joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077730
Capabilities:
Check os version
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x100b37f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100db00c]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [0x100dc64c]
test eax, eax
jle 0x10077782
inc eax
mov dword [0x100dc64c], eax
mov al, 1
jmp 0x100778c7
push 1
xor bh, bh
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
call fcn.100a26fd
mov dword [ebp - 0x18], eax
push 0x118
push 0
mov byte [eax], bh
lea eax, [ebp + 0xf0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [ebp + 0xec], 0x11c
lea eax, [ebp + 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100777de
cmp dword [ebp + 0xf0], 6
mov eax, dword [ebp - 0x18]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10012bb0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10011f30
test bl, bl
je 0x100778b7
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100778b7
push str.ImpersonateLoggedOnUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp - 0x10]
push esi
call eax
test eax, eax
je 0x100778ae
mov ebx, dword [ebp - 0x14]
inc dword [0x100dc64c]
mov eax, dword [ebx]
test eax, eax
je 0x1007784c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], esi
xor esi, esi
mov bh, 1
cmp dword [0x100db51c], esi
jne 0x100778ae
push 0x20a
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
lea ecx, [ebp]
mov word [ebp + 0x206], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10077890
sub ecx, edx
lea eax, [ebp]
sar ecx, 1
push ecx
push eax
mov ecx, 0x100db50c
call fcn.100039d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100778ba
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x100778c5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.100a26ec
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x10084f00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10084f0b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10084f30
Function at 0x10088c30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d4d88
push 0x100a32f1
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100db00c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10088c91
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.10088d80
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x10088cd4
test bl, bl
jne 0x10088d5d
cmp edi, 0x1a
jne 0x10088d5d
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10088cf6
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10088d30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.100039d0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100a26ec
mov esp, ebp
pop ebp
ret
Function at 0x10089000
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x100b4ef2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100db00c]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x10089044
call fcn.10089190
cmp byte [0x100dc650], 0
jne 0x10089057
mov eax, 0x80000001
jmp 0x1008916c
mov eax, dword [esi]
test eax, eax
jne 0x100890c2
push 8
call fcn.100a26fd
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 1
call fcn.100a26fd
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100890b1
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008915b
call fcn.10012af0
test al, al
jne 0x100890fc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.10012c70
test al, al
je 0x1008915b
mov ecx, dword [esi]
add ecx, 4
call fcn.100125d0
call fcn.10012af0
test al, al
je 0x1008915b
push str.Advapi32.dll
lea ecx, [ebp - 0x28]
call fcn.100036e0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
call fcn.100168f0
mov ecx, eax
call fcn.100169b0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003970
test edi, edi
je 0x1008915b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008915b
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x1008915b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1008916a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.100a26ec
lea esp, [ebp + 0x120]
pop ebp
ret 4
Function at 0x1008a6d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b51cf
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100db00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea esi, [edi + 0x94]
cmp esi, ebx
je 0x1008a733
push esi
mov ecx, edi
call fcn.1008bcc0
add esi, 0x94
add edi, 0x94
cmp esi, ebx
jne 0x1008a713
mov edi, dword [ebp - 0x10]
mov ebx, dword [edi + 4]
jmp 0x1008a735
mov edi, eax
lea esi, [ebx - 0x94]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10003970
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10003970
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10003970
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10003970
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10003970
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10003970
mov eax, dword [ebp - 0x14]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1008b3c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b541f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100db00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10003970
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10003970
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10003970
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10003970
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10003970
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10003970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1008f4d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100db00c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x1008f552
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1008f552
test ecx, ecx
je 0x1008f54e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1008f510
xor eax, eax
jmp 0x1008f557
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1008f561
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a26ec
add esp, 0xc
ret 0xc
Function at 0x10090500
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], 0
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x10090523
cmp dword [eax + 0x14], 8
jb 0x10090525
mov eax, dword [eax]
jmp 0x10090525
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x1009054d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x1009054f
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x100905b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5f88
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100db00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x100905f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.10014600
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x1009061c
lea eax, [esi + 8]
jmp 0x1009061e
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x1009062e
cmp dword [ebx + 0x14], 8
jb 0x10090630
mov ebx, dword [ebx]
jmp 0x10090630
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10090651
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10090651
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x1009067a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1009068f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.100a272d
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a26ec
mov esp, ebp
pop ebp
ret 4
Function at 0x100906d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100db00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x10090713
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.100146e0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x1009073d
lea ecx, [esi + 8]
jmp 0x1009073f
xor ecx, ecx
cmp dword [ebx + 0x10], 0
mov dword [ebp - 0x18], ecx
je 0x10090754
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10090756
mov eax, dword [ebx]
jmp 0x10090756
xor eax, eax
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x100907a1
call ecx
cmp eax, 5
jne 0x1009079b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx + 0x10], 0
je 0x1009078b
cmp dword [ebx + 0x14], 8
jb 0x1009078d
mov ebx, dword [ebx]
jmp 0x1009078d
xor ebx, ebx
push ebx
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x100907bf
call ecx
cmp eax, 0xb7
jne 0x100907b4
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.10012ff0
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x100907e5
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100907fa
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.100a272d
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a26ec
mov esp, ebp
pop ebp
ret 4
Function at 0x100998a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b530f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100db00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.10003750
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10003750
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10003750
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10003750
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10003750
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10003750
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1009b560
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100db00c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x1009b5c5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009b5a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009b5c5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100a26ec
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100a26ec
add esp, 8
ret 4
Function at 0x1009b770
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7738
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100db00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x1009b7b9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x1009b90b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x1009b8d6
test eax, eax
je 0x1009b8d6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x1009b8d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x1009b85b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009b84f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009b85b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x1009b869
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10003750
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x1009b8d6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x1009b814
jmp 0x1009b8d9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x1009b902
test edx, edx
je 0x1009b8fe
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x1009b7d0
mov al, 1
jmp 0x1009b90d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1009b90b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a26ec
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1009f1f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x100db00c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x1009f287
cmp dword [esp + 8], 6
jb 0x1009f287
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.100a26ec
add esp, 0x118
ret

Function at 0x1009f2a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x100db00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.100039d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100168f0
mov ecx, eax
call fcn.100169b0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003970
push 0xb
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push str.crypt32.dll
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.100039d0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.100168f0
mov ecx, eax
call fcn.100169b0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10003970
test ebx, ebx
je 0x1009f3fd
test esi, esi
je 0x1009f3fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x741914c5
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x262333a3
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x484cc7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x484a08
inc ebx
call fcn.00484cff
add edi, ebx
xor dword [ecx], eax
add ebx, 0x6281ee14
sub edi, ebx
add ecx, 2
add edi, 1
cmp ecx, esi
jl fcn.00484cc7
and ebx, ebx
sub edi, 1
add ebx, edi
ret