joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005c08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp + 0x20]
xor ebx, ebx
cmp dword [ebp + 8], 1
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x854], eax
jne 0x10005c4a
cmp dword [0x10052c40], ebx
jne 0x10005e48
cmp dword [0x10052f8c], ebx
je 0x10005d8b
push 0x744
lea eax, [ebp - 0x850]
push ebx
push eax
call fcn.1002aa10
add esp, 0xc
cmp dword [ebp + 8], 1
mov dword [ebp - 0x850], 0x12345678
jne 0x10005c87
mov dword [ebp - 0x84c], 6
jmp 0x10005c97
cmp dword [ebp + 8], 2
jne 0x10005c97
mov dword [ebp - 0x84c], 2
mov eax, dword [ebp + 0x14]
cmp eax, 1
mov dword [ebp - 0x640], eax
mov edi, 0x104
jne 0x10005cca
mov esi, str.default
lea eax, [ebp - 0x848]
push esi
push eax
call fcn.1002b3e0
pop ecx
pop ecx
mov dword [ebp - 0x63c], 1
jmp 0x10005d2f
push edi
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.1002aa10
add esp, 0xc
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10041c08
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.1002cbb9
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x848]
push eax
call fcn.1002b3e0
push dword [ebp + 0x14]
call fcn.100043cf
add esp, 0x18
mov dword [ebp - 0x63c], eax
mov esi, str.default
cmp dword [ebp + 0x18], ebx
lea eax, [ebp - 0x638]
je 0x10005d4e
push dword [ebp - 0x858]
push eax
call fcn.1002b3e0
push dword [ebp - 0x854]
jmp 0x10005d56
push esi
push eax
call fcn.1002b3e0
push esi
lea eax, [ebp - 0x534]
push eax
call fcn.1002b3e0
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x744]
push edi
push eax
call fcn.10004433
lea eax, [ebp - 0x850]
push 1
push eax
call fcn.100058b2
add esp, 0x14
jmp 0x10005e48
cmp dword [ebp + 0x14], ebx
jne 0x10005d97
xor al, al
jmp 0x10005e4a
cmp dword [ebp + 8], 1
mov dword [esi], 0x1f8
mov dword [esi + 8], 0x1616
jne 0x10005e1a
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push 0xff
push eax
mov dword [esi + 0xc], 3
mov dword [esi + 0x10], 0x508
call fcn.10004433
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebx
je 0x10005def
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10005d90
push dword [ebp + 0x14]
mov dword [esi + 0x14], ebx
push esi
call fcn.1000558d
pop ecx
pop ecx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea eax, [ebp - 0x108]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi], eax
jmp 0x10005e48
cmp dword [ebp + 8], 2
jne 0x10005e48
cmp dword [edi], ebx
je 0x10005e48
push esi
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10005e48
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi + 0x14], ebx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae45
leave
ret
Function at 0x1000a5ff
Capabilities:
Hide thread from debugger

Disassembly:
push esi
push edi
push str.NtSetInformationThread
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x1000a624
xor al, al
jmp 0x1000a642
cmp dword [esp + 0xc], edi
push edi
push edi
push 0x11
jne 0x1000a637
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
jmp 0x1000a63b
push dword [esp + 0x18]
call esi
cmp eax, edi
sete al
pop edi
pop esi
ret

Function at 0x1000b2bf
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000b312
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x1000b328
push 0x80004005
call fcn.10002c4a
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1000b32b
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000bbb9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.1000b28a
mov edi, eax
cmp edi, esi
je 0x1000bc21
lea ecx, [ebp - 0x70]
call fcn.1000b225
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae45
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000bc39
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.1000bbb9
cmp eax, esi
jne 0x1000bc6c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x1000bc29
lea ecx, [ebp - 0x70]
call fcn.1000b225
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.1000b225
mov eax, esi
jmp 0x1000bc07
Function at 0x10010053
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x1003f1aa
call fcn.1002b8d2
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x1004e6c0]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x1001010d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000ae7c
add esp, 0xc
test eax, eax
jl 0x1001010d
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x100100f5
push edi
call fcn.1000ba61
test al, al
pop ecx
je 0x100100f5
mov eax, edi
call fcn.1002ec50
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x100100fe
push edi
lea ecx, [ebp - 0x20]
call fcn.1000bd18
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.1000af5d
cmp eax, ebx
jne 0x10010152
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1001011d
lea ecx, [ebp]
call fcn.1000b914
lea ecx, [ebp - 0x20]
call fcn.10002c86
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.1002ae45
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x10010171
call fcn.1000b175
mov esi, eax
jmp 0x1001023b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1001018e
call fcn.1000b175
jmp 0x10010230
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10010184
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x100101d5
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x100101c1
lea ecx, [ebp]
call fcn.1000b914
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.10002c86
mov eax, esi
jmp 0x1001012a
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.1000cb57
mov dword [ebp - 4], 1
jmp 0x100101fd
cmp dword [ebp], ebx
jne 0x10010209
mov esi, 0x8007000e
jmp 0x10010232
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.10002fc2
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.1000dcef
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x100101c6
lea ecx, [ebp]
call fcn.1000b914
jmp 0x100101c6
Function at 0x1001196c
Capabilities:
Get keyboard layout
Log keystrokes via polