joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100028d8
test al, al
je 0x1002a4bd
xor al, al
jmp 0x1002a5f1
push esi
lea ecx, [ebp - 0x28]
call fcn.100039f2
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.1002b320
lea ecx, [ebp - 0x28]
call fcn.100028e0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002a5de
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002a51e
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100028eb
cmp esi, 0xffffffff
jne 0x1002a5de
lea ecx, [ebp - 0x28]
call fcn.100029d1
cmp eax, 2
jbe 0x1002a5da
lea ecx, [ebp - 0x28]
call fcn.100029d1
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.100029a0
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x1002a563
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x1002a582
lea ecx, [ebp - 0x28]
call fcn.100029d1
cmp dword [esi + 0x14], 8
jb 0x1002a57a
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x1002a5da
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.1002b320
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002a5de
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002a5c9
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100028eb
cmp esi, 0xffffffff
jne 0x1002a5de
xor bl, bl
jmp 0x1002a5e0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045825
mov esp, ebp
pop ebp
ret
Function at 0x1002a610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100028d8
test al, al
je 0x1002a64d
xor al, al
jmp 0x1002a787
push esi
lea ecx, [ebp - 0x28]
call fcn.100039f2
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.1002b320
lea ecx, [ebp - 0x28]
call fcn.100028e0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002a6bb
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002a6aa
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100028eb
cmp ebx, 0xffffffff
je 0x1002a6c4
test bl, 0x10
je 0x1002a774
lea ecx, [ebp - 0x28]
call fcn.100029d1
cmp eax, 2
jbe 0x1002a770
lea ecx, [ebp - 0x28]
call fcn.100029d1
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.100029a0
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x1002a6f4
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x1002a713
lea ecx, [ebp - 0x28]
call fcn.100029d1
cmp dword [esi + 0x14], 8
jb 0x1002a70b
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x1002a770
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.1002b320
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002a76b
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002a75a
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100028eb
cmp ebx, 0xffffffff
je 0x1002a770
test bl, 0x10
je 0x1002a774
xor bl, bl
jmp 0x1002a776
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045825
mov esp, ebp
pop ebp
ret
Function at 0x1002a7b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad80
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100028d8
test al, al
je 0x1002a7ec
xor al, al
jmp 0x1002a876
push esi
lea ecx, [ebp - 0x28]
call fcn.100039f2
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.1002b320
lea ecx, [ebp - 0x28]
call fcn.100028e0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002a85a
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002a849
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100028eb
cmp ebx, 0xffffffff
je 0x1002a863
test bl, 0x10
je 0x1002a863
mov bl, 1
jmp 0x1002a865
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045825
mov esp, ebp
pop ebp
ret
Function at 0x1002a8a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006add0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.100028d8
test al, al
je 0x1002a8dd
xor al, al
jmp 0x1002aa89
mov ecx, edi
call fcn.1002a7b0
test al, al
je 0x1002a8ef
mov al, 1
jmp 0x1002aa89
push 0
mov ecx, edi
call fcn.100028e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x1002a93e
lea ecx, [ebp - 0x28]
call fcn.10003c19
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.1003b000
test al, al
je 0x1002a92f
push 0
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov ecx, edi
call fcn.1002a7b0
test al, al
jne 0x1002a8e8
mov ecx, edi
call fcn.100029d1
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1002aa2e
mov ecx, edi
call fcn.100029a0
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x1002a972
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x1002a995
mov eax, ebx
cmp ecx, 8
jb 0x1002a98b
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x1002aa1e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10005628
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.100028d8
test al, al
jne 0x1002aa0f
lea ecx, [ebp - 0x28]
call fcn.1002a480
test al, al
jne 0x1002aa0f
push 0
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1002aa0f
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b000
test al, al
je 0x1002aa03
push 0
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.100028eb
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x1002a966
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.1002a480
test al, al
jne 0x1002aa82
push 0
mov ecx, edi
call fcn.100028e0
push eax
call ebx
test eax, eax
jne 0x1002aa82
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.1003b000
test al, al
je 0x1002aa73
push 0
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100028eb
mov ecx, edi
call fcn.1002a7b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045825
mov esp, ebp
pop ebp
ret
Function at 0x1002c570
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002c6b2
cmp dword [esi + 4], 6
push edi
ja 0x1002c5c6
jne 0x1002c64e
cmp dword [esi + 8], 2
jb 0x1002c64e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1002c64e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1002c64e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002c64e
movups xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x1007ec60]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1002c64e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002c64e
cmp word [edi + 2], ax
jbe 0x1002c64e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1002c699
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1002c699
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.10045825
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.10045825
add esp, 0x140
ret
Function at 0x1002de10
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068238
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1002de4b
xor al, al
jmp 0x1002ded2
add eax, 0x20
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x14]
call fcn.10003e08
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1002debf
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x1002da00
push 0
push 0
call fcn.10055e96
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x1002deee
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x1002deb7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.1002db80
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10003e2b
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045825
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x1002df06
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1002dea6
mov bl, 1
jmp 0x1002dec1
Function at 0x1002e790
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x124
push 0xffffffffffffffff
push 0x1006b60a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp + 0x120], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x1002e7d5
call fcn.1002e9e0
cmp byte [0x1008d734], 0
jne 0x1002e7e8
mov eax, 0x80000001
jmp 0x1002e9b1
mov eax, dword [esi]
test eax, eax
jne 0x1002e853
push 8
call fcn.10045a3f
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 1
call fcn.10045a3f
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 8]
push eax
call fcn.10048ed0
add esp, 0x14
mov dword [ebp + 4], 0x11c
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002e842
cmp dword [ebp + 8], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1002e9a0
call fcn.100384b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test al, al
jne 0x1002e946
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
add eax, 4
mov byte [ebp - 0xd], 0
push str.Advapi32.dll
mov dword [ebp - 0x14], eax
call fcn.100028f0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.10030850
mov ecx, eax
call fcn.10030910
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100028eb
test edi, edi
je 0x1002e9a0
push 0x10080348
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x1002e9a0
push dword [ebp - 0x18]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1002e9a0
lea eax, [ebp]
mov dword [ebp], 0
push eax
push 0x20008
push edi
call ebx
test eax, eax
je 0x1002e913
push dword [ebp]
mov ecx, dword [ebp - 0x14]
call fcn.10038620
mov bl, al
jmp 0x1002e916
mov bl, byte [ebp - 0xd]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ecx, dword [ebp]
test ecx, ecx
je 0x1002e929
push ecx
call edi
test bl, bl
je 0x1002e9a0
mov ecx, dword [esi]
add ecx, 4
call fcn.10038010
call fcn.100384b0
test al, al
je 0x1002e9a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Advapi32.dll
lea ecx, [ebp - 0x30]
call fcn.100028f0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.10030850
mov ecx, eax
call fcn.10030910
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100028eb
test edi, edi
je 0x1002e9a0
push str.RegOpenCurrentUser
push edi
call ebx
test eax, eax
je 0x1002e9a0
push dword [esi]
push 0x20019
call eax
test eax, eax
je 0x1002e9a0
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1002e9af
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.10045825
lea esp, [ebp + 0x124]
pop ebp
ret 4
Function at 0x10036e80
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.10048ed0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x10036f17
cmp dword [esp + 8], 6
jb 0x10036f17
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.10045825
add esp, 0x118
ret

Function at 0x10036f40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c460
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x1008b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.100028f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.10030850
mov ecx, eax
call fcn.10030910
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.100028f0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.10030850
mov ecx, eax
call fcn.10030910
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100028eb
test ebx, ebx
je 0x10037055
test esi, esi
je 0x10037055
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039bf0
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x1006c820
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10039cb9
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x10039cde
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a36
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10039ca5
cmp eax, edi
ja 0x10039ca5
mov edx, ebx
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [edx + eax*2], ecx
jmp 0x10039d06
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x10039cb9
push ebx
call fcn.10045836
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.10045825
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [edi + edi]
cmp eax, 0x800
jae 0x10039dfd
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x10039dfd
mov word [ebp + eax + 4], cx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
test edi, edi
je 0x10039de2
mov eax, dword [ebp - 0x10]
mov edi, 2
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
cmp word [edx + edi - 2], 0
jne 0x10039dcd
cmp ecx, ebx
je 0x10039dcd
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x38]
call fcn.100028f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
call fcn.10002bc4
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.10002988
mov ecx, edx
test al, al
je 0x10039da3
call fcn.100029a0
mov ecx, esi
mov edx, eax
call fcn.10002930
mov ecx, edx
mov ebx, eax
call fcn.100029a0
push dword [ebx]
mov edi, eax
push 0x18
call fcn.1000235c
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.100029a0
push eax
mov ecx, edx
call fcn.10002ee7
add dword [ebx], 0x18
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x10039db8
call fcn.100029a0
push eax
mov ecx, esi
call fcn.10002930
mov eax, dword [eax]
push eax
call fcn.10002bcc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.100028eb
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x14]
inc ebx
add edi, 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
cmp ebx, eax
jb 0x10039d23
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10039df6
push esi
call fcn.10045836
add esp, 4
mov al, 1
jmp 0x10039cbb
call fcn.1004595c
int3
Function at 0x1003a0f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push 0x20c
lea eax, [esp + 0x1c]
mov ebp, ecx
push 0
push eax
call fcn.10048ed0
add esp, 0xc
lea eax, [esp + 0x18]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1003a2f4
push ebx
xor eax, eax
push esi
mov word [esp + 0x22a], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10002ab7
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.100029a0
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1003a19d
mov esi, edi
cmp eax, 8
jb 0x1003a170
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10002a85
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
add esp, 0x14
jmp 0x1003a2d9
mov ecx, ebp
call fcn.10002ee1
cmp ebx, eax
ja 0x1003a30c
mov ecx, ebp
call fcn.10002ee1
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1003a1f3
mov ecx, ebp
call fcn.100029a0
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1003a1f3
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10002a23
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1003a205
or ecx, 0xffffffff
jmp 0x1003a20d
cmp ecx, 0x1000
jb 0x1003a236
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.10045a3f
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1003a311
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1003a247
test ecx, ecx
je 0x1003a245
push ecx
call fcn.10045a3f
add esp, 4
jmp 0x1003a247
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10002a9e
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1003a2b8
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1003a2a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003a311
mov eax, edx
push ecx
push eax
call fcn.10045a6f
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1003a2d9
lea eax, [esp + 0x10]
push eax
call fcn.10002bc4
push edi
mov esi, eax
call fcn.10002bc4
push eax
push 4
call fcn.1000235c
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10045825
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
xor al, al
pop ebp
xor ecx, esp
call fcn.10045825
add esp, 0x224
ret
call fcn.10002e9f
call fcn.1004eea7
int3