joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020181
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x30], edi
mov dword [esi + 0xc], ebx
je 0x100201c6
call fcn.1001fb97
test eax, eax
je 0x100201cf
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x1002013b
push edi
push edi
call fcn.100ad5a0
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x40], eax
je 0x100201c6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [esi + 0x48]
cmp eax, edi
je 0x100201c6
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x48]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0x1c]
cmp ebx, edi
je 0x10020215
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x48]
push edi
mov ecx, dword [eax]
neg edx
push edx
push dword [ebp - 4]
push dword [ebp + 8]
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push edi
push edi
push dword [esi + 0x34]
push eax
call dword [ecx + 0x20]
jmp 0x10020251
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov edx, dword [esi + 0x48]
push edi
neg ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], edx
push dword [ebp + 8]
mov edx, dword [edx]
push edi
push eax
push ecx
push edi
push edi
push dword [esi + 0x34]
push dword [ebp - 8]
call dword [edx + 0x20]
test eax, eax
jne 0x100201c6
inc eax
jmp 0x100201c8

Function at 0x100209ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.100cd841
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10020a83
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x10020a83
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10020a83
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10020a7f
test ebx, ebx
je 0x10020a7f
push edi
push eax
push ebx
call fcn.100ab860
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push edi
push esi
call fcn.10020634
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop ebx
jmp 0x10020a85
xor edi, edi
jmp 0x10020a73
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x10021246
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x100d739c
call fcn.100ac440
sub esp, 0x824
mov eax, dword [0x1011c710]
and dword [ebp - 0x824], 0
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, ebp
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x830], eax
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x818], eax
and dword [ebp - 4], 0
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x820], eax
test esi, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x828], 0x50
je 0x100212e9
mov ecx, dword [ebp - 0x81c]
push 0
push esi
call fcn.10020bd8
test eax, eax
jne 0x100212db
xor esi, esi
jmp 0x10021452
push edi
lea ecx, [ebp - 0x818]
call fcn.10001f92
jmp 0x10021344
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x82c]
push eax
push edi
call fcn.100cd3c0
test eax, eax
je 0x10021344
xor esi, esi
cmp dword [ebp - 0x82c], 3
jne 0x10021452
push esi
lea ecx, [ebp - 0x820]
call fcn.1000192d
push dword [ebp - 0x828]
mov ecx, dword [ebp - 0x81c]
push eax
call fcn.10020bd8
test eax, eax
je 0x10021452
test ebx, ebx
lea eax, [ebp - 0x810]
je 0x10021365
push ebx
push dword [ebp - 0x818]
push str.POST__s_HTTP_1.1_r_n_s_r_n
push eax
call fcn.100acf5b
add esp, 0x10
jmp 0x10021379
push dword [ebp - 0x818]
push str.POST__s_HTTP_1.1_r_n_r_n
push eax
call fcn.100acf5b
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov esi, dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x814], eax
jle 0x100213d6
mov eax, 0x1000
cmp dword [ebp - 0x814], eax
jg 0x100213ab
mov eax, dword [ebp - 0x814]
mov edi, dword [ebp - 0x81c]
push 0
push eax
lea eax, [ebp + ebx - 0x810]
push eax
push dword [edi + 4]
call esi
test eax, eax
jl 0x100213dc
sub dword [ebp - 0x814], eax
add ebx, eax
cmp dword [ebp - 0x814], 0
jg 0x10021398
mov edi, dword [ebp - 0x81c]
mov eax, dword [ebp + 0x18]
xor ebx, ebx
test eax, eax
mov dword [ebp - 0x814], eax
jle 0x10021424
mov eax, 0x1000
cmp dword [ebp - 0x814], eax
jg 0x100213fe
mov eax, dword [ebp - 0x814]
push 0
push eax
mov eax, dword [ebp - 0x830]
add eax, ebx
push eax
push dword [edi + 4]
call esi
