esp + 0x320]
lea eax, [esp + 0xc]
dec edx
push edx
push eax
push esi
call fcn.10015d80
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x30c
ret 8
Function at 0x1000b9e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x618
push ebx
mov ebx, dword [esp + 0x620]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x1000bbae
push ebx
call fcn.10015a84
add esp, 4
test eax, eax
je 0x1000bbae
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.10015c6d
add esp, 0xc
cmp word [esp + 0xc], 0x5c
jne 0x1000bb1d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
push 0xc
lea ecx, [esp + 0x10]
push str.SystemRoot_
push ecx
stosw word es:[edi], ax
call fcn.10078482
add esp, 0xc
test eax, eax
jne 0x1000bad8
lea edx, [esp + 0x214]
push str._SystemRoot_
push edx
call fcn.10015cd4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x236]
push eax
push ecx
mov word [esp + 0x23c], 0x5c
call fcn.10015cd4
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x214]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1000bbae
cmp eax, 0x104
jb 0x1000bb1d
pop edi
pop esi
pop ebx
add esp, 0x618
ret 8
push 4
push 0x100a0354
push ebx
call fcn.10078482
add esp, 0xc
test eax, eax
jne 0x1000bb1d
lea ecx, [esp + 0x14]
push 0x103
lea edx, [esp + 0x218]
push ecx
push edx
call fcn.10015c6d
lea eax, [esp + 0x220]
push 0x103
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.10015c6d
add esp, 0x18
lea edx, [esp + 0xc]
push 0x104
push edx
mov ecx, esi
call fcn.1000bc50
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x41e]
mov word [esp + 0x41c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 8]
test eax, eax
je 0x1000bb97
lea eax, [esp + 0xc]
push 0x7e
push eax
call fcn.10015f7c
add esp, 8
test eax, eax
je 0x1000bb97
lea ecx, [esp + 0x41c]
push 0x104
lea edx, [esp + 0x10]
push ecx
push edx
call dword [esi + 8]
test eax, eax
jbe 0x1000bb97
cmp eax, 0x104
jae 0x1000bb97
mov eax, dword [esp + 0x62c]
lea ecx, [esp + 0x41c]
dec eax
push eax
push ecx
jmp 0x1000bba5
mov edx, dword [esp + 0x62c]
lea eax, [esp + 0xc]
dec edx
push edx
push eax
push ebx
call fcn.10015c6d
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x618
ret 8
Function at 0x1000bce0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, ecx
xor eax, eax
push 2
lea ecx, [esp + 0x10]
xor ebx, ebx
mov word [esp + 0x11], ax
push ebp
push ecx
mov byte [esp + 0x18], bl
mov byte [esp + 0x1b], al
call fcn.10015750
mov al, byte [esp + 0x18]
add esp, 0xc
cmp al, 0x43
jl 0x1000bd1f
cmp al, 0x5a
jle 0x1000bd27
cmp al, 0x63
jl 0x1000bd51
cmp al, 0x7a
jg 0x1000bd51
cmp byte [esp + 0xd], 0x3a
jne 0x1000bd51
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, ebx
je 0x1000bd51
cmp eax, 2
je 0x1000bd51
cmp eax, 3
je 0x1000bd51
cmp eax, 5
je 0x1000bd51
cmp eax, 6
jne 0x1000bd5f
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 8
mov eax, dword [edi + 0x44]
push esi
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x1000bd7a
push eax
call fcn.10047770
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x24], 0x104
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x1000be18
lea edx, [ebp + 2]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebx, ecx
cmp ebx, 0x104
jae 0x1000be18
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x1c]
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x128]
mov ecx, edx
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebp
call fcn.10015750
add esp, 0xc
mov esi, 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000be25
call fcn.10047ae0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x110
ret 8

Function at 0x1000d800
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000d878
mov eax, dword [esp + 4]
cmp eax, esi
je 0x1000d878
cmp dword [esp + 0x20], esi
je 0x1000d851
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
inc ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 1
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1000d85d
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
jne 0x1000d866
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0x18
xor eax, eax
pop esi
pop ecx
ret 0x18
Function at 0x1000d9d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
je 0x1000dab9
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
je 0x1000dab9
xor ecx, ecx
push edi
mov dword [esp + 0x11], ecx
push eax
mov dword [esp + 0x19], ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x1d], ecx
push 0x100a03d0
mov word [esp + 0x25], cx
push edx
xor edi, edi
mov byte [esp + 0x1c], bl
mov byte [esp + 0x2b], cl
call fcn.100157ea
add esp, 0xc
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
push 0x2001f
push ebx
push str.SOFTWARETECOcular.3ShareDataPID
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000daae
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x1000daae
lea ecx, [esp + 0x28]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push ebx
push edx
lea ecx, [esp + 0x20]
push ebx
push ecx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x1000daa2
cmp dword [esp + 0x10], 1
jne 0x1000daa2
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp edx, eax
ja 0x1000daa2
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ebp
push ebx
lea ecx, [esp + 0x20]
push ebx
push ecx
push edx
call esi
test eax, eax
jne 0x1000daa2
mov edi, 1
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0xc

Function at 0x1000e640
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1008ce68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
call fcn.10056730
push 0x20019
push str.SOFTWARETECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.100568a0
test eax, eax
jne 0x1000e6b2
push str.open_reg_error_agent__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call fcn.10056820
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
push 1
push str.NACondMatchResult
lea ecx, [esp + 0xc]
call fcn.10056a40
lea ecx, [esp + 4]
mov esi, eax
call fcn.100568f0
xor eax, eax
cmp esi, 1
sete al
mov esi, eax
push esi
push str.CRunOnacThread::GetNacCondMatchResult___d_
push str.RunNac
push 0xf
push 0x100a8a3c
call fcn.10010030
add esp, 0x14
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10056820
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1000e720
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1008ce88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
call fcn.10056730
push 0x20019
push str.SOFTWARETECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.100568a0
test eax, eax
jne 0x1000e792
push str.open_reg_error_agent__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call fcn.10056820
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
push 1
push str.USCondMatchResult
lea ecx, [esp + 0xc]
call fcn.10056a40
lea ecx, [esp + 4]
mov esi, eax
call fcn.100568f0
xor eax, eax
cmp esi, 1
sete al
mov esi, eax
push esi
push str.CRunOnacThread::GetUSCondMatchResult___d_
push str.RunNac
push 0xf
push 0x100a8a3c
call fcn.10010030
add esp, 0x14
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10056820
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x100265c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x100ab98c]
test eax, eax
jne 0x100266ac
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x100ab828
mov dword [0x100ab98c], 1
mov dword [0x100ab828], 0x94
call esi
mov edx, dword [0x100ab838]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x100a4818], eax
je 0x1002668e
push edi
push 0x100ab8c0
mov dword [0x100ab8c0], 0x9c
call esi
push 0x1009f2dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x100ab984], eax
call edi
mov dword [0x100ab988], eax
mov eax, dword [0x100ab984]
pop edi
test eax, eax
push 0x100ab960
je 0x1002665c
call eax
jmp 0x10026662
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100ab8c4]
cmp eax, 6
jae 0x1002667a
cmp eax, 5
jne 0x1002668e
cmp dword [0x100ab8c8], 2
jb 0x1002668e
cmp word [0x100ab960], 9
jne 0x1002668e
mov dword [0x100ab81c], 1
push 0x100ab830
push 0x100ab82c
call fcn.100269e0
add esp, 8
call fcn.100266c0
mov eax, 1
pop esi
ret
mov eax, 1
ret
Function at 0x100276e0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094080
push 0x1001f374
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x100ab990]
xor ebx, ebx
cmp eax, ebx
jne 0x10027840
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002783b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x1009f4cc
lea edx, [ebp - 0x224]
push edx
call fcn.100157ea
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.1007de1a
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x1002783b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10027832
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10027832
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x100ab990], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10027832
push esi
call fcn.1007de43
add esp, 4
mov eax, dword [0x100ab990]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10027eb0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10027f00
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x100280d0
push 0
push 0
call fcn.100194f4
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x10027f00
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x10027eef
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10027f50
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10027f64
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10027fb1
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x1002cbb0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x1002cc09
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1002cc09
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x1002cc10
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1002cbed
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1002cc0b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x100326e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x10032730
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10032730
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10032735
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1003271b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10032742
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x1003d320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1003d361
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003d363
mov esi, edi
test esi, esi
je 0x1003d3d8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003d3cd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1003d3cd
cmp dword [esp + 0x1c], eax
jbe 0x1003d39e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003d3cd
cmp esi, edi
je 0x1003d3bf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x1003d3d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc