joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8916f9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
call fcn.00891303
push dword [0x82e644]
call fcn.00897c18
push dword [0x82db98]
call fcn.00897ba9
mov dword [ebp - 4], eax
mov edi, 0x82d69c
cmp dword [0x82e254], 1
jne 0x89173d
mov dword [edi], 0x20205042
add edi, 3
jmp 0x89179a
cmp dword [0x82e254], 2
jne 0x89175c
mov dword [edi], 0x50455453
mov byte [edi + 4], 0x20
add edi, 5
jmp 0x89179a
cmp dword [0x82e254], 3
jne 0x891777
mov dword [edi], 0x20205057
add edi, 3
jmp 0x89179a
cmp dword [0x82e254], 4
jne 0x89179a
mov dword [edi], 0x45435845
mov dword [edi + 4], 0x4f495450
mov word [edi + 8], DialogBoxIndirectParamA
add edi, 0xa
cmp dword [0x47b76c], 0
jne 0x8917f8
call fcn.00897d1c
mov eax, dword [0x82e640]
cmp eax, dword [0x82d714]
jne 0x8917df
cmp dword [ebp - 4], 1
jne 0x8917da
cmp byte [0x82d710], 1
jne 0x8917da
call fcn.0088fad6
jmp 0x8918e5
jmp 0x8917e4
mov dword [0x82d714], eax
mov al, 0x5b
stosb byte es:[edi], al
mov esi, dword [0x82e6a0]
cmp byte [esi], 0
je 0x8917f5
movsb byte es:[edi], byte [esi]
jmp 0x8917ed
mov al, 0x5d
stosb byte es:[edi], al
cmp dword [0x47b76c], 0
jne 0x891808
push 1
call fcn.00890421
cmp dword [0x82e25c], 0
je 0x891825
push esi
mov esi, dword [0x82e25c]
mov byte [edi], 0x20
inc edi
cmp byte [esi], 0
je 0x891824
movsb byte es:[edi], byte [esi]
jmp 0x89181c
pop esi
mov byte [edi], 0
push 0x82d69c
push 0
push 0xc
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 8]
call fcn.0088f45b
push dword [ebp + 8]
call fcn.0088f941
push dword [ebp + 8]
call fcn.0088f9b2
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_IsIconic]
cmp eax, 1
jne 0x891871
push 9
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push 0x404
push dword [0x82d614]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x82e254], 3
jne 0x8918c8
push 0
push dword [0x82e258]
push 0x405
push dword [0x82d60c]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x47b76c], 0
je 0x8918d6
call fcn.0089300c
mov dword [0x82d694], 0
mov eax, 0
mov esp, ebp
pop ebp
ret 4

Function at 0x8918eb
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov dword [0x82d728], 1
mov dword [0x82d730], 1
cmp dword [0x82e238], 1
jne 0x891919
call fcn.0088fad6
jmp 0x891966
push 0x1388
push dword [0x82ddb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x89195c
push 0x30
push str.Critical_error
push str.The_debugger_thread_does_not_respond.__r_nThis_should_not_happen__The_thread_is_now_terminated_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0089722c
push 0
push dword [0x82ddb8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x82ddb8], 0
mov esp, ebp
pop ebp
ret
Function at 0x89196a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
pop dword [0x82d718]
cmp dword [0x819220], 0
je 0x89198d
push 0
push dword [0x819220]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x82d690], 1
mov dword [0x82d68c], 0
mov dword [0x82d728], 0
mov dword [0x82d730], 0
mov dword [0x82d724], 1
mov dword [0x82d72c], 0
push 0x82d6fc
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push word [0x82d704]
pop word [0x82d738]
push word [0x82d708]
pop word [0x82d73a]
push 0x82d6fc
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [0x82d704]
mov edi, dword [0x82d708]
push 0x82d6fc
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x82d6fc]
sub dword [0x82d704], eax
sub esi, dword [0x82d704]
mov dword [0x82d6fc], esi
mov eax, dword [0x82d700]
sub dword [0x82d708], eax
cmp edi, dword [0x82d708]
jbe 0x891a4e
mov dword [0x82d708], edi
mov dword [0x82d700], 0
push 0x82d6fc
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push 1
push dword [0x82d708]
push dword [0x82d704]
push dword [0x82d700]
push dword [0x82d6fc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 6
push 0x47a1d0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableA]
mov dword [0x82d698], eax
mov eax, dword [0x81a568]
cmp eax, 0
je 0x891aaf
mov dword [0x82d73c], eax
jmp 0x891adc
push 0x46ac51
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0x190
push 0
push 0
push 4
push 8
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x82d73c], eax
call fcn.0088fb4f
push dword [ebp + 8]
call fcn.0088ef90
push dword [ebp + 8]
call fcn.0088f52c
call fcn.00890aaf
call fcn.0089053f
push dword [ebp + 8]
call fcn.00891164
push str.Running_...
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00894815
call fcn.00891351
mov eax, 0
mov esp, ebp
pop ebp
ret 4
Function at 0x892017
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, 0x28
jne 0x892073
cmp eax, 0xfffffdd9
jne 0x892069
push 0
push 0
push 0x130b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6e0], 8
push 0x82d6e0
push eax
push 0x1305
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 8]
call fcn.0088f45b
mov eax, 0
jmp 0x892145
cmp edx, 0xc8
jne 0x892109
cmp eax, 0xfffffdd9
jne 0x8920ff
push 0
push 0
push 0x130b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0
jne 0x8920a8
mov edi, dword [0x82d60c]
jmp 0x8920da
cmp eax, 1
jne 0x8920b5
mov edi, dword [0x82d610]
jmp 0x8920da
cmp eax, 2
jne 0x8920c2
mov edi, dword [0x82cb1c]
jmp 0x8920da
cmp eax, 3
jne 0x8920cf
mov edi, dword [0x82c9f8]
jmp 0x8920da
cmp eax, 4
jne 0x8920da
mov edi, dword [0x82c99c]
push 0
push dword [0x82d614]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x82d614], edi
push dword [ebp + 8]
call fcn.0088fa65
mov eax, 0
jmp 0x892145
cmp edx, 0x14b
jne 0x892125
push eax
call fcn.00890e97
mov eax, 0
jmp 0x892145
cmp edx, 0x14d
jne 0x892140
push dword [ebx + 0xc]
push eax
push ebx
call fcn.008902e2
jmp 0x892145
mov eax, 0
mov esp, ebp
pop ebp
ret 8

Function at 0x89394d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, 4
and eax, 0xfffffffc
sub esp, eax
mov edi, esp
push 0
push 0x82c890
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + edi], 0
push edi
push 0xffffffffffffffff
push 0x14c
push dword [0x82d7dc]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x14e
push dword [0x82d7dc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x8939ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], esp
mov dword [ebp - 0xc], 0x614c614c
push 0
push 0
push 0x147
push dword [0x82d7dc]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x8939da
jmp 0x893a39
mov ebx, eax
push 0
push ebx
push 0x149
push dword [0x82d7dc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 8], eax
add eax, 4
and eax, 0xfffffffc
sub esp, eax
mov edi, esp
push edi
push ebx
push 0x148
push dword [0x82d7dc]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x82c890
push 8
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x82c890
push dword [ebp - 8]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4
Function at 0x895484
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x47b6e4], 1
jne 0x895495
jmp 0x895501
call fcn.00897e5e
mov dword [0x82e7ec], 0x94
push 0x82e7ec
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x82e7fc], 1
jne 0x8954cc
mov dword [0x47b9f8], 0
mov dword [0x47b9fc], 0xbfffffff
call fcn.00892206
push 0x82ddb4
push 0
push 0
push 0x89553a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0
jne 0x8954fa
push str.Debugger:_CreateThread__Resource_Manager_
call fcn.0088d416
jmp 0x895501
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x89571c
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x82dddc
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [0x82de08], 0
mov esi, 0x5098a4
mov edi, 0x82df24
cmp byte [esi], 0
je 0x895750
movsb byte es:[edi], byte [esi]
jmp 0x895748
cmp byte [edi], 0x5c
je 0x895756
dec edi
cmp byte [edi], 0x5c
je 0x895761
mov byte [edi], 0
dec edi
jmp 0x895756
inc edi
sub edi, 0x82df24
mov dword [0x82e12c], edi
push 0x82df24
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [str..EXE.EXE.SCR.DLL.SYSTest.a], 0x4c4c442e
jne 0x8957a8
push 0x47b71c
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp eax, 0
jne 0x89579a
jmp 0x895890
movzx eax, word [0x47b754]
mov dword [0x82e12c], eax
jmp 0x8957c6
mov edi, 0x82e028
mov esi, 0x5098a4
cmp byte [esi], 0
je 0x8957ba
movsb byte es:[edi], byte [esi]
jmp 0x8957b2
push dword [str..EXE.EXE.SCR.DLL.SYSTest.a]
pop dword [edi]
mov byte [edi + 4], 0
add dword [0x82e12c], 0x82e028
call fcn.0088d0d7
mov dword [0x82e130], eax
mov edi, 0x82e134
mov ecx, 0x104
mov al, 0x22
stosb byte es:[edi], al
dec ecx
mov esi, 0x82e028
cmp byte [esi], 0
je 0x8957f6
movsb byte es:[edi], byte [esi]
dec ecx
jmp 0x8957ed
mov ax, 0x2022
stosw word es:[edi], ax
sub ecx, 2
mov esi, dword [0x82e130]
cmp esi, 0
je 0x89581a
cmp byte [esi], 0
je 0x89581a
cmp ecx, 1
jne 0x895816
jmp 0x89581a
movsb byte es:[edi], byte [esi]
dec ecx
jmp 0x89580a
mov byte [edi], 0
push 0x82ddcc
push 0x82dddc
push 0x82df24
push 0
push 3
push 0
push 0
push 0
push 0x82e134
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
cmp eax, 0
jne 0x895870
push str.Debugger:_CreateProcess
call fcn.0088d416
cmp eax, 0x10b
jne 0x895870
push 0
push str.Directory_is:
push 0x82df24
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x82c88c], 0
je 0x89588d
mov eax, dword [0x82c88c]
call fcn.0084b661
mov dword [0x82c88c], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x89632e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
movzx eax, word [0x47b2d2]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 4], eax
sub esp, dword [ebp - 4]
mov dword [0x82e3a8], esp
push dword [ebp - 4]
push dword [0x82e3a8]
push dword [0x47b2cc]
call fcn.00897268
push dword [ebp - 4]
push dword [0x82e3a8]
push 0x406
push dword [0x82d718]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x82e3ac], 0
jne 0x8963ff
mov esi, 0x82e028
mov edi, 0x82e3b0
mov ecx, 0x100
cmp byte [esi], 0
je 0x89639f
movsb byte es:[edi], byte [esi]
loop 0x896397
neg ecx
add ecx, 0x100
mov byte [edi], 0
cmp byte [edi], 0x2e
je 0x8963b2
dec edi
loop 0x8963aa
neg ecx
add ecx, 0x100
mov esi, str._dbg.log
cmp byte [esi], 0
je 0x8963c7
movsb byte es:[edi], byte [esi]
loop 0x8963bf
mov byte [edi], 0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x82e3b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x8963fa
push str.HandleDebugString:_CreateFile
call fcn.0088d416
jmp 0x896442
mov dword [0x82e3ac], eax
movzx eax, word [0x47b2d2]
dec eax
push 0
push 0x82c890
push eax
push dword [0x82e3a8]
push dword [0x82e3ac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov word [esp], 0xa0d
push 0
push 0x82c890
push 2
push dword [0x82e3a8]
push dword [0x82e3ac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x897764
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [0x82e60c]
mov ecx, dword [0x82e610]
mov ebx, dword [0x82db98]
dec ebx
cmp ecx, 0
jne 0x897786
jmp 0x897815
cmp dword [esi], ebx
je 0x897796
add esi, 8
dec ecx
je 0x897815
jmp 0x897786
cmp byte [esi + 4], 4
jne 0x8977d5
lea eax, [esi + 7]
push 1
push eax
push ebx
call fcn.008972d2
cmp byte [esi + 6], 0
je 0x8977be
movzx eax, byte [esi + 6]
push eax
call fcn.0089782b
jmp 0x8977c4
push ebx
call fcn.0089760e
dec dword [0x82db98]
dec dword [0x82e644]
jmp 0x897810
cmp byte [esi + 4], 2
jne 0x897810
lea eax, [esi + 7]
push 1
push eax
push ebx
call fcn.008972d2
mov byte [esi + 5], 2
cmp byte [0x82d724], 1
jne 0x8977fe
mov dword [0x82e614], esi
cmp byte [esi + 7], 0xcc
je 0x897810
dec dword [0x82db98]
dec dword [0x82e644]
jmp 0x897825
push 0
push dword [0x82d724]
push 0
push ebx
call fcn.00897593
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x897863
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x82dae0], 0x1003f
push 0x82dae0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push dword [0x82db98]
call fcn.00897ba9
cmp eax, 1
jne 0x8978b1
push 0
push 1
push 4
push dword [0x82db98]
call fcn.00897593
jmp 0x8978cd
push dword [0x82dba4]
call fcn.00897176
cmp eax, 0
je 0x8978cd
push 0
push 1
push 4
push eax
call fcn.00897593
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret 4
Function at 0x89805e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x82c890
push 2
push str._r_nExx12345678_r_nWin32_Data_Types
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4
Function at 0x89807e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push str.crash.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x8982f6
mov edi, str.__RosAsm__The_Bottom_Up_Assembler__V.2.053d_
call fcn.0084a357
mov edx, str.__RosAsm__The_Bottom_Up_Assembler__V.2.053d_
add edx, 2
sub eax, 2
push 0
push 0x82c890
push eax
push edx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call fcn.0089805e
call fcn.0089850e
mov edi, 0x82e6ec
call fcn.0084a357
push 0
push 0x82c890
push eax
push 0x82e6ec
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call fcn.0089805e
push dword [ebp - 4]
call fcn.0089805e
mov edi, 0x47bbcc
call fcn.0084a357
push 0
push 0x82c890
push eax
push 0x47bbcc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call fcn.0089805e
push dword [ebp - 4]
call fcn.0089805e
mov ebx, dword [ebp + 0xc]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5841
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xb0]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5842
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xa4]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5843
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xac]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5844
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xa8]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x4953
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xa0]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x4944
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0x9c]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5042
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xb4]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x47bd5a
mov word [edi + 1], 0x5053
add edi, 4
mov ecx, 4
mov edx, dword [ebx + 0xc4]
call fcn.00894421
push 0
push 0x82c890
push 0xe
push 0x47bd5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x89838a
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov esi, 0
mov dword [0x82e7ec], 0x9c
push 0x82e7ec
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, 1
jne 0x89844a
cmp word [0x82e886], 1
jne 0x8983f9
cmp dword [0x82e7f0], 4
jne 0x8983d8
mov esi, str.Workstation_4.0
jmp 0x8983f4
mov ax, word [0x82e884]
and ax, 0x200
cmp ax, 0
je 0x8983ef
mov esi, str.Home_Edition
jmp 0x8983f4
mov esi, str.Professional
jmp 0x898445
cmp dword [0x82e7f0], 5
jne 0x898429
cmp dword [0x82e7f4], 2
jne 0x898416
call fcn.008982fc
jmp 0x898424
cmp dword [0x82e7f4], 0
jne 0x898424
call fcn.0089832c
jmp 0x898445
mov ax, word [0x82e884]
and ax, 2
cmp ax, 0
je 0x898440
mov esi, str.Server_4.0_Enterprise
jmp 0x898445
mov esi, str.Server_4.0
jmp 0x8984ea
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
je 0x89846c
jmp 0x8984ea
mov dword [0x82e8d8], 0x50
push 0x82e8d8
push 0x82e888
push 0
push 0
push str.ProductType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0
je 0x89849c
jmp 0x8984ea
cmp dword [0x82e8d8], 0x50
jbe 0x8984aa
jmp 0x8984ea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x82e888], 0x4e4e4957
jne 0x8984c6
mov esi, str.Workstation
jmp 0x8984ea
cmp dword [0x82e888], 0x4d4e414c
jne 0x8984d9
mov esi, str.Server
jmp 0x8984ea
cmp dword [0x82e888], 0x56524553
jne 0x8984ea
mov esi, str.Advanced_Server
mov esp, ebp
pop ebp
ret
Function at 0x89850e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov dword [0x82e7ec], 0x94
push 0x82e7ec
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x82e6ec
cmp dword [0x82e7fc], 2
jne 0x8985dd
cmp dword [0x82e7f0], 5
jne 0x898578
cmp dword [0x82e7f4], 2
jne 0x898555
mov esi, str.MS_Windows_Server_2003
jmp 0x898573
cmp dword [0x82e7f4], 1
jne 0x898565
mov esi, str.MS_Windows_XP
jmp 0x898573
cmp dword [0x82e7f4], 0
jne 0x898573
mov esi, str.MS_Windows_2000
jmp 0x89858a
cmp dword [0x82e7f0], 4
ja 0x89858a
mov esi, str.MS_Windows_NT
cmp byte [esi], 0
je 0x898592
movsb byte es:[edi], byte [esi]
jmp 0x89858a
mov al, 0x20
stosb byte es:[edi], al
mov esi, 0x82e800
cmp byte [esi], 0
je 0x8985a2
movsb byte es:[edi], byte [esi]
jmp 0x89859a
call fcn.0089834a
mov esi, str._Build
cmp byte [esi], 0
je 0x8985b4
movsb byte es:[edi], byte [esi]
jmp 0x8985ac
movzx eax, word [0x82e7f8]
call fcn.008984ee
mov al, 0x20
stosb byte es:[edi], al
call fcn.0089838a
cmp esi, 0
je 0x8985d8
cmp byte [esi], 0
je 0x8985d5
movsb byte es:[edi], byte [esi]
jmp 0x8985cd
mov al, 0x20
stosb byte es:[edi], al
jmp 0x89867c
cmp dword [0x82e7fc], 1
jne 0x898662
cmp dword [0x82e7f0], 4
jne 0x89865d
mov eax, 0
cmp dword [0x82e7f4], 0x5a
jne 0x89860c
mov esi, str.MS_Windows_ME
jmp 0x898654
cmp dword [0x82e7f4], 0xa
jne 0x89862a
mov esi, str.MS_Windows_98
cmp byte [0x82e801], 0x41
jne 0x898628
mov eax, 0x455320
jmp 0x898654
cmp dword [0x82e7f4], 0
jne 0x898654
mov esi, str.MS_Windows_95
cmp byte [0x82e801], 0x42
jne 0x898646
mov eax, 0x3252534f
cmp byte [0x82e801], 0x43
jne 0x898654
mov eax, 0x3252534f
cmp byte [esi], 0
je 0x89865c
movsb byte es:[edi], byte [esi]
jmp 0x898654
stosd dword es:[edi], eax
jmp 0x89867c
cmp dword [0x82e7fc], 0
jne 0x89867c
mov esi, str.MS_Win32s
cmp byte [esi], 0
je 0x89867c
movsb byte es:[edi], byte [esi]
jmp 0x898674
mov byte [edi], 0
mov esp, ebp
pop ebp
ret

Function at 0x8986b7
Capabilities:
Create process on windows

Disassembly:
call fcn.0086fdad
push 1
push 0
push 0x813c64
push str.WordPad
push str.open
push dword [0x8187e4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x898c2f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [0x82e9cc]
cmp byte [eax], 0
jbe 0x898c3c
inc eax
jmp 0x898c34
sub eax, dword [0x82e9cc]
cmp eax, 0
jne 0x898c48
ret
mov dword [0x845b04], eax
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x898cd8
call dword [sym.imp.USER32.dll_EmptyClipboard]
cmp eax, 0
je 0x898cd2
mov ecx, dword [0x845b04]
shl ecx, 2
push ecx
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, 0
jne 0x898c92
pop eax
jmp 0x898cd2
mov dword [0x818bfc], eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
pop ecx
shr ecx, 2
mov edi, eax
mov esi, dword [0x82e9cc]
cmp byte [esi], 0
jbe 0x898cb2
movsb byte es:[edi], byte [esi]
jmp 0x898caa
mov eax, 0
stosd dword es:[edi], eax
push dword [0x818bfc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x818bfc]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
ret
Function at 0x898f43
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x841158], 0
jne 0x898f68
push 0x1000
push str.Arghhh___...
push str.No_RC_Data_Resources_in_this_PE
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
mov dword [0x82bc00], 0x841158
mov dword [0x82bc04], 0
add dword [0x82bc00], 4
push 0
push 0x899965
push 0
push 0x3e8
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x845a2c], eax
cmp byte [0x82bc04], 0
jne 0x899033
call fcn.008990ff
call fcn.00899127
call fcn.0088bfc5
push 0x841158
push 0x88c00c
push dword [0x8187e4]
push 0x47926c
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp dword [0x82bc04], 0x1b
jne 0x898ff6
jmp 0x8990fe
cmp dword [0x82bc00], 0x841158
jae 0x899017
add dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x89902e
mov esi, dword [0x82bc00]
cmp dword [esi], 0
jne 0x89902e
sub dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x898fa2
push 0x1024
push str.Are_you_sure...
push str.Save_this_RC_Resource_to_Disk_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
push eax
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
pop eax
cmp eax, 6
jne 0x8990fe
mov dword [str.RosAsm_Dialog_Template], 0x478fbf
push 0x478fd8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [str.RosAsm_Dialog_Template], 0x478fa0
cmp eax, 0
jne 0x89908c
ret
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x82b3c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x8990b9
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x4319b8], eax
mov dword [0x4319c0], 0
mov esi, dword [0x82bc00]
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push 0
push 0x4319c0
push ecx
push esi
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b8], 0
ret