joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100708a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x101a7008]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.10114770
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1007091e
cmp dword [esp + 0x14], 6
jb 0x1007091e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, reloc.gdiplus.dll_Ordinal_1
call fcn.10070710
add esp, 0xc
test al, al
je 0x1007091e
cmp word [esi], 0
jne 0x10070976
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, SysReAllocString
call fcn.10070710
add esp, 0xc
test al, al
je 0x1007094a
cmp word [esi], 0
jne 0x10070976
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, reloc.gdiplus.dll_Ordinal_1
call fcn.10070710
add esp, 0xc
test al, al
je 0x1007098b
cmp word [esi], 0
je 0x1007098b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.10111f70
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.10111f70
mov esp, ebp
pop ebp
ret
Function at 0x10070f20
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101482db
mov eax, dword fs:[0]
push eax
mov eax, 0x285c
call fcn.101343b0
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2218]
push ebx
push eax
call fcn.10114770
add esp, 0xc
mov eax, 0x22
mov word [ebp - 0x2218], ax
test esi, esi
je 0x10071134
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x10071134
push esi
call edi
cmp eax, 0xffa
jge 0x10071134
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2218]
push eax
call esi
push 0x1016a7b4
lea eax, [ebp - 0x2218]
push eax
call esi
push str.Shell32.dll
lea ecx, [ebp - 0x2868]
call fcn.10004ac0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2868]
push eax
call fcn.10079390
mov ecx, eax
call fcn.10079450
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2868]
call fcn.10004a70
test esi, esi
je 0x10071134
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x284c], eax
test eax, eax
je 0x10071134
lea ecx, [ebp - 0x2848]
call fcn.100709a0
xor edi, edi
lea esi, [ebp - 0x2848]
nop dword [eax]
cmp word [esi], 0
je 0x10071054
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x284c]
cmp eax, 0x20
ja 0x10071062
inc edi
add esi, 0x210
cmp edi, 3
jl 0x10071030
jmp 0x10071084
imul ebx, edi, 0x210
cmp dword [ebp + ebx - 0x2640], 0
mov ebx, dword [ebp + ebx - 0x263c]
jne 0x1007107c
add ebx, 0x10
test ebx, ebx
jne 0x10071130
mov edi, dword [ebp - 0x284c]
lea eax, [ebp - 0x2218]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x1007112b
mov dword [ebp - 0x2850], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x284c], str._programfiles_Internet_Exploreriexplore.exe
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10114770
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x103
push eax
push dword [ebp + esi*4 - 0x2850]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10071121
push 1
push 0
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x218]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x1007112b
inc esi
cmp esi, 2
jb 0x100710c0
mov eax, ebx
jmp 0x10071136
mov ebx, 0x10
mov eax, ebx
jmp 0x10071136
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret
Function at 0x100714e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10148370
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.10004a40
test al, al
je 0x1007151d
xor al, al
jmp 0x100716c9
mov ecx, edi
call fcn.10071370
test al, al
je 0x1007152f
mov al, 1
jmp 0x100716c9
push 0
mov ecx, edi
call fcn.10005700
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x1007157e
lea ecx, [ebp - 0x28]
call fcn.10005c70
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.100833e0
test al, al
je 0x1007156f
push 0
lea ecx, [ebp - 0x28]
call fcn.10005700
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004a70
mov ecx, edi
call fcn.10071370
test al, al
jne 0x10071528
mov ecx, edi
call fcn.10004eb0
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1007166e
mov ecx, edi
call fcn.10004e20
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x100715b2
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x100715d5
mov eax, ebx
cmp ecx, 8
jb 0x100715cb
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x1007165e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10009d80
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10004a40
test al, al
jne 0x1007164f
lea ecx, [ebp - 0x28]
call fcn.10071160
test al, al
jne 0x1007164f
push 0
lea ecx, [ebp - 0x28]
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1007164f
lea ecx, [ebp - 0x40]
call fcn.10005c70
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.100833e0
test al, al
je 0x10071643
push 0
lea ecx, [ebp - 0x40]
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10004a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004a70
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x100715a6
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.10071160
test al, al
jne 0x100716c2
push 0
mov ecx, edi
call fcn.10005700
push eax
call ebx
test eax, eax
jne 0x100716c2
lea ecx, [ebp - 0x40]
call fcn.10005c70
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.100833e0
test al, al
je 0x100716b3
push 0
lea ecx, [ebp - 0x40]
call fcn.10005700
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10004a70
mov ecx, edi
call fcn.10071370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret
Function at 0x100720d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013d808
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101a7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10072113
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0x20
mov dword [ebp - 0x10], 0
push eax
lea ecx, [ebp - 0x10]
call fcn.100095c0
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x10072187
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10071cb0
push 0
push 0
call fcn.1011e861
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x100721ac
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x1007217f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10071e40
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100095f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x100721c4
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1007216e
mov bl, 1
jmp 0x10072189

Function at 0x10072460
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x10072498
mov edx, dword [esp + 4]
test edx, edx
je 0x10072498
cmp dword [eax], 0xffffffff
je 0x10072498
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10072498
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x100724a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x100724da
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x100724da
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x100724da
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100724da
cmp edi, dword [esi]
jne 0x100724da
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc
Function at 0x10072520
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x101a7008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x10072583
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x10072583
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007255e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10072583
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10111f70
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10111f70
add esp, 8
ret 4
Function at 0x10073430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10148726
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x650]
mov ebx, dword [ebp + 0xc]
call fcn.10005c70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x654]
push 0x101ad080
mov dword [ebp - 0x654], 0
call fcn.100095c0
mov byte [ebp - 4], 1
mov ecx, 0x101ad084
call fcn.10004a40
test al, al
jne 0x100734d9
mov ecx, 0x101ad084
call fcn.10004e20
lea ecx, [ebp - 0x650]
cmp ecx, eax
je 0x1007359d
mov ecx, 0x101ad084
call fcn.10004e20
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x100734d0
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x10073592
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10114770
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x10073630
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.10114770
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x1007357b
test eax, eax
je 0x1007357b
add eax, eax
cmp eax, 0x412
jae 0x10073673
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.10005400
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x10073591
lea eax, [ebp - 0x220]
push eax
call fcn.10005400
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x650]
call fcn.10004ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x654]
call fcn.100095f0
push ebx
push edi
lea eax, [ebp - 0x650]
mov ecx, esi
push eax
call fcn.100733c0
test al, al
je 0x100735c4
mov bl, 1
jmp 0x10073641
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10114770
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1007363f
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push eax
call fcn.10005400
add esp, 4
lea ecx, [ebp - 0x650]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10004ec0
push ebx
push edi
lea eax, [ebp - 0x650]
mov ecx, esi
push eax
call fcn.100733c0
mov bl, al
jmp 0x10073641
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x654]
call fcn.100095f0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x650]
call fcn.10004a70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret 8
call fcn.10112577
int3
Function at 0x100777b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10192e00
push 0x10113d00
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x101a7008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10004a50
mov ecx, edi
call fcn.100778d0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x10077843
test bl, bl
jne 0x100778b2
cmp edi, 0x1a
jne 0x100778b2
mov ecx, esi
call fcn.10004a50
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.10114770
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x430]
push eax
call fcn.10005400
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.10004ec0
mov ecx, esi
call fcn.10004a40
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret
Function at 0x10079c50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101493cb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x10079c89
call fcn.10079df0
cmp byte [0x101ac4b8], 0
jne 0x10079c9c
mov eax, reloc.gdiplus.dll_Ordinal_1
jmp 0x10079dcc
mov eax, dword [esi]
test eax, eax
jne 0x10079d1c
push 8
call fcn.10111f81
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.10111f81
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.10114770
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10079d0b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x10079dbb
call fcn.1006e890
test al, al
jne 0x10079d56
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.1006edd0
test al, al
je 0x10079dbb
mov ecx, dword [esi]
add ecx, 4
call fcn.1006e3e0
call fcn.1006e890
test al, al
je 0x10079dbb
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.10004ac0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.10079390
mov ecx, eax
call fcn.10079450
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10004a70
test edi, edi
je 0x10079dbb
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10079dbb
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x10079dbb
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x10079dca
mov dword [eax], reloc.gdiplus.dll_Ordinal_1
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret 4
Function at 0x1007bba0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014982f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101a7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.1007c280
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10004a70
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10004a70
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10004a70
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10004a70
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10004a70
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10004a70
mov eax, dword [ebp + 8]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1007c850
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10149a1f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101a7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10004a70
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10004a70
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10004a70
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10004a70
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10004a70
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10004a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007db30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10149bbf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101a7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10005c30
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10005c30
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10005c30
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10005c30
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10005c30
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10005c30
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10080f60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x101a7008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10080fe2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10080fe2
test ecx, ecx
je 0x10080fde
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10080fa0
xor eax, eax
jmp 0x10080fe7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10080ff1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10111f70
add esp, 0xc
ret 0xc
Function at 0x10082ee0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013de28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x10082f17
xor al, al
jmp 0x10082f7a
and esi, 0xffffb1af
push esi
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10082f32
mov al, 1
jmp 0x10082f7a
lea ecx, [ebp - 0x28]
call fcn.10005c70
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.100833e0
test al, al
je 0x10082f67
push esi
lea ecx, [ebp - 0x28]
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10082f67
mov bl, 1
jmp 0x10082f69
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004a70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret

Function at 0x10082fa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013de28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1008301e
lea ecx, [ebp - 0x28]
call fcn.10005c70
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.100833e0
test al, al
je 0x1008300d
lea ecx, [ebp - 0x28]
call fcn.10005700
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004a70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10111f70
mov esp, ebp
pop ebp
ret