joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100740d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10236026
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x828], ecx
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x818], edi
test edi, edi
je 0x100741b0
lea edx, [ebp - 0x810]
mov dword [ebp - 0x814], 0
xor esi, esi
mov dword [ebp - 0x81c], edx
mov dword [ebp - 0x814], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x100741ce
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101e4dd6
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x814], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1007419c
cmp eax, edi
ja 0x1007419c
mov edx, ebx
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x818], edi
mov dword [edx + eax*2], ecx
jmp 0x100741fc
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100741b0
push ebx
call fcn.101e4dd1
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
lea eax, [edi + edi]
cmp eax, 0x800
jae 0x10074328
xor ecx, ecx
mov word [ebp + eax - 0x810], cx
add eax, 2
cmp eax, 0x800
jae 0x10074328
mov word [ebp + eax - 0x810], cx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x820], ebx
test edi, edi
je 0x1007430d
mov eax, dword [ebp - 0x818]
mov edi, 2
mov esi, dword [ebp - 0x828]
mov dword [ebp - 0x824], edi
nop word [eax + eax]
cmp word [edx + edi - 2], 0
jne 0x100742ef
cmp ecx, ebx
je 0x100742ef
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x840]
call fcn.10005e0a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x840]
push eax
call fcn.10005f6e
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.10008084
mov ecx, edx
test al, al
je 0x100742bc
call fcn.10005e30
mov ecx, esi
mov edx, eax
call fcn.1000802c
mov ecx, edx
mov ebx, eax
call fcn.10005e30
push dword [ebx]
mov edi, eax
push 0x18
call fcn.10005b84
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.10005e30
push eax
mov ecx, edx
call fcn.100085c3
add dword [ebx], 0x18
mov ebx, dword [ebp - 0x820]
mov edi, dword [ebp - 0x824]
jmp 0x100742d1
call fcn.10005e30
push eax
mov ecx, esi
call fcn.1000802c
mov eax, dword [eax]
push eax
call fcn.10008242
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call fcn.10005e05
mov eax, dword [ebp - 0x818]
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x81c]
inc ebx
add edi, 2
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x824], edi
cmp ebx, eax
jb 0x10074230
mov esi, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10074321
push esi
call fcn.101e4dd1
add esp, 4
mov al, 1
jmp 0x100741b2
call fcn.101e524c
int3
Function at 0x10075bb0
Capabilities:
Get common file path

Disassembly:
jmp 0x1009b6c0
sub esp, 0x42c
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, ecx
call fcn.1000fc76
push 0x412
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.101fd690
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1009b8d0
cmp eax, 0x208
jae 0x1009b8d0
push ebx
xor eax, eax
push esi
mov word [esp + 0x430], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1009b779
mov esi, edi
cmp eax, 8
jb 0x1009b74c
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1009b8b5
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1009b8e8
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1009b7cf
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1009b7cf
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1009b7e1
or ecx, 0xffffffff
jmp 0x1009b7e9
cmp ecx, 0x1000
jb 0x1009b812
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.101e4da1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1009b8ed
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1009b823
test ecx, ecx
je 0x1009b821
push ecx
call fcn.101e4da1
add esp, 4
jmp 0x1009b823
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1009b894
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1009b882
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009b8ed
mov eax, edx
push ecx
push eax
call fcn.101e4d70
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1009b8b5
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101e48f0
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor al, al
pop ebp
xor ecx, esp
call fcn.101e48f0
add esp, 0x42c
ret
call fcn.1000604b
call fcn.10205f6e
int3
Function at 0x100772a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022fd78
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x100772db
xor al, al
jmp 0x1007737e
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x100772f7
mov eax, dword [edi]
test eax, eax
je 0x100772f7
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1007735b
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10076e40
push 0
push 0
call fcn.1020b93d
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x1007739a
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x10077353
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10077010
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1007737c
mov eax, dword [edi]
test eax, eax
je 0x10077375
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x100773b2
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1007733d
mov bl, 1
jmp 0x1007735d
Function at 0x10077890
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102365f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.10007f3e
test al, al
je 0x100778cd
xor al, al
jmp 0x10077a79
mov ecx, edi
call fcn.10077710
test al, al
je 0x100778df
mov al, 1
jmp 0x10077a79
push 0
mov ecx, edi
call fcn.10007f54
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x1007792e
lea ecx, [ebp - 0x28]
call fcn.10007fd4
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.1009c150
test al, al
je 0x1007791f
push 0
lea ecx, [ebp - 0x28]
call fcn.10007f54
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov ecx, edi
call fcn.10077710
test al, al
jne 0x100778d8
mov ecx, edi
call fcn.10007f50
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x10077a1e
mov ecx, edi
call fcn.10005e30
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x10077962
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x10077985
mov eax, ebx
cmp ecx, 8
jb 0x1007797b
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x10077a0e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10020f50
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10007f3e
test al, al
jne 0x100779ff
lea ecx, [ebp - 0x28]
call fcn.10077500
test al, al
jne 0x100779ff
push 0
lea ecx, [ebp - 0x28]
call fcn.10007f54
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100779ff
lea ecx, [ebp - 0x40]
call fcn.10007fd4
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1009c150
test al, al
je 0x100779f3
push 0
lea ecx, [ebp - 0x40]
call fcn.10007f54
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x10077956
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.10077500
test al, al
jne 0x10077a72
push 0
mov ecx, edi
call fcn.10007f54
push eax
call ebx
test eax, eax
jne 0x10077a72
lea ecx, [ebp - 0x40]
call fcn.10007fd4
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.1009c150
test al, al
je 0x10077a63
push 0
lea ecx, [ebp - 0x40]
call fcn.10007f54
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov ecx, edi
call fcn.10077710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
Function at 0x10079b10
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.101fd690
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10079c52
cmp dword [esi + 4], 6
push edi
ja 0x10079b66
jne 0x10079bee
cmp dword [esi + 8], 2
jb 0x10079bee
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x10079bee
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10079bee
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10079bee
movups xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x102816e8]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10079bee
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10079bee
cmp word [edi + 2], ax
jbe 0x10079bee
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10079c39
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.101fd690
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x10079c39
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.101e48f0
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.101e48f0
add esp, 0x140
ret

Function at 0x1007b620
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102369d4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10007fd4
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10007fd4
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10007fd4
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10007fd4
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.10007fd4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10081dd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.101fd690
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10081e4e
cmp dword [esp + 0x14], 6
jb 0x10081e4e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, reloc.WS2_32.dll_accept
call fcn.10081c40
add esp, 0xc
test al, al
je 0x10081e4e
cmp word [esi], 0
jne 0x10081ea6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, accept
call fcn.10081c40
add esp, 0xc
test al, al
je 0x10081e7a
cmp word [esi], 0
jne 0x10081ea6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, reloc.WS2_32.dll_accept
call fcn.10081c40
add esp, 0xc
test al, al
je 0x10081ebb
cmp word [esi], 0
je 0x10081ebb
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
Function at 0x10082420
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023768b
mov eax, dword fs:[0]
push eax
mov eax, 0x285c
call fcn.101e6030
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2218]
push ebx
push eax
call fcn.101fd690
add esp, 0xc
mov eax, 0x22
mov word [ebp - 0x2218], ax
test esi, esi
je 0x10082634
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x10082634
push esi
call edi
cmp eax, 0xffa
jge 0x10082634
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2218]
push eax
call esi
push 0x10280e7c
lea eax, [ebp - 0x2218]
push eax
call esi
push str.Shell32.dll
lea ecx, [ebp - 0x2868]
call fcn.10005e0a
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2868]
push eax
call fcn.1008c540
mov ecx, eax
call fcn.1008c600
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2868]
call fcn.10005e05
test esi, esi
je 0x10082634
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x284c], eax
test eax, eax
je 0x10082634
lea ecx, [ebp - 0x2848]
call fcn.10081ed0
xor edi, edi
lea esi, [ebp - 0x2848]
nop dword [eax]
cmp word [esi], 0
je 0x10082554
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x284c]
cmp eax, 0x20
ja 0x10082562
inc edi
add esi, 0x210
cmp edi, 3
jl 0x10082530
jmp 0x10082584
imul ebx, edi, 0x210
cmp dword [ebp + ebx - 0x2640], 0
mov ebx, dword [ebp + ebx - 0x263c]
jne 0x1008257c
add ebx, 0x10
test ebx, ebx
jne 0x10082630
mov edi, dword [ebp - 0x284c]
lea eax, [ebp - 0x2218]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x1008262b
mov dword [ebp - 0x2850], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x284c], str._programfiles_Internet_Exploreriexplore.exe
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.101fd690
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x103
push eax
push dword [ebp + esi*4 - 0x2850]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10082621
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x218]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x1008262b
inc esi
cmp esi, 2
jb 0x100825c0
mov eax, ebx
jmp 0x10082636
mov ebx, 0x10
mov eax, ebx
jmp 0x10082636
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret
Function at 0x10083460
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102377b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x100834a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1009c580
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x100834cf
lea ebx, [esi + 8]
jmp 0x100834d1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.10007f3e
test al, al
jne 0x100834e7
mov ecx, dword [ebp - 0x18]
call fcn.10007f54
jmp 0x100834e9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x1008350a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1008350a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x10083533
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10083548
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.101e4d70
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 4
Function at 0x10083580
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102377b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x100835c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1009c640
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x100835f0
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x100835f7
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.10007f3e
test al, al
jne 0x1008360b
mov ecx, ebx
call fcn.10007f54
jmp 0x1008360d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x1008365e
call ecx
cmp eax, 5
jne 0x10083658
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.10007f3e
test al, al
jne 0x10083648
mov ecx, ebx
call fcn.10007f54
jmp 0x1008364a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x1008367c
call ecx
cmp eax, 0xb7
jne 0x10083671
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.10098b30
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x100836a2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100836b7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.101e4d70
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 4
Function at 0x1008ae20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102387eb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x1008ae59
call fcn.1008afc0
cmp byte [0x102cf01c], 0
jne 0x1008ae6c
mov eax, reloc.WS2_32.dll_accept
jmp 0x1008af9c
mov eax, dword [esi]
test eax, eax
jne 0x1008aeec
push 8
call fcn.101e4da1
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.101e4da1
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.101fd690
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008aedb
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008af8b
call fcn.10098250
test al, al
jne 0x1008af26
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.100987b0
test al, al
je 0x1008af8b
mov ecx, dword [esi]
add ecx, 4
call fcn.10097d70
call fcn.10098250
test al, al
je 0x1008af8b
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.10005e0a
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.1008c540
mov ecx, eax
call fcn.1008c600
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10005e05
test edi, edi
je 0x1008af8b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008af8b
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x1008af8b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008af9a
mov dword [eax], reloc.WS2_32.dll_accept
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 4