joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100200a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0dab
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.1007bae0
add esp, 0xc
cmp dword [section..data], 0
je 0x100201dc
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100201cc
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x248]
push ecx
movups xmmword [ebp - 0x248], xmm0
movups xmmword [ebp - 0x238], xmm0
call eax
mov ax, word [ebp - 0x248]
cmp ax, 9
je 0x100201c2
cmp ax, 6
je 0x100201c2
cmp ax, 0xc
je 0x100201c2
push str.IsWow64Process2
push 0x100fd97c
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100201b9
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x100201b9
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x220], cx
sete al
mov dword [0x10139844], eax
jmp 0x100201cc
xor eax, eax
mov dword [0x10139844], eax
jmp 0x100201cc
mov dword [0x10139844], 1
mov edi, dword [ebp - 0x21c]
mov dword [section..data], 0
cmp dword [0x10139844], 0
lea eax, [ebp - 0x218]
je 0x100201f2
push str.wallpaperhelperComputerZ8_x64.dll
jmp 0x100201f7
push str.wallpaperhelperComputerZ8.dll
push dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100202a8
lea ecx, [ebp - 0x21c]
call fcn.10005800
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, str._u__s___s_
test edi, edi
mov eax, 0x100ff0b0
cmove eax, ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10006000
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0x1388
push 1
push 0
push esi
push str.regsvr32.exe
push 0
call fcn.100202d0
add esp, 0x2c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._tid:_d__CDeskBandInstallHelper::RegisterBand_bRegister:_d_Param:_s
call fcn.1002ea70
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100202a3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 4
Function at 0x10020370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2858
call fcn.10069fc0
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.1007bae0
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x10020424
test esi, esi
je 0x10020459
push 0x1000
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1002040d
push 0x800
lea eax, [ebp - 0x1804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x1804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebp - 0x1804]
push 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10097da2
add esp, 0xc
jmp 0x10020440
lea ecx, [ebp - 0x804]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x10020430
cmp dword [ebp + 0x20], 0
je 0x1002046c
lea eax, [ebp - 0x804]
push eax
call fcn.10052bd0
add esp, 4
test eax, eax
jne 0x1002046c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x2858], 0x44
lea eax, [ebp - 0x2858]
movlpd qword [ebp - 0x2854], xmm0
push eax
movlpd qword [ebp - 0x284c], xmm0
movlpd qword [ebp - 0x2844], xmm0
movlpd qword [ebp - 0x283c], xmm0
movlpd qword [ebp - 0x2834], xmm0
movlpd qword [ebp - 0x282c], xmm0
movlpd qword [ebp - 0x2824], xmm0
movlpd qword [ebp - 0x281c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x2828], ax
lea eax, [ebp - 0x2804]
push 0
push eax
mov dword [ebp - 0x282c], 1
movups xmmword [ebp - 0x2814], xmm0
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x1002051d
push edi
push eax
lea eax, [ebp - 0x2804]
push str.__s___s
push eax
call fcn.1001fe40
add esp, 0x10
jmp 0x10020532
push eax
lea eax, [ebp - 0x2804]
push 0x100ff368
push eax
call fcn.1001fe40
add esp, 0xc
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x1002058c
cmp dword [ebp + 0x18], 0
je 0x10020576
push dword [ebp + 0x1c]
push dword [ebp - 0x2814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x2810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x10020cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0e9e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10136674]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], vtable.ILayerWindow.0
mov dword [edi], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.0
mov dword [edi + 0x24], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.1.0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], 0xff
mov ecx, esi
mov dword [edi + 0x40], 1
mov dword [edi + 0x44], 0
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10022fa0
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
call fcn.100087f0
mov ecx, eax
test ecx, ecx
je 0x10020eb8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x54], eax
push 0xa4
mov byte [ebp - 4], 4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
call fcn.10035660
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x10020e04
mov ecx, eax
call fcn.10062b10
test eax, eax
jne 0x10020e06
xor eax, eax
mov dword [edi + 0x44], eax
lea esi, [edi + 0x78]
mov dword [edi], vtable.CInputWnd.0
mov dword [edi + 0x24], vtable.CInputWnd.1.0
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
lea ebx, [esi + 0x24]
mov byte [ebp - 4], 7
mov dword [esi], vtable.CEditExImpl_class_CEditEx__class_WTL::CEditT_class_ATL::CWindow___class_ATL::CWinTraits_1442840576__0__.0
mov dword [ebp - 0x18], ebx
call fcn.100087f0
mov ecx, eax
test ecx, ecx
je 0x10020ec2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x100fddf8
mov byte [ebp - 4], 8
mov ecx, ebx
test eax, 0xffff0000
jne 0x10020e84
movzx eax, ax
push eax
call fcn.10006850
jmp 0x10020e90
push 0
push 0x100fddf8
call fcn.10007690
mov dword [esi + 0x28], 0
mov eax, edi
mov dword [esi + 0x54], 0
mov dword [esi], vtable.CEditEx.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005ea0
push 0x80004005
call fcn.10005ea0
int3
Function at 0x10020ed0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.1007bae0
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.1007bae0
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10020f33
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x10020f38
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x10020f56
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x10020f58
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x10020f6c
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x1013a2c4]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10069b58
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10021c30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0fab
mov eax, dword fs:[0]
push eax
mov eax, 0x2008
call fcn.10069fc0
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
push 0x2000
push 0
push eax
mov dword [ebp - 0x2014], esi
call fcn.1007bae0
add esp, 0xc
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10021ca4
push 0x1000
lea eax, [ebp - 0x2010]
push eax
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.100087f0
mov ecx, eax
test ecx, ecx
je 0x10021d20
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10021cda
movzx eax, ax
mov ecx, esi
push eax
call fcn.10006850
jmp 0x10021d01
lea ecx, [ebp - 0x2010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021ce3
sub ecx, edx
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007690
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005ea0
int3
Function at 0x10026100
Capabilities:
Create process on windows

Disassembly:
push 4
push 0x100ffb90
push 0
call fcn.10034000
cmp eax, 6
jne 0x1002612b
push 1
push 0
push 0
push str.http:__cdn_ali_file_dida.halopaper.cn_halo_halowallpaper_home.exe
push 0x100fe398
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x100267e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f1546
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x1002688c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x1002688c
call fcn.10016b50
mov edi, eax
jmp 0x100269ab
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100268af
call fcn.10016b50
jmp 0x1002699e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x100268cd
call fcn.10016b50
jmp 0x1002699e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x100268ee
mov edi, 0x8007000e
jmp 0x100269a0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x100269e4
jb 0x1002690c
cmp eax, 0xffffffff
ja 0x100269e4
cmp eax, 0x400
jbe 0x10026921
push eax
lea ecx, [ebp - 0x418]
call fcn.100247f0
jmp 0x10026947
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10026947
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x1002695e
mov edi, 0x8007000e
jmp 0x100269a0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1002697e
call fcn.10016b50
jmp 0x1002699e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10026640
mov edi, eax
test esi, esi
je 0x100269ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100269c4
lea ecx, [ebp - 0x418]
call fcn.10024fb0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.10005ea0
int3
Function at 0x10028750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10028778
push esi
call fcn.10025080
mov ecx, eax
call fcn.1001ce80
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
mov dword [ebp - 0x41c], 1
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x100fe3bc
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10028874
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013690
push str.bizhi
call fcn.10017d10
mov ecx, eax
call fcn.10013750
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10139a84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013600
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.10017d10
mov ecx, eax
call fcn.10013240
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
call fcn.10025080
mov ecx, eax
call fcn.1001e090
test eax, eax
jne 0x1002893a
push 1
call fcn.10019330
add esp, 4
test eax, eax
jne 0x1002893a
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013690
push str.bizhi
call fcn.10017d10
mov ecx, eax
call fcn.10013750
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10139a84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013600
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.10017d10
mov ecx, eax
call fcn.10013240
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
cmp dword [0x10139a98], 0
jne 0x1002895d
push 0
push esi
push 0
push dword [0x10139a84]
mov dword [0x10139a98], 1
call fcn.10028a20
mov ecx, dword [ebp - 4]
mov eax, dword [0x1013522c]
xor ecx, ebp
pop esi
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x10029290
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f166d
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x260], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
lea ecx, [ebp - 0x254]
call fcn.10029030
mov dword [ebp - 4], 1
call fcn.10025080
mov ecx, eax
call fcn.1001cbb0
push eax
mov ecx, edi
call fcn.10029030
mov eax, dword [edi]
mov esi, dword [ebp - 0x254]
mov dword [ebp - 0x20], 0x75006c
mov dword [ebp - 0x1c], 0x610064
mov dword [ebp - 0x18], 0x680073
mov dword [ebp - 0x14], 0x69
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x250], 1
jne 0x1002942e
cmp dword [esi - 0xc], 0
jl 0x1002942e
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.1007bf40
add esp, 8
test eax, eax
je 0x1002942e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x1002942e
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
mov dword [ebp - 0x25c], 1
xor eax, eax
mov dword [ebp - 0x258], 0x104
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x258]
mov dword [ebp - 0x44], 0x4f0053
push eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x40], 0x540046
push eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x3c], 0x410057
push eax
push str.VendorID
lea eax, [ebp - 0x44]
mov dword [ebp - 0x38], 0x450052
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], 0x4c005c
mov dword [ebp - 0x30], 0x640075
mov dword [ebp - 0x2c], 0x730061
mov dword [ebp - 0x28], 0x690068
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002942e
lea eax, [ebp - 0x24c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10029410
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10007690
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002944a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f19b8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x250022
mov dword [ebp - 0x60], 0x220073
mov dword [ebp - 0x5c], 0x5f002c
mov dword [ebp - 0x58], 0x740041
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x6e0045
mov dword [ebp - 0x4c], 0x720074
mov dword [ebp - 0x48], 0x400079
mov dword [ebp - 0x44], 0x360031
mov dword [ebp - 0x40], 0x2d0020
mov dword [ebp - 0x3c], 0x72002d
mov dword [ebp - 0x38], 0x760065
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x650073
mov dword [ebp - 0x2c], 0x77005f
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x6f0064
mov dword [ebp - 0x20], 0x3d0077
mov dword [ebp - 0x1c], 0x250022
mov dword [ebp - 0x18], 0x220073
mov word [ebp - 0x14], ax
call fcn.100087f0
mov ecx, eax
test ecx, ecx
je 0x1002b30c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x1002b2e6
movzx eax, ax
push eax
call fcn.10006850
jmp 0x1002b2ec
push eax
call fcn.10015aa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005ea0
int3

Function at 0x1002b320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f19e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0x3a0043
mov dword [ebp - 0x44], 0x57005c
mov dword [ebp - 0x40], 0x6e0069
mov dword [ebp - 0x3c], 0x6f0064
mov dword [ebp - 0x38], 0x730077
mov dword [ebp - 0x34], 0x53005c
mov dword [ebp - 0x30], 0x730079
mov dword [ebp - 0x2c], 0x650074
mov dword [ebp - 0x28], 0x33006d
mov dword [ebp - 0x24], 0x5c0032
mov dword [ebp - 0x20], 0x6d0063
mov dword [ebp - 0x1c], 0x2e0064
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.100087f0
mov ecx, eax
test ecx, ecx
je 0x1002b40c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x1002b3e6
movzx eax, ax
push eax
call fcn.10006850
jmp 0x1002b3ec
push eax
call fcn.10015aa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005ea0
int3
Function at 0x100317f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2318
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10136674]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi + 0xa8]
call fcn.10022860
mov ecx, 0x10139ad8
call fcn.1000b490
push str.quit
call fcn.1002ea70
add esp, 4
lea ecx, [esi + 0x8c]
call fcn.1002c5d0
test eax, eax
jne 0x10031886
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax + 0x24], 0
push 1
push 0
push str.install_r_fail
mov dword [ebp - 4], 0
call fcn.10017d10
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10013240
push str.quit_finish
call fcn.1002ea70
add esp, 4
xor esi, esi
call fcn.10025080
mov ecx, eax
call fcn.1001e9b0
test eax, eax
mov ecx, 1
cmovne esi, ecx
call fcn.10037480
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.10037480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret