joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004faf2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2aa4
call fcn.10063e20
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1005d3f0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x1004fb44
sub eax, ecx
sar eax, 1
test eax, eax
jle 0x1004fb78
push 0x5c
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x20e]
je 0x1004fb78
mov word [ebp + eax - 0x20c], cx
xor ecx, ecx
mov word [ebp + eax - 0x20a], cx
push esi
push str.iphlpapi.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1005f5b3
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2aa0], eax
test eax, eax
jne 0x1004fbac
xor al, al
jmp 0x1004fcd8
push edi
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004fc97
lea ecx, [ebp - 0x2aa4]
push ecx
lea ecx, [ebp - 0x2a8c]
push ecx
mov dword [ebp - 0x2aa4], 0x2880
call eax
test eax, eax
jne 0x1004fc97
mov dword [ebp - 0x2a98], ebx
lea eax, [ebp - 0x2a94]
sub dword [ebp - 0x2a98], eax
lea esi, [ebp - 0x2a8c]
mov dword [ebp - 0x2a9c], 3
lea eax, [esi + 8]
push eax
call fcn.1004fce9
pop ecx
mov ecx, eax
xor eax, eax
lea edi, [ebp - 0x2a94]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov edx, dword [ebp - 0x2a98]
lea eax, [ebp + edi - 0x2a94]
mov dl, byte [edx + eax]
cmp dl, byte [eax]
jne 0x1004fc3a
inc edi
cmp edi, 6
jb 0x1004fc1e
jmp 0x1004fc52
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x1004fc4a
cmp eax, 0x17
jne 0x1004fc8d
cmp dword [ebp - 0x2a9c], ecx
jle 0x1004fc8d
mov al, byte [esi + 0x194]
mov byte [ebx], al
mov al, byte [esi + 0x195]
mov byte [ebx + 1], al
mov al, byte [esi + 0x196]
mov byte [ebx + 2], al
mov al, byte [esi + 0x197]
mov byte [ebx + 3], al
mov al, byte [esi + 0x198]
mov byte [ebx + 4], al
mov al, byte [esi + 0x199]
mov byte [ebx + 5], al
mov dword [ebp - 0x2a9c], ecx
mov esi, dword [esi]
test esi, esi
jne 0x1004fc05
push dword [ebp - 0x2aa0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
lea edi, [ebp - 0x2a94]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, ebx
lea eax, [ebp - 0x2a94]
xor ecx, ecx
sub esi, eax
pop edi
lea eax, [ebp + ecx - 0x2a94]
mov dl, byte [esi + eax]
cmp dl, byte [eax]
jne 0x1004fce5
inc ecx
cmp ecx, 6
jb 0x1004fcbb
mov al, 1
xor ecx, ecx
test al, al
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005c747
leave
ret
xor al, al
jmp 0x1004fcd1
Function at 0x1004fce9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x120]
push eax
xor ebx, ebx
mov edi, 0x20019
push edi
push ebx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x110], 3
mov dword [ebp - 0x11c], 0x104
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x114], ebx
call esi
test eax, eax
jne 0x1004feb5
push dword [ebp - 0x124]
lea eax, [ebp - 0x108]
push str._sConnection
push 0xffffffffffffffff
push 0x103
push eax
call fcn.1006057d
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
push edi
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x120]
call esi
test eax, eax
jne 0x1004fea9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push str.MediaSubType
push dword [ebp - 0x10c]
call esi
test eax, eax
jne 0x1004fe9d
push 0x104
xor edi, edi
lea eax, [ebp - 0x108]
push ebx
inc edi
push eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], 0x103
call fcn.1005d3f0
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push str.PnpInstanceID
push dword [ebp - 0x10c]
call esi
test eax, eax
jne 0x1004fe9d
cmp dword [ebp - 0x114], edi
jne 0x1004fe87
push 3
mov esi, 0x100b69c0
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10063556
add esp, 0xc
test eax, eax
jne 0x1004fe5d
mov dword [ebp - 0x110], ebx
jmp 0x1004fe9d
cmp dword [ebp - 0x114], edi
jne 0x1004fe87
push 3
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10063556
add esp, 0xc
test eax, eax
je 0x1004fe87
mov dword [ebp - 0x110], 2
jmp 0x1004fe9d
xor eax, eax
cmp dword [ebp - 0x114], 2
setne al
lea eax, [eax + eax + 1]
mov dword [ebp - 0x110], eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x110]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c747
leave
ret
Function at 0x1005058f
Capabilities:
Get storage device properties

Disassembly:
push 0xd64
mov eax, 0x10099116
call fcn.1007684e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 0xd55], bl
mov dword [ebp - 0xd5c], ebx
cmp byte [ebp - 0xd55], bl
jne 0x10050809
push 0x200
lea eax, [ebp - 0x510]
push ebx
push eax
call fcn.1005d3f0
push dword [ebp - 0xd5c]
mov esi, 0xff
push 0x100b69c4
push 0xffffffffffffffff
lea eax, [ebp - 0x510]
push esi
push eax
call fcn.1006241e
add esp, 0x20
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xd60], eax
cmp eax, 0xffffffff
je 0x100507f6
xor eax, eax
lea edi, [ebp - 0xd1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x800
push edi
lea eax, [ebp - 0xd10]
push ebx
push eax
mov dword [ebp - 0xd64], ebx
mov dword [ebp - 0xd1c], ebx
mov dword [ebp - 0xd18], ebx
call fcn.1005d3f0
add esp, 0xc
push ebx
lea eax, [ebp - 0xd64]
push eax
push edi
lea eax, [ebp - 0xd10]
push eax
push 0xc
lea eax, [ebp - 0xd1c]
push eax
push 0x2d1400
push dword [ebp - 0xd60]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100507e4
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.1005d3f0
push esi
lea eax, [ebp - 0x20f]
push ebx
push eax
mov byte [ebp - 0x210], bl
call fcn.1005d3f0
push esi
lea eax, [ebp - 0x30f]
push ebx
push eax
mov byte [ebp - 0x310], bl
call fcn.1005d3f0
mov eax, dword [ebp - 0xd00]
push ebx
lea esi, [ebp - 0x210]
lea ecx, [ebp - 0xd10]
call fcn.1004ffd8
mov eax, dword [ebp - 0xcfc]
push ebx
lea esi, [ebp - 0x310]
lea ecx, [ebp - 0xd10]
call fcn.1004ffd8
mov eax, dword [ebp - 0xcf8]
xor edi, edi
inc edi
push edi
lea esi, [ebp - 0x110]
lea ecx, [ebp - 0xd10]
call fcn.1004ffd8
movsx eax, byte [ebp - 0x110]
push eax
call fcn.10061c4e
add esp, 0x34
test eax, eax
jne 0x10050741
movsx eax, byte [ebp - 0xfd]
push eax
call fcn.10061c4e
pop ecx
test eax, eax
je 0x100507ea
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0xd38]
call fcn.10014ee2
mov ecx, dword [ebp - 0xd68]
push eax
mov dword [ebp - 4], ebx
call fcn.1001de7a
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0xd38]
call fcn.10013fa5
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xd38]
call fcn.10014ee2
mov ecx, dword [ebp - 0xd70]
push eax
mov dword [ebp - 4], edi
call fcn.1001de7a
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0xd38]
call fcn.10013fa5
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0xd54]
call fcn.10014ee2
mov ecx, dword [ebp - 0xd6c]
push eax
mov dword [ebp - 4], 2
call fcn.1001de7a
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0xd54]
call fcn.10013fa5
mov byte [ebp - 0xd55], 1
jmp 0x100507ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xd60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xd5c]
cmp dword [ebp - 0xd5c], 0x10
jl 0x100505c7
mov al, byte [ebp - 0xd55]
call fcn.100768d1
ret
Function at 0x10052a43
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.1005d3f0
push 0x100b6798
push edi
call fcn.10063616
add esp, 0x14
test eax, eax
lea eax, [ebp - 0x210]
jne 0x10052ac3
push ebx
push esi
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
sub esi, ebx
push esi
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.1005f5b3
add esp, 0x10
pop esi
pop ebx
jmp 0x10052ad7
push 0x104
push edi
push 0x105
push eax
call fcn.1006059e
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10052aec
xor eax, eax
jmp 0x10052afd
push 0
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c747
leave
ret

Function at 0x10053365
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [esi + 4], ebx
mov eax, str.984F2052_5475_4CD7_887A_726BFFCF1798
push edi
push eax
mov dword [esi], vtable.Utils::Config::CConfig.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0xc], eax
call fcn.1005d560
mov dword [esi + 0x10], eax
mov dword [esp], 0x208
lea eax, [esi + 0x1c]
push ebx
push eax
call fcn.1005d3f0
mov edi, 0x100d9690
push edi
call fcn.1005d0d1
add esp, 0x10
test eax, eax
jne 0x10053443
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.1005d3f0
push str._APPDATA_BaiduBaidu_
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1005d4a8
push str.config_
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1005f689
add esp, 0x24
push 0x103
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call fcn.1005d0d1
add eax, eax
cmp word [eax + 0x100d968e], 0x5c
pop ecx
je 0x10053443
push 0x5c
pop edx
xor ecx, ecx
mov word [eax + 0x100d9690], dx
mov word [eax + 0x100d9692], cx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.1005c747
leave
ret
Function at 0x1005348f
Capabilities:
Check if file exists
Check mutex on windows
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebx + 8], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.1005d3f0
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1005d3f0
add esp, 0x18
push 0x103
test edi, edi
jne 0x1005350a
push 0x100d9690
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1006059e
add esp, 0x10
jmp 0x10053565
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
push eax
call fcn.1005d0d1
mov esi, eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1006059e
lea eax, [esi + esi]
add esp, 0x14
cmp word [ebp + eax - 0x20e], 0x5c
je 0x10053565
push 0x5c
pop ecx
mov word [ebp + eax - 0x20c], cx
xor ecx, ecx
mov word [ebp + eax - 0x20a], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1005357b
test al, 0x10
jne 0x10053586
lea edi, [ebp - 0x20c]
call fcn.10052a43
push dword [ebp + 8]
lea ecx, [ebp - 0x20c]
mov edx, ebx
call fcn.100537b4
push str.GlobalEB19B4E1_D804_4FF6_B8B2_61530127D102
push 0
call fcn.1004b197
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x100535bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x100535bf
xor eax, eax
jmp 0x100535c8
xor eax, eax
inc eax
mov dword [ebx + 0x224], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c747
leave
ret 8
Function at 0x100538b2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13d0
call fcn.10063e20
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push 0xf9c
mov dword [ebp - 0x13d0], eax
lea eax, [ebp - 0x13b4]
push edi
push eax
mov dword [ebp - 0x13b8], edi
call fcn.1005d3f0
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
mov dword [ebp - 0x13c4], edi
call fcn.1005d3f0
add esp, 0x18
lea eax, [ebp - 0x13c4]
push eax
push 0xfa0
lea eax, [ebp - 0x13b8]
push eax
mov dword [ebp - 0x13c0], edi
mov dword [ebp - 0x13c8], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10053a1f
mov eax, dword [ebp - 0x13c4]
cmp eax, edi
je 0x10053a1f
shr eax, 2
mov dword [ebp - 0x13cc], eax
mov dword [ebp - 0x13bc], edi
cmp eax, edi
jbe 0x10053a1f
mov esi, 0x208
mov eax, dword [ebp - 0x13bc]
push dword [ebp + eax*4 - 0x13b8]
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x10053a07
push esi
lea eax, [ebp - 0x418]
push edi
push eax
mov dword [ebp - 0x13c0], edi
call fcn.1005d3f0
add esp, 0xc
lea eax, [ebp - 0x13c4]
push eax
push 4
lea eax, [ebp - 0x13c0]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x10053a00
push 0x104
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x13c0]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x10053a00
push str.Baidu.exe
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100539f8
mov dword [ebp - 0x13c8], 1
cmp dword [ebp - 0x13c8], edi
jne 0x10053a30
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x13bc]
mov eax, dword [ebp - 0x13bc]
cmp eax, dword [ebp - 0x13cc]
jb 0x1005396a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c747
leave
ret
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.1005d3f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x210]
push eax
call fcn.1005d0d1
pop ecx
mov ecx, dword [ebp - 0x13d0]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000f93d
xor eax, eax
inc eax
jmp 0x10053a21
Function at 0x10053f42
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x25c
mov eax, 0x10099ecc
call fcn.1007684e
xor eax, eax
xor ebx, ebx
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x258], ebx
call fcn.1005d3f0
mov dword [ebp - 0x25c], ebx
inc ebx
add esp, 0xc
mov esi, 0x104
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], ebx
test edi, edi
je 0x10054151
lea eax, [ebp - 0x25c]
push eax
push ebx
push 0
push str.SOFTWARE_baiduBaidu
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10054033
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
push 0x100af7c4
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005401a
cmp dword [ebp - 0x264], ebx
jne 0x1005401a
lea eax, [ebp - 0x21c]
push eax
call fcn.10053dca
pop ecx
test eax, eax
je 0x1005401a
push esi
lea eax, [ebp - 0x21c]
push eax
push esi
push edi
call fcn.1006059e
add esp, 0x10
mov dword [ebp - 0x258], ebx
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x258], 0
jne 0x10054135
and dword [ebp - 0x228], 0
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x238], ax
and dword [ebp - 4], eax
lea edi, [ebp - 0x238]
call fcn.10053d3d
test eax, eax
je 0x10054117
and dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], ebx
mov word [ebp - 0x254], ax
push 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x238]
pop ebx
cmp dword [ebp - 0x224], ebx
jae 0x1005408f
mov ecx, edi
lea eax, [ebp - 0x254]
push eax
call fcn.10053e27
pop ecx
test eax, eax
jne 0x100540bf
mov ecx, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x100540b4
lea ecx, [ebp - 0x238]
lea edi, [ebp - 0x254]
call fcn.10053ecf
mov ecx, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x100540d3
lea ecx, [ebp - 0x238]
lea edi, [ebp - 0x254]
call fcn.10053ecf
mov dword [ebp - 0x258], eax
test eax, eax
je 0x10054108
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x240], ebx
jae 0x100540f8
mov eax, edi
push eax
push esi
push dword [ebp - 0x260]
call fcn.1005d4a8
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x254]
call fcn.1000f89d
push 0
push 1
lea ecx, [ebp - 0x238]
call fcn.1000f89d
cmp dword [ebp - 0x258], 0
je 0x10054149
mov edi, dword [ebp - 0x260]
push edi
call fcn.10053dca
pop ecx
test eax, eax
jne 0x10054149
and dword [ebp - 0x258], eax
mov word [edi], ax
mov eax, dword [ebp - 0x258]
jmp 0x10054153
xor eax, eax
call fcn.100768d1
ret
Function at 0x100541f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1005d3f0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x20c]
push eax
push str._APPDATA_BaiduBaidu_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edi, [ebp - 0x20c]
call fcn.10052a43
mov esi, eax
test esi, esi
je 0x1005425e
push 0xffffffffffffffff
mov eax, edi
push eax
push 0x104
push ebx
call fcn.1006059e
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1005c747
leave
ret

Function at 0x1005426e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
xor edi, edi
push 0x400
mov word [ebp - 0x614], ax
lea eax, [ebp - 0x612]
push edi
push eax
mov dword [ebp - 0x61c], edi
mov dword [ebp - 0x618], edi
call fcn.1005d3f0
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0x620], 0x400
call fcn.1005d3f0
add esp, 0x18
call fcn.10053872
neg eax
sbb eax, eax
and eax, 0x200
lea ecx, [ebp - 0x618]
push ecx
inc eax
push eax
push edi
push str.SOFTWARE_baiduBaidu
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10054368
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x614]
push eax
push edi
push edi
push str.SupplyID
push dword [ebp - 0x618]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005435c
push 0x104
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x210]
push 0x105
push eax
mov dword [ebp - 0x61c], 1
call fcn.1006059e
lea eax, [ebp - 0x210]
push eax
call fcn.1005d3e2
add esp, 0x14
mov dword [ebx], eax
push dword [ebp - 0x618]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x61c]
xor ecx, ebp
pop edi
call fcn.1005c747
leave
ret
Function at 0x1005932f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x420], eax
xor eax, eax
mov esi, 0x208
xor edi, edi
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x434], edi
call fcn.1005d3f0
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.1005d3f0
add esp, 0x18
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x430], edi
cmp ebx, edi
je 0x100594f7
xor eax, eax
cmp ax, word [ebx]
je 0x100594f7
cmp dword [ebp - 0x420], edi
je 0x100594f7
push esi
push edi
push dword [ebp - 0x420]
call fcn.1005d3f0
add esp, 0xc
push edi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
cmp esi, edi
je 0x100594ef
push esi
call fcn.1005ebe9
pop ecx
mov dword [ebp - 0x428], eax
cmp eax, edi
je 0x100594ef
push eax
push esi
push edi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100594e3
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x100b8a44
push dword [ebp - 0x428]
call esi
test eax, eax
je 0x100594e3
xor ebx, ebx
test dword [ebp - 0x424], 0xfffffffc
jbe 0x100594c1
mov eax, dword [ebp - 0x430]
lea eax, [eax + ebx*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.StringFileInfo_04x_04xFileVersion
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.1006241e
add esp, 0x18
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], edi
call esi
test eax, eax
jne 0x100594a9
mov eax, dword [ebp - 0x424]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x10059445
jmp 0x100594c1
push 0x104
push dword [ebp - 0x42c]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x434], 1
push dword [ebp - 0x428]
call fcn.1005c822
pop ecx
mov eax, dword [ebp - 0x434]
jmp 0x100594f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c747
leave
ret

Function at 0x1005c747
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100cc5b0]
jne 0x1005c751
repz ret
jmp fcn.10063e4b