joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1060bc1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10cf230]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [0x10f1310], esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x218], ecx
jne 0x1060c01
push ecx
push dword [ebp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, eax
jmp 0x1060c8d
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push 0x105
lea ecx, [ebp - 0x214]
push ecx
push 0xffffffffffffffff
push eax
push esi
push esi
call edi
test eax, eax
je 0x1060c82
push esi
push esi
push 4
lea eax, [ebp - 0x21c]
push eax
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
test eax, eax
je 0x1060c82
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, esi
mov ebx, eax
je 0x1060c82
push 0x104
push dword [ebp - 0x218]
lea eax, [ebp - 0x10c]
push 0xffffffffffffffff
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1060c86
xor eax, eax
jmp 0x1060c8f
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01041c5f
leave
ret

Function at 0x1060ca1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10f1310], edi
jne 0x1060cbc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1060cf6
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01081f90
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1060cef
or eax, 0xffffffff
jmp 0x1060cf6
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1060d75
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x1060da1
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x100e4b0]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1060d80
not eax
ret
Function at 0x1060de8
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x10cf230]
push esi
push edi
xor esi, esi
mov dword [ebp + 0x188], eax
mov eax, dword [ebp + 0x194]
mov edi, ecx
cmp dword [edi], esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], esi
je 0x1060e31
mov eax, dword [edi + 4]
cmp eax, esi
je 0x1060e31
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1060e3b
mov esi, 0x80004005
jmp 0x1060eea
push esi
push esi
push 0x200
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x80]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, esi
mov dword [ebp - 0x7c], eax
je 0x1060ebf
cmp dword [edi + 8], 0xffffffff
je 0x1060e94
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x1060ebf
mov ecx, dword [ebp - 0x7c]
add eax, ecx
cmp eax, dword [edi + 8]
jbe 0x1060e94
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1060ebf
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1060ebf
push 2
push esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1060ebf
push esi
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x7c]
dec eax
push eax
lea eax, [ebp - 0x78]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1060ee1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1060ed1
call esi
mov esi, eax
jmp 0x1060ee1
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp + 0x188]
pop edi
mov eax, esi
pop esi
call fcn.01041c5f
add ebp, 0x18c
leave
ret 4

Function at 0x1062a6e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1062a83
call edi
mov dword [esi], eax
call edi
sub eax, dword [esi]
pop edi
cmp eax, dword [esp + 8]
pop esi
jb 0x1062a94
xor eax, eax
inc eax
jmp 0x1062aa8
call sub.msvcrt.dll_rand
push 0x64
cdq
pop ecx
idiv ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
ret 8
Function at 0x1079afb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
jne 0x1079b35
cmp ecx, edi
jne 0x1079b35
push 2
pop eax
cmp eax, edi
jne 0x1079b6d
shr ecx, 1
push ecx
call fcn.0104216f
cmp eax, edi
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
je 0x1079b6d
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1079b67
mov al, 1
jmp 0x1079b6f
push ebx
call fcn.01042199
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1079d2b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1079d7d
push edi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
jmp 0x1079d7f
xor al, al
pop esi
leave
ret 0xc

Function at 0x107a61a
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea ecx, [ebp - 0xc]
call fcn.010424ee
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.0107f08b
mov esi, eax
test esi, esi
jl 0x107a682
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x107a682
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x107a660
push 0x57
pop eax
test eax, eax
jg 0x107a66d
call esi
test eax, eax
jne 0x107a680
push 0x57
pop eax
jmp 0x107a680
call esi
test eax, eax
jne 0x107a676
push 0x57
pop eax
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0xc]
call fcn.01042e75
mov eax, esi
pop esi
leave
ret 8
Function at 0x107bde7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x80070005
call fcn.0107e139
push dword [ebp + 8]
lea ecx, [ebp - 0x60]
push 2
call fcn.0107f141
xor ebx, ebx
test eax, eax
jl 0x107be4b
lea ecx, [ebp - 0x60]
call fcn.0107d601
cmp eax, 4
jne 0x107be4b
push 0x1f4
lea eax, [ebp - 0x60]
push eax
call fcn.0107afc9
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x107be50
cmp byte [0x10f2c3c], bl
je 0x107be4b
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x10f2c40
call fcn.0107bc62
cmp dword [ebp - 4], ebx
jge 0x107beca
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 8]
push 0x107a48a
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x107beca
mov ecx, 0x10f2bd4
call fcn.0107a3dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x107bec3
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x107bec3
cmp dword [ebp - 4], ebx
je 0x107bea1
mov dword [ebp - 4], 0x80070005
jmp 0x107bec3
cmp byte [0x10f2c3c], bl
je 0x107bec3
lea ecx, [ebp - 0x60]
call fcn.0107b52e
test al, al
jne 0x107bec3
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x10f2c40
call fcn.0107bc62
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x60]
call fcn.0104163c
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x107bf88
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.0107b3a2
push dword [ebp + 8]
lea esi, [edi + 0x2c]
push esi
mov ecx, edi
call fcn.0107b72e
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x107c024
cmp byte [ebp + 0xc], 0
je 0x107c020
mov ecx, edi
call fcn.0107b3bf
lea ecx, [ebp - 0x10]
call fcn.010424ee
lea ecx, [ebp - 0x6c]
call fcn.0107e139
push dword [ebp + 8]
lea ecx, [ebp - 0x6c]
call fcn.0107f7dd
push ebx
push 0x1002298
lea ecx, [ebp - 0x6c]
call fcn.0107e578
mov esi, eax
test esi, esi
jl 0x107c00c
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x6c]
call fcn.0107f08b
mov esi, eax
test esi, esi
jl 0x107c00c
push dword [ebp - 0x10]
call fcn.0107bde7
mov esi, eax
lea ecx, [ebp - 0x6c]
call fcn.0104163c
lea ecx, [ebp - 0x10]
call fcn.01042e75
mov eax, esi
jmp 0x107c08c
xor edi, edi
jmp 0x107c082
push ebx
mov ecx, esi
call fcn.0107b465
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x208]
mov ecx, 0x10f2bd4
mov edi, eax
call fcn.0107a3c0
cmp edi, eax
mov ecx, esi
push ebx
jb 0x107c077
call fcn.0107b465
push eax
call fcn.0107bde7
mov edi, eax
test edi, edi
jge 0x107c082
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ecx, esi
mov edi, eax
call fcn.0107b465
mov dword [eax + 0x208], edi
push ebx
mov ecx, esi
call fcn.0107b465
mov edi, dword [eax + 0x20c]
mov ecx, dword [ebp - 4]
call fcn.0107b3bf
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x107c10a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.010424ee
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0
call fcn.0107f08b
test eax, eax
jl 0x107c197
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0107c098
test eax, eax
jl 0x107c192
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x107c183
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x107c175
call esi
jmp 0x107c185
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x107c185
xor eax, eax
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0107bd64
pop esi
push ebx
call edi
pop edi
pop ebx
lea ecx, [ebp - 0x14]
call fcn.01042e75
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x107cefb
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10cf230]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x101c328]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x101c32c]
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_towupper]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], bx
call esi
cmp eax, 5
jne 0x107cf65
and dword [ebp - 0x10], 0
push 0x41
pop edi
cmp bx, di
jbe 0x107cf69
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], di
call esi
cmp eax, 5
jne 0x107cf5d
inc dword [ebp - 0x10]
inc edi
cmp di, bx
jb 0x107cf4b
jmp 0x107cf69
or dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
call fcn.01041c5f
leave
ret 4
Function at 0x107d2e8
Capabilities:
Check os version
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10cf230]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], eax
call fcn.010424ee
xor ebx, ebx
cmp esi, ebx
je 0x107d4a3
mov si, word [esi]
cmp si, 0x41
jb 0x107d32a
cmp si, 0x5a
ja 0x107d32a
movzx edi, si
sub edi, 0x40
jmp 0x107d330
movzx edi, si
sub edi, 0x60
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jge 0x107d3c6
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push ebx
push 0x101c374
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x107d46e
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x34]
push ecx
push 0x1c
lea ecx, [ebp - 0x5c]
push ecx
push 0x1c
push ecx
inc esi
push esi
push eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x860
mov dword [ebp - 0x50], 0x440d
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x107d3a8
test byte [ebp - 0x44], 1
jne case.default.0x107d3a8
movzx eax, byte [ebp - 0x2b]
cmp eax, 9
ja case.default.0x107d3a8
jmp dword [eax*4 + 0x107d4c3]
mov esi, 0x320
jmp case.0x107d3a8.5
xor esi, esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x107d46e
lea eax, [edi + 0x40]
push eax
lea eax, [ebp - 0x40]
push 0x101c364
push eax
call fcn.01043352
add esp, 0xc
test eax, eax
jl 0x107d46c
push ebx
push ebx
push 3
push ebx
push 2
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x107d472
push ebx
lea ecx, [ebp - 0x34]
push ecx
push 0x1e0
lea ecx, [ebp - 0x23c]
push ecx
push ebx
push ebx
push 0x70c00
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x107d3a8
cmp dword [ebp - 0x34], ebx
jbe case.default.0x107d3a8
mov eax, dword [ebp - 0x234]
xor esi, esi
inc esi
cmp eax, esi
je case.0x107d3a8.0
jle case.default.0x107d3a8
cmp eax, 5
jle case.0x107d3a8.2
cmp eax, 0xa
jle case.0x107d3a8.0
cmp eax, 0xb
je case.0x107d3a8.6
cmp eax, 0xc
jne case.default.0x107d3a8
jmp case.0x107d3a8.5
push 2
pop esi
jmp case.0x107d3a8.5
mov esi, 0x15e
jmp case.0x107d3a8.5
mov esi, 0x20d
jmp case.0x107d3a8.5
xor esi, esi
cmp esi, ebx
jne 0x107d4a5
add edi, 0x40
push edi
lea eax, [ebp - 0x40]
push 0x101c358
push eax
call fcn.01043352
add esp, 0xc
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 2
pop esi
cmp eax, esi
je 0x107d4a5
cmp eax, 3
je 0x107d4be
jbe 0x107d4a3
cmp eax, 6
jbe 0x107d4a5
xor esi, esi
lea ecx, [ebp - 0x40]
call fcn.01042e75
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.01041c5f
leave
ret 4
xor esi, esi
inc esi
jmp 0x107d4a5
Function at 0x107d601
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.010424ee
push 0x101c278
mov ecx, esi
call fcn.0107ce25
test al, al
je 0x107d6cf
push dword [esi + 0x28]
call fcn.010b1fab
test al, al
je 0x107d645
mov dword [ebp - 4], 4
jmp 0x107d6e6
mov eax, dword [esi + 0x28]
xor bl, bl
xor ecx, ecx
test eax, eax
je 0x107d656
cmp word [eax], cx
setne cl
test cl, cl
je 0x107d67f
mov eax, dword [esi + 0x28]
movzx cx, byte [eax]
cmp cx, word [eax]
jne 0x107d67f
mov bl, byte [eax]
movzx eax, bl
mov al, byte [eax + 0x10f30e8]
test al, al
jbe 0x107d67f
movzx eax, al
test eax, eax
mov dword [ebp - 4], eax
jne 0x107d6e6
mov eax, dword [esi + 0x28]
push 3
push eax
lea ecx, [ebp - 0x10]
call fcn.01042ec9
test eax, eax
jl 0x107d6e6
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov dword [ebp - 4], eax
jne 0x107d6c1
push dword [ebp - 0x10]
mov ecx, esi
call fcn.0107d2e8
cmp eax, 0x15e
je 0x107d6ba
cmp eax, 0x20d
jne 0x107d6c1
mov dword [ebp - 4], 0x80
mov cl, byte [ebp - 4]
movzx eax, bl
mov byte [eax + 0x10f30e8], cl
jmp 0x107d6e6
push 0x101c2a4
mov ecx, esi
call fcn.0107ce25
test al, al
je 0x107d6e6
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.01042e75
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x107f904
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10cf230]
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x118]
push eax
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x107f954
cmp dword [ebp - 0x108], 2
jne 0x107f954
cmp dword [ebp - 0x114], 5
ja 0x107f952
jne 0x107f954
cmp dword [ebp - 0x110], ebx
jbe 0x107f954
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
call fcn.01041c5f
leave
ret

Function at 0x107f98b
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.010424ee
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x107f9b8
mov dword [ebp - 4], 0x80004003
jmp 0x107fa70
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x107f9ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x107f9de
push 0x57
pop eax
cmp eax, ebx
jle 0x107f9ea
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x107fa6e
jbe 0x107fa6e
push edi
call fcn.010420ba
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x107fa67
mov esi, dword [esi]
push eax
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x107f9cf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x10023c0
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x107f9cf
cmp dword [ebp + 0xc], ebx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea eax, [ebp - 0x20]
je 0x107fa4c
push 0x101c680
jmp 0x107fa51
push 0x101c668
push eax
call fcn.01043352
add esp, 0x18
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
call fcn.010429a5
jmp 0x107fa6e
mov dword [ebp - 4], 0x8007000e
pop edi
pop esi
lea eax, [ebp - 0xc]
push eax
call fcn.01042113
lea ecx, [ebp - 0x20]
call fcn.01042e75
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0xc
Function at 0x108048f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.010424ee
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x10804b8
mov ebx, 0x80004003
jmp 0x10805e9
push 0x105
lea ecx, [ebp - 0x1c]
call fcn.01043096
mov ebx, eax
cmp ebx, esi
jl 0x10805e9
mov esi, dword [ebp - 0x1c]
push edi
mov edi, dword [0x10f0184]
lea ecx, [ebp - 0x1c]
call fcn.010425be
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1080523
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x10804ff
push 0x57
pop eax
test eax, eax
jg 0x1080511
call esi
test eax, eax
jne 0x108050a
push 0x57
pop eax
mov ebx, eax
jmp 0x10805e8
call esi
test eax, eax
jne 0x10805d4
push 0x57
pop eax
jmp 0x10805d4
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov word [eax + 0x208], di
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jbe 0x10805e8
push esi
call fcn.010420ba
cmp eax, edi
mov dword [ebp - 8], eax
je 0x10805e3
push eax
push esi
push edi
push dword [ebp - 0x1c]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10805bf
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0x10023c0
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10805bf
cmp dword [ebp + 8], edi
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea eax, [ebp - 0x1c]
je 0x10805a4
push 0x101c680
jmp 0x10805a9
push 0x101c668
push eax
call fcn.01043352
add esp, 0x18
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.010429a5
jmp 0x10805e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x10805ce
push 0x57
pop eax
cmp eax, edi
jle 0x108050a
and eax, 0xffff
or eax, 0x80070000
jmp 0x108050a
mov ebx, 0x8007000e
pop edi
lea eax, [ebp - 8]
push eax
call fcn.01042113
lea ecx, [ebp - 0x1c]
call fcn.01042e75
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x108062c
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
jne 0x108064d
mov esi, 0x80004005
jmp 0x1080701
push edi
lea eax, [ebp - 0xc]
push eax
mov esi, 0x101cc24
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x108066d
mov esi, 0x80004005
jmp 0x1080700
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x1080682
mov esi, 0x8007000e
jmp 0x1080700
push eax
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10806c4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jne 0x10806a0
push 0x57
pop eax
cmp eax, ebx
jg 0x10806af
call esi
cmp eax, ebx
jne 0x10806ab
push 0x57
pop eax
mov esi, eax
jmp 0x10806f7
call esi
cmp eax, ebx
jne 0x10806b8
push 0x57
pop eax
and eax, 0xffff
or eax, 0x80070000
jmp 0x10806ab
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0x1008648
push dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x10806ea
mov esi, 0x80004005
jmp 0x10806f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
mov dword [ecx], eax
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x108070e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push eax
push 0x101cc3c
push dword [ebp + 8]
call fcn.01043352
add esp, 0xc
pop ebp
ret 4