test eax, eax
jl 0x10021424
sub dword [ebp - 0x814], eax
add ebx, eax
cmp dword [ebp - 0x814], 0
jg 0x100213eb
cmp dword [ebp - 0x814], 0
jne 0x1002144c
mov ecx, edi
call fcn.10020e00
cmp eax, 0x64
mov dword [ebp - 0x824], eax
jne 0x1002144c
mov ecx, edi
call fcn.10020e00
mov dword [ebp - 0x824], eax
mov esi, dword [ebp - 0x824]
mov ecx, dword [ebp - 0x820]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 0x14
Function at 0x1002148b
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x100d73bc
call fcn.100ac440
sub esp, 0x81c
mov eax, dword [0x1011c710]
and dword [ebp - 0x820], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, ebp
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], ecx
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x818], eax
and dword [ebp - 4], 0
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x81c], eax
test esi, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x824], 0x50
je 0x10021525
mov ecx, dword [ebp - 0x814]
push 0
push esi
call fcn.10020bd8
test eax, eax
jne 0x10021517
xor esi, esi
jmp 0x1002163f
push edi
lea ecx, [ebp - 0x818]
call fcn.10001f92
jmp 0x10021580
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x828]
push eax
push edi
call fcn.100cd3c0
test eax, eax
je 0x10021580
xor esi, esi
cmp dword [ebp - 0x828], 3
jne 0x1002163f
push esi
lea ecx, [ebp - 0x81c]
call fcn.1000192d
push dword [ebp - 0x824]
mov ecx, dword [ebp - 0x814]
push eax
call fcn.10020bd8
test eax, eax
je 0x1002163f
test ebx, ebx
lea eax, [ebp - 0x810]
je 0x100215a1
push ebx
push dword [ebp - 0x818]
push str.GET__s_HTTP_1.1_r_n_s_r_n
push eax
call fcn.100acf5b
add esp, 0x10
jmp 0x100215b5
push dword [ebp - 0x818]
push str.GET__s_HTTP_1.1_r_n_r_n
push eax
call fcn.100acf5b
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
test edi, edi
jle 0x10021610
mov ebx, 0x1000
cmp edi, ebx
mov eax, ebx
jg 0x100215d7
mov eax, edi
push 0
push eax
lea eax, [ebp + esi - 0x810]
push eax
mov eax, dword [ebp - 0x814]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jl 0x100215ff
sub edi, eax
add esi, eax
test edi, edi
jg 0x100215cf
jmp 0x1002160e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x814]
mov dword [ecx + 0x1c], eax
test edi, edi
jne 0x10021639
mov ecx, dword [ebp - 0x814]
call fcn.10020e00
cmp eax, 0x64
mov dword [ebp - 0x820], eax
jne 0x10021639
mov ecx, dword [ebp - 0x814]
call fcn.10020e00
mov dword [ebp - 0x820], eax
mov esi, dword [ebp - 0x820]
mov ecx, dword [ebp - 0x81c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 0xc
Function at 0x10021e5f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100d742c
call fcn.100ac440
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x84], ebx
jne 0x10021f14
push esi
call fcn.100cd841
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push ebx
call esi
cmp eax, ebx
mov dword [edi + 0x84], eax
jne 0x10021f13
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x104
push eax
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.1000192d
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000170f
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.10007475
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x10021f08
push 0x6a
push ebx
call esi
test eax, eax
je 0x10021f01
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x84], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001199
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1002249d
Capabilities:
Check http status code

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x1011c710]
mov edx, dword [ebp + 0x400]
push ebx
push esi
mov esi, dword [ebp + 0x3f8]
xor ebx, ebx
push ebx
push dword [ebp + 0x404]
xor eax, ebp
push 3
push ebx
push ebx
push dword [ebp + 0x3fc]
mov dword [ebp + 0x3e8], eax
mov eax, ecx
mov ecx, dword [ebp + 0x3f4]
push ecx
push dword [eax + 4]
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x70], ebx
call fcn.10089969
add esp, 0x20
cmp eax, ebx
mov dword [ebp - 0x80], eax
jne 0x10022501
xor eax, eax
jmp 0x100225c8
push edi
push ebx
push dword [ebp + 0x404]
push ebx
push ebx
push ebx
push esi
push 0x100e6f3c
push eax
call fcn.10089918
mov edi, eax
add esp, 0x20
cmp edi, ebx
jne 0x10022528
xor eax, eax
jmp 0x100225c7
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10089a38
add esp, 0x14
test eax, eax
je 0x100225b5
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x398]
push eax
push 0x13
push edi
mov dword [ebp - 0x7c], 0x50
call fcn.100897fb
add esp, 0x14
test eax, eax
je 0x100225a6
lea eax, [ebp + 0x398]
push eax
call fcn.100ad0fd
cmp eax, 0xc8
pop ecx
mov dword [ebp - 0x70], eax
jne 0x100225a6
mov esi, 0x400
jmp 0x10022590
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x100225a6
mov ecx, dword [ebp - 0x78]
mov byte [ebp + eax - 0x6c], bl
lea eax, [ebp - 0x6c]
push eax
call fcn.10007475
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
push edi
call fcn.100897b6
add esp, 0x10
test eax, eax
jne 0x10022579
push ebx
push ebx
push ebx
push edi
call fcn.100899f3
mov ebx, dword [ebp - 0x70]
add esp, 0x10
push edi
call fcn.100899ba
push dword [ebp - 0x80]
call fcn.100899ba
pop ecx
pop ecx
mov eax, ebx
pop edi
mov ecx, dword [ebp + 0x3e8]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
add ebp, 0x3ec
leave
ret 0x14
Function at 0x100225e1
Capabilities:
Check http status code

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x1011c710]
mov edx, dword [ebp + 0x404]
push ebx
push esi
mov esi, dword [ebp + 0x3f8]
push edi
mov edi, dword [ebp + 0x3fc]
xor ebx, ebx
push ebx
push dword [ebp + 0x408]
xor eax, ebp
push 3
push ebx
push ebx
push dword [ebp + 0x400]
mov dword [ebp + 0x3e8], eax
mov eax, ecx
mov ecx, dword [ebp + 0x3f4]
push ecx
push dword [eax + 4]
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x70], ebx
call fcn.10089969
add esp, 0x20
cmp eax, ebx
mov dword [ebp - 0x80], eax
je 0x10022664
push ebx
push dword [ebp + 0x408]
push ebx
push ebx
push ebx
push esi
push str.POST
push eax
call fcn.10089918
mov esi, eax
add esp, 0x20
cmp esi, ebx
jne 0x1002266b
xor eax, eax
jmp 0x10022710
push edi
call fcn.100ab7d0
push eax
push edi
push ebx
push ebx
push esi
call fcn.10089a38
add esp, 0x18
test eax, eax
je 0x100226fe
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x398]
push eax
push 0x13
push esi
mov dword [ebp - 0x7c], 0x50
call fcn.100897fb
add esp, 0x14
test eax, eax
je 0x100226ef
lea eax, [ebp + 0x398]
push eax
call fcn.100ad0fd
cmp eax, 0xc8
pop ecx
mov dword [ebp - 0x70], eax
jne 0x100226ef
mov edi, 0x400
jmp 0x100226d9
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x100226ef
mov ecx, dword [ebp - 0x78]
mov byte [ebp + eax - 0x6c], bl
lea eax, [ebp - 0x6c]
push eax
call fcn.10007475
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
push esi
call fcn.100897b6
add esp, 0x10
test eax, eax
jne 0x100226c2
push ebx
push ebx
push ebx
push esi
call fcn.100899f3
mov ebx, dword [ebp - 0x70]
add esp, 0x10
push esi
call fcn.100899ba
push dword [ebp - 0x80]
call fcn.100899ba
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp + 0x3e8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
add ebp, 0x3ec
leave
ret 0x18
Function at 0x10023625
Capabilities:
Create directory

Disassembly:
mov eax, 0x100d7611
call fcn.100ac440
sub esp, 0x11c
mov eax, dword [0x1011c710]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x10], eax
mov esi, ecx
jne 0x10023654
xor eax, eax
jmp 0x1002379c
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x118], eax
push edi
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], ebx
call fcn.10001f92
mov eax, dword [ebp - 0x118]
cmp dword [eax - 0xc], ebx
je 0x1002378c
push ebx
push 0x100e7018
lea ecx, [ebp - 0x118]
call fcn.10003f61
cmp eax, 0xffffffff
jle 0x1002378c
lea ecx, [ebp - 0x128]
call fcn.100c7273
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.100ab720
lea eax, [ebp - 0x114]
push eax
call fcn.1006d2be
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x10
push ebx
lea eax, [ebp - 0x114]
push eax
call edi
lea eax, [ebp - 0x114]
push str.Lrc_
push eax
call fcn.100ac910
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x114]
push eax
call edi
mov eax, dword [esi + 0xb4]
push ebx
push 0x1001
push eax
lea ecx, [ebp - 0x128]
call fcn.100c751b
test eax, eax
je 0x1002373c
mov ecx, dword [ebp - 0x118]
mov eax, dword [ecx - 0xc]
inc eax
push eax
push ecx
lea ecx, [ebp - 0x128]
call fcn.100c6fc1
lea ecx, [ebp - 0x128]
call fcn.100c7211
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x90]
mov dword [esi + 0x88], ebx
call fcn.10022cbb
push dword [esi + 0xb4]
mov ecx, esi
call fcn.100235a0
test eax, eax
je 0x1002377b
push ebx
mov ecx, esi
call fcn.10022b28
mov esi, dword [esi + 0x84]
push 1
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], bl
call fcn.100c72b2
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.10001199
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 4
Function at 0x100268fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
lea eax, [esi + 0x28]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x100269f6
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.100c6c30
push ebx
push 0
push eax
mov dword [esi], eax
call fcn.100ab720
add esp, 0x10
push dword [esi]
lea eax, [esi + 0x28]
push edi
push dword [ebp - 4]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop ebx
je 0x100269f6
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.10026807
test eax, eax
je 0x100269f6
mov eax, dword [ebp - 0x30]
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0xa], ax
mov eax, dword [ebp - 0x2c]
mov word [esi + 8], cx
mov ecx, eax
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
shr ecx, 0x10
mov word [esi + 0xc], cx
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
shr ecx, 0x10
mov word [esi + 0x16], ax
mov word [esi + 0x10], cx
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
shr ecx, 0x10
lea eax, [esi + 0x230]
push eax
mov word [esi + 0x14], cx
push str.CompanyName
mov ecx, esi
call fcn.10026847
lea eax, [esi + 0x640]
push eax
push str.FileDescription
mov ecx, esi
call fcn.10026847
lea eax, [esi + 0x438]
push eax
push str.ProductName
mov ecx, esi
call fcn.10026847
xor eax, eax
inc eax
jmp 0x100269f8
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10027a02
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d7ab8
call fcn.100ac440
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.PSNetwork.dll_public:_void___thiscall_CPSNetwork::constructor_void_]
and dword [ebp - 4], 0
push fcn.10001923
push fcn.1000190f
push 3
push 4
lea eax, [esi + 0x10]
push eax
mov dword [esi], 0x100e7b78
call fcn.100ae7eb
lea ecx, [esi + 0x1c]
call fcn.1000190f
lea ecx, [esi + 0x20]
call fcn.1000190f
lea ecx, [esi + 0x24]
call fcn.1000190f
lea ecx, [esi + 0x28]
call fcn.1000190f
lea ecx, [esi + 0x2c]
call fcn.1000190f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
call fcn.1004dcea
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 7
call fcn.10002fed
and dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1002b234
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x100d7f55
call fcn.100ac440
sub esp, 0x2c
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.100cd841
mov esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1002b25a
mov eax, 0x100e8128
push eax
movzx eax, word [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1002b31f
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor esi, esi
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x1002b294
xor eax, eax
jmp 0x1002b31e
push 0x400
lea ecx, [ebp - 0x38]
call fcn.100cb28c
cmp dword [ebp + 0xc], 2
mov dword [ebp - 4], esi
jne 0x1002b2e8
lea edi, [ebx + 0xe]
push edi
call fcn.100c6c30
mov esi, eax
test esi, esi
pop ecx
je 0x1002b310
push edi
push 0
push esi
call fcn.100ab720
push ebx
push dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
mov word [esi], 0x4d42
mov dword [esi + 2], edi
mov dword [esi + 0xa], 0x36
call fcn.100ab860
add esp, 0x18
push 0
push edi
push esi
jmp 0x1002b2ed
push esi
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.100cb31f
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
call fcn.1002b1df
test esi, esi
mov edi, eax
je 0x1002b30e
push esi
call fcn.100c6c35
pop ecx
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100cb661
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1002c5b4
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x100d849b
call fcn.100ac440
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e8150
call fcn.1000190f
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
call fcn.1000190f
or dword [esi + 0x10], 0xffffffff
lea ecx, [esi + 0x14]
call fcn.1000190f
lea ecx, [esi + 0x18]
call fcn.1000190f
lea ecx, [esi + 0x1c]
call fcn.1000190f
lea ecx, [esi + 0x20]
call fcn.1000190f
lea ecx, [esi + 0x24]
call fcn.1000190f
lea ecx, [esi + 0x28]
call fcn.1000190f
lea ecx, [esi + 0x2c]
call fcn.1000190f
lea ecx, [esi + 0x30]
call fcn.1000190f
lea ecx, [esi + 0x34]
call fcn.1000190f
lea ecx, [esi + 0x38]
call fcn.1000190f
lea ecx, [esi + 0x3c]
call fcn.1000190f
lea ecx, [esi + 0x40]
call fcn.1000190f
lea ecx, [esi + 0x44]
call fcn.1000190f
lea ecx, [esi + 0x48]
call fcn.1000190f
lea ecx, [esi + 0x4c]
call fcn.1000190f
lea ecx, [esi + 0x50]
call fcn.1000190f
lea ecx, [esi + 0x54]
call fcn.1000190f
lea ecx, [esi + 0x58]
call fcn.1000190f
lea ecx, [esi + 0x5c]
call fcn.1000190f
lea ecx, [esi + 0x60]
call fcn.1000190f
lea ecx, [esi + 0x64]
call fcn.1000190f
lea ecx, [esi + 0x68]
call fcn.1000190f
lea ecx, [esi + 0x6c]
call fcn.1000190f
lea ecx, [esi + 0x70]
call fcn.1000190f
lea ecx, [esi + 0x74]
call fcn.1000190f
push edi
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0x1a
call fcn.10050861
push edi
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 0x1b
call fcn.10050861
lea ecx, [esi + 0xd8]
call fcn.1000190f
lea ecx, [esi + 0xdc]
call fcn.1000190f
lea ecx, [esi + 0xe4]
call fcn.1000190f
lea ecx, [esi + 0xec]
call fcn.1000190f
lea ecx, [esi + 0xf4]
call fcn.1000190f
lea ecx, [esi + 0xfc]
call fcn.1000190f
lea ecx, [esi + 0x104]
call fcn.1000190f
lea ebx, [esi + 0x114]
mov ecx, ebx
call fcn.1000190f
lea ecx, [esi + 0x118]
call fcn.1000190f
lea ecx, [esi + 0x11c]
call fcn.1000190f
lea ecx, [esi + 0x120]
call fcn.1000190f
lea ecx, [esi + 0x124]
call fcn.1000190f
lea ecx, [esi + 0x128]
call fcn.10002e95
lea ecx, [esi + 0x144]
call fcn.10002e95
lea ecx, [esi + 0x160]
call fcn.10002e95
lea ecx, [esi + 0x17c]
call fcn.10002e95
lea ecx, [esi + 0x198]
call fcn.10002e95
lea ecx, [esi + 0x1b4]
call fcn.10002e95
push edi
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 0x2e
call fcn.10050861
mov byte [ebp - 4], 0x2f
push edi
lea ecx, [esi + 0x1fc]
call fcn.10050861
fldz
mov ecx, ebx
fstp dword [esi + 0xe0]
mov byte [ebp - 4], 0x30
mov dword [esi + 4], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
call fcn.10001819
lea ecx, [esi + 0x118]
call fcn.10001819
lea ecx, [esi + 0x11c]
call fcn.10001819
mov ecx, esi
call fcn.1002bd89
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1002cced
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x1f0]
xor esi, esi
inc esi
test eax, eax
push edi
je 0x1002cd4d
mov edi, dword [ebx + 0x424]
add eax, 0x53c
mov esi, edi
mov dword [ebp - 8], edi
mov ecx, eax
and esi, 1
and edi, 4
mov dword [ebp - 4], eax
call fcn.1007c008
test eax, eax
je 0x1002cd44
movsx esi, byte [ebp - 8]
mov ecx, dword [ebp - 4]
and esi, 2
shr esi, 1
call fcn.1007c001
test eax, eax
je 0x1002cd4d
xor eax, eax
test edi, edi
jmp 0x1002cd48
xor eax, eax
test esi, esi
setne al
mov esi, eax
push 0x24
xor edi, edi
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.100ab720
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1c], 2
jae 0x1002cdc8
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002cdb7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push str.MHz
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
cmp eax, edi
jbe 0x1002cdc6
cmp eax, dword [ebx + 0x428]
jae 0x1002cdc8
xor esi, esi
push str.psnetwork.ini
push edi
push str.drawflashesp
push str.vstat
call fcn.100027f5
cmp eax, dword [ebx + 0x42c]
jle 0x1002cde7
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret