joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10085a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f7f11
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov ecx, 0x10146148
call fcn.100e3445
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test eax, eax
je 0x10085bdc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push str.RegCloseKey
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x10085bdc
cmp dword [ebp - 0x84], 0
je 0x10085bdc
test esi, esi
je 0x10085bdc
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.100a6670
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x10085bc6
lea ecx, [ebp - 0x78]
call fcn.10005c90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.1009b3b0
add esp, 0xc
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x60], 0x14
cmovae eax, dword [ebp - 0x78]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x7c]
movups xmmword [ebp - 0x5c], xmm0
call dword [ebp - 0x84]
test eax, eax
jne 0x10085bad
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x78]
call fcn.10003460
mov byte [ebp - 4], 1
mov byte [ebp - 4], 1
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.100a6820
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 4
Function at 0x10085c00
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x114], eax
mov ecx, 0x10146148
call fcn.100e3445
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10085c66
cmp dword [esp + 4], 6
jb 0x10085c66
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.100e0d24
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.100e0d24
add esp, 0x118
ret
Function at 0x10086550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x244]
push edi
mov edi, ecx
mov ecx, 0x10146148
call fcn.100e3445
test ebx, ebx
je 0x100866a8
mov eax, dword [edi]
test eax, eax
je 0x100866a8
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100866a8
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x208
cmp dword [esi + 0x14], 8
jb 0x100865d5
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
call edi
lea eax, [esp + 0x34]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100865f0
sub eax, edx
lea ecx, [ebp + 0x38]
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10003530
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push ebx
call edi
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10086632
sub ecx, edx
lea eax, [esp + 0x34]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x50]
call fcn.10003530
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push ebx
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call edi
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e0d24
add esp, 0x230
ret 0xc
Function at 0x1008a460
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f89af
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, 0x10146148
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
call fcn.100e3445
push 0
push 0x25
mov ecx, esi
call fcn.100565e0
push esi
cmp eax, 0xffffffff
jne 0x1008a4d0
mov ecx, edi
call fcn.1001af80
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
jmp 0x1008a5c1
lea ecx, [ebp - 0x28]
call fcn.1001af80
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1008a4e9
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x1008a520
push esi
mov ecx, edi
call fcn.1001af80
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.10003460
mov dword [ebp - 4], ebx
jmp 0x1008a5ba
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e1947
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x1008a547
mov esi, dword [esi]
lea ecx, [ebx + 1]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x1008a589
cmp eax, ebx
ja 0x1008a589
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008a570
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10003530
push esi
call fcn.100e0d73
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10018490
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10003460
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 8
Function at 0x1008b340
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f8d14
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x10146148
call fcn.100e3445
push 0x208
lea eax, [ebp - 0x264]
mov dword [ebp - 0x5c], 0x61004d
push 0
push eax
mov dword [ebp - 0x58], 0x720063
mov ebx, 0x6c
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.10003030
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10003030
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c8]
push eax
lea edx, [ebp - 0x2b0]
lea ecx, [ebp - 0x294]
call fcn.100a0bd0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b0]
call fcn.10003460
mov byte [ebp - 4], 3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x294]
call fcn.1009bbc0
test al, al
jne 0x1008b4b4
xor bl, bl
jmp 0x1008b511
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.100a5e00
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
jne 0x1008b4d7
xor bl, bl
jmp 0x1008b4fa
lea eax, [ebp - 0x27c]
cmp esi, eax
je 0x1008b4f8
cmp dword [ebp - 0x268], 8
push ecx
cmovae eax, dword [ebp - 0x27c]
mov ecx, esi
push eax
call fcn.10003530
mov bl, 1
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x27c]
call fcn.10003460
mov byte [ebp - 4], 8
mov byte [ebp - 4], 8
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x294]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 4
Function at 0x10094dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov ecx, 0x101451e1
push edi
call fcn.100e3445
cmp dword [ebx + 0x38], 0
je 0x10094df8
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10094e1a
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10094e1c
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10094ea1
jg 0x10094e31
test esi, esi
je 0x10094ea1
test ecx, ecx
jl 0x10094e7a
jg 0x10094e3b
test eax, eax
je 0x10094e7a
cmp edi, ecx
jg 0x10094e4f
jl 0x10094e45
cmp esi, eax
jae 0x10094e4f
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10094e7d
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10094ea1
jg 0x10094e87
test esi, esi
je 0x10094ea1
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10094ea1
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10094ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x101451e1
call fcn.100e3445
cmp dword [edi + 0x38], 0
je 0x10094ef8
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10094f1a
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10094f1c
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10094fbc
jg 0x10094f39
test esi, esi
je 0x10094fbc
test ecx, ecx
jl 0x10094f86
jg 0x10094f43
test eax, eax
je 0x10094f86
cmp ebx, ecx
jg 0x10094f57
jl 0x10094f4d
cmp esi, eax
jae 0x10094f57
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10094f8d
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10094fbc
jg 0x10094f97
test esi, esi
je 0x10094fbc
cmp dword [edi + 0x4c], 0
je 0x10094fbc
mov ecx, edi
call fcn.100962b0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10095370
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov esi, ecx
mov ecx, 0x101451e1
call fcn.100e3445
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
jne 0x100953aa
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100953dd
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100953dd
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100954e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10095406
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1009543b
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100954e3
cmp eax, 1
jle 0x1009549f
cmp eax, 3
jne 0x100954e3
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.10093fc0
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x100954bf
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100954e3
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x100954e3
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e0d24
add esp, 0x30
ret 4
Function at 0x10096320
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x101451e1
push edi
call fcn.100e3445
cmp dword [esi + 0x38], 0
je 0x100963d8
cmp byte [esi + 0x3d], 0
je 0x100963d8
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10096389
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1009639c
sub eax, 1
je 0x100963a0
sub eax, 2
je 0x100963d8
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100963c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10096389
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x28
ret
Function at 0x10099e70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3b22
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x10146148
call fcn.100e3445
mov edi, dword [esi + 8]
test edi, edi
jne 0x10099eb5
xor al, al
jmp 0x10099f67
mov dword [ebp - 0x14], 0
add edi, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edi
je 0x10099ed8
mov eax, dword [edi]
test eax, eax
je 0x10099ed8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x10099f3d
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x100996d0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x10099f83
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x10099f35
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.100998a0
xor bl, bl
mov dword [ebp - 4], 2
test edi, edi
je 0x10099f5e
mov eax, dword [edi]
test eax, eax
je 0x10099f57
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10099f9b
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10099f1f
mov bl, 1
jmp 0x10099f3f

Function at 0x1009a4d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x10146148
push edi
mov edi, dword [esp + 0x14]
call fcn.100e3445
mov eax, dword [esi]
test eax, eax
je 0x1009a53f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1009a53f
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009a51a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009a53f
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100e0d24
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 8
ret 4
Function at 0x1009cf00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov ecx, 0x10146148
call fcn.100e3445
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x1009cf32
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1009cf76
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.100e0d24
add esp, 0x418
ret
cmp eax, 0x208
jae 0x1009cf5e
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1009cf90
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10003530
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x418
ret

Function at 0x1009de90
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
mov ecx, 0x10146148
call fcn.100e3445
push 0x118
lea eax, [esi + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1009dfdc
cmp dword [esi + 4], 6
push edi
ja 0x1009def0
jne 0x1009df78
cmp dword [esi + 8], 2
jb 0x1009df78
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1009df78
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1009df78
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1009df78
movups xmm0, xmmword [0x10114168]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x10114178]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1009df78
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009df78
cmp word [edi + 2], ax
jbe 0x1009df78
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1009dfc3
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1009dfc3
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.100e0d24
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x140
ret