joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013fa9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10014099
mov eax, 0x94
call fcn.10013090
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001410e
mov ecx, dword [esi + 0x10]
mov dword [0x10039018], ecx
mov eax, dword [esi + 4]
mov dword [0x10039024], eax
mov edx, dword [esi + 8]
mov dword [0x10039028], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1003901c], esi
je 0x10014014
or esi, 0x8000
mov dword [0x1003901c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10039020], eax
call fcn.10017430
test eax, eax
pop ecx
je 0x1001410e
call fcn.1001648c
test eax, eax
jne 0x10014041
call fcn.10017481
jmp 0x1001410e
call fcn.10019fe0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100398f0], eax
call fcn.10019ebe
mov dword [0x10039004], eax
call fcn.1001856a
test eax, eax
jl 0x10014092
call fcn.10019e1c
test eax, eax
jl 0x1001408d
call fcn.10019be9
test eax, eax
jl 0x1001408d
push 0
call fcn.10014ad2
test eax, eax
pop ecx
jne 0x1001408d
inc dword [0x10039000]
jmp 0x1001411f
call fcn.10018768
call fcn.10016275
jmp 0x10014037
test eax, eax
jne 0x100140c9
cmp dword [0x10039000], eax
jle 0x1001410e
dec dword [0x10039000]
cmp dword [0x10039054], eax
jne 0x100140b8
call fcn.10014c10
call fcn.10018768
call fcn.10016275
call fcn.10017481
jmp 0x1001411f
cmp eax, 2
jne 0x10014112
push 0x8c
push 1
call fcn.100187b4
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1001410e
push esi
push dword [0x10035fd4]
call dword [0x10039068]
test eax, eax
push esi
je 0x10014108
call fcn.10016292
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1001411f
call fcn.10013186
pop ecx
xor eax, eax
jmp 0x10014122
cmp eax, 3
jne 0x1001411f
push 0
call fcn.1001645d
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x10014b3c
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1002ef08
call fcn.10014264
push 8
call fcn.100172ce
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x10039058], esi
jne 0x10014b70
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10039054], esi
mov al, byte [ebp + 0x10]
mov byte [0x10039050], al
cmp dword [ebp + 0xc], edi
jne 0x10014bba
cmp dword [0x100398e8], edi
je 0x10014baa
mov eax, dword [0x100398e4]
sub eax, 4
mov dword [0x100398e4], eax
cmp eax, dword [0x100398e8]
jb 0x10014baa
mov eax, dword [eax]
cmp eax, edi
je 0x10014b8b
call eax
jmp 0x10014b8b
push 0x100350c0
mov eax, 0x100350b8
call fcn.10014aba
pop ecx
push 0x100350cc
mov eax, 0x100350c4
call fcn.10014aba
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10014beb
cmp dword [ebp + 0x10], edi
jne 0x10014bf9
mov dword [0x10039058], esi
push dword [ebp + 8]
call fcn.10014a78
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10014bf8
push 8
call fcn.10017219
pop ecx
ret
call fcn.1001429f
ret
Function at 0x10014d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x10014d2d
call fcn.1001568d
mov dword [eax], 0x16
xor eax, eax
jmp 0x10014d97
push esi
push 0x8c
push 1
call fcn.100187b4
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10014d82
push esi
call fcn.10016292
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x10014d60
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x10014c7b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10014d96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.10013186
test ebx, ebx
pop ecx
je 0x10014d94
push ebx
call fcn.1001569f
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001a1e7
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x10035a8c]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10036430]
je 0x1001a21c
inc eax
cmp eax, 0x13
jb 0x1001a20d
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10036430]
jne 0x1001a342
mov eax, dword [0x1003900c]
cmp eax, 1
je 0x1001a31a
cmp eax, edx
jne 0x1001a24c
cmp dword [0x10039010], 1
je 0x1001a31a
cmp ecx, 0xfc
je 0x1001a342
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001a282
lea eax, [ebp - 0x80]
push 0x1002f090
push eax
call fcn.1001b2c0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10014650
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001a2b6
mov eax, edi
push eax
call fcn.10014650
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x1002f08c
push edi
call fcn.10013230
add esp, 0x10
push edi
call fcn.10014650
push dword [esi + 0x10036434]
mov ebx, eax
call fcn.10014650
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10013090
mov ebx, esp
push 0x1002f9e0
push ebx
call fcn.1001b2c0
push edi
push ebx
call fcn.1001b2d0
push 0x1002f088
push ebx
call fcn.1001b2d0
push dword [esi + 0x10036434]
push ebx
call fcn.1001b2d0
push 0x12010
push 0x1002f054
push ebx
call fcn.1001c3ce
add esp, 0x2c
jmp 0x1001a342
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x10036434]
push dword [esi]
call fcn.10014650
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1001291b
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x1001bbf3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1001bdc7
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x10039580]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1001bdc7
test cl, 0x48
je 0x1001bc5e
cmp byte [eax + 5], 0xa
je 0x1001bc5e
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001bcb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x1001bc98
call fcn.1001568d
mov dword [eax], 9
call fcn.10015696
mov dword [eax], esi
jmp 0x1001bca8
cmp eax, 0x6d
je 0x1001bdc7
push eax
call fcn.1001569f
pop ecx
or eax, 0xffffffff
jmp 0x1001bdc9
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x1001bdc2
test eax, eax
je 0x1001bcd7
cmp byte [ebx], 0xa
jne 0x1001bcd7
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x1001bce0
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1001bdbc
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1001bdac
cmp al, 0xd
je 0x1001bd12
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x1001bd9e
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1001bd2c
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x1001bd27
add dword [ebp + 0x10], 2
jmp 0x1001bd80
mov dword [ebp + 0x10], eax
jmp 0x1001bd9a
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001bd54
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001bd9a
cmp dword [ebp - 0xc], 0
je 0x1001bd9a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1001bd75
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1001bd80
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1001bd9d
cmp ebx, dword [ebp + 0xc]
jne 0x1001bd85
cmp byte [ebp - 1], 0xa
jne 0x1001bd85
mov byte [ebx], 0xa
jmp 0x1001bd9d
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001c0f2
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x1001bd9e
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1001bcf6
jmp 0x1001bdbc
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x1001bdbc
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1001bdc9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001be79
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x10035a8c]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x1001beaa
xor eax, eax
jmp 0x1001c033
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x10039580]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1001bee6
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.1001de3a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1001bfc1
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x1001bfff
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x1001bf4a
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1001bf3b
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x1001bf1b
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001bf8a
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x1001bf93
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x1001bf0c
jmp 0x1001bf95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x1001c02e
cmp dword [ebp - 0x6c], edi
je 0x1001bfff
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x1001bff4
call fcn.1001568d
mov dword [eax], 9
call fcn.10015696
mov dword [eax], esi
jmp 0x1001c029
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001bfe9
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x1001bf95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x1001bf95
push dword [ebp - 0x6c]
call fcn.1001569f
pop ecx
jmp 0x1001c029
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1001c017
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x1001c017
xor eax, eax
jmp 0x1001c031
call fcn.1001568d
mov dword [eax], 0x1c
call fcn.10015696
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x1001c031
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1001291b
add ebp, 0x3a0
leave
ret
Function at 0x1001c3ce
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10039454], ebx
push esi
push edi
jne 0x1001c44e
push 0x1002e1e4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001c489
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002fb24
push edi
call esi
test eax, eax
mov dword [0x10039454], eax
je 0x1001c489
push 0x1002fb14
push edi
call esi
push 0x1002fb00
push edi
mov dword [0x10039458], eax
call esi
cmp dword [0x10039018], 2
mov dword [0x1003945c], eax
jne 0x1001c44e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10039464], eax
je 0x1001c44e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10039460], eax
mov eax, dword [0x10039460]
test eax, eax
je 0x1001c493
call eax
test eax, eax
je 0x1001c47a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10039464]
test eax, eax
je 0x1001c47a
test byte [ebp - 8], 1
jne 0x1001c493
cmp dword [0x10039024], 4
jb 0x1001c48d
or byte [ebp + 0x12], 0x20
jmp 0x1001c4b2
xor eax, eax
jmp 0x1001c4c2
or byte [ebp + 0x12], 4
jmp 0x1001c4b2
mov eax, dword [0x10039458]
test eax, eax
je 0x1001c4b2
call eax
mov ebx, eax
test ebx, ebx
je 0x1001c4b2
mov eax, dword [0x1003945c]
test eax, eax
je 0x1001c4b2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10039454]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001f17f
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x1001f198
or eax, 0xffffffff
jmp 0x1001f1f9
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1001f1f5
push 0x3d
push esi
call fcn.10014715
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1001f1f5
cmp esi, eax
je 0x1001f1f5
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x10039038]
sete cl
cmp eax, dword [0x1003903c]
mov dword [ebp - 8], ecx
jne 0x1001f1db
mov edi, eax
call fcn.1001f11e
mov dword [0x10039038], eax
cmp eax, ebx
jne 0x1001f234
cmp dword [ebp + 0xc], ebx
je 0x1001f1fd
cmp dword [0x10039040], ebx
je 0x1001f1fd
call fcn.1001e97c
test eax, eax
je 0x1001f234
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x1001f206
xor eax, eax
jmp 0x1001f1f8
push 4
call fcn.10013174
cmp eax, ebx
pop ecx
mov dword [0x10039038], eax
je 0x1001f1f5
mov dword [eax], ebx
cmp dword [0x10039040], ebx
jne 0x1001f234
push 4
call fcn.10013174
cmp eax, ebx
pop ecx
mov dword [0x10039040], eax
je 0x1001f1f5
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x10039038]
call fcn.1001f0d1
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x1001f295
cmp dword [esi], ebx
je 0x1001f295
lea esi, [esi + edi*4]
push dword [esi]
call fcn.10013186
cmp dword [ebp - 8], ebx
pop ecx
jne 0x1001f278
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1001f2d6
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x1001f26f
mov eax, edi
shl eax, 2
push eax
push dword [0x10039038]
call fcn.100138bd
cmp eax, ebx
pop ecx
pop ecx
je 0x1001f2d6
jmp 0x1001f2d1
cmp dword [ebp - 8], ebx
jne 0x1001f341
cmp edi, ebx
jge 0x1001f2a4
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x10039038]
call fcn.100138bd
cmp eax, ebx
pop ecx
pop ecx
je 0x1001f1f5
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x10039038], eax
cmp dword [ebp + 0xc], ebx
je 0x1001f32b
push dword [ebp - 4]
call fcn.10014650
inc eax
inc eax
push eax
call fcn.10013174
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1001f32b
push dword [ebp - 4]
push esi
call fcn.1001b2c0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1001f324
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.10013186
pop ecx
cmp dword [ebp - 8], ebx
je 0x1001f339
push dword [ebp - 4]
call fcn.10013186
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x1001f1f8
push dword [ebp - 4]
call fcn.10013186
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x1001f202
Function at 0x1001f3cb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10035a8c]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.1001f39b
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.100142b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1001f42d
cmp dword [ebp - 0x1c], 5
jb 0x1001f445
jmp 0x1001f441
cmp dword [ebp - 0x10], 1
jne 0x1001f445
cmp dword [ebp - 0x1c], 4
ja 0x1001f441
jne 0x1001f445
cmp dword [ebp - 0x18], 0
jbe 0x1001f445
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x10030280
call fcn.10007b00
test eax, eax
jge 0x1001f466
mov byte [0x10036c44], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.1001291b
add ebp, 0x78
leave
ret

Function at 0x1002082e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1002a734
call fcn.10014244
sub esp, 0x150
mov eax, dword [0x10035a8c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x10020876
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x1002087a
cmp eax, esi
jb 0x10020881
xor eax, eax
jmp 0x10020956
call fcn.10020327
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.100207ec
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x10020946
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x100208d5
xor esi, esi
jmp 0x10020949
test byte [ebp - 0x158], 2
jne 0x100208e5
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x158], 4
jne 0x10020946
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x10020946
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x154], ebx
je 0x100208d1
cmp dword [ebp - 0x154], edi
jbe 0x100208d1
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x154]
cmp eax, esi
jge 0x100208d1
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001730
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.1001291b
leave
ret 8
Function at 0x10021509
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x1c
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
mov esi, ecx
call fcn.100142b0
add esp, 0xc
call fcn.1002754e
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
call edi
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
je 0x100215d9
cmp dword [ebp - 8], ebx
je 0x100215d4
lea ecx, [esi + 0x2c]
push ecx
or eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100213db
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.10014d10
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x100215e3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call edi
test byte [ebp + 8], 4
je 0x100215ac
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [ebp - 4], ebx
je 0x100215c6
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x28]
call edi
mov dword [esi + 0x28], ebx
jmp 0x100215de
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
inc eax
jmp 0x100215e5
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], ebx
je 0x100215e3
push dword [ebp - 8]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100215ec
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1002a7ee
call fcn.10014244
push ecx
push esi
push 0x40
call fcn.1002020a
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor esi, esi
cmp ecx, esi
mov dword [ebp - 4], esi
je 0x1002161b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10027fb0
mov esi, eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
or eax, 4
push eax
mov ecx, esi
call fcn.10021509
test eax, eax
jne 0x10021642
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
xor eax, eax
jmp 0x1002165f
push dword [ebp + 0x10]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test byte [ebp + 0x18], 4
jne 0x1002165d
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x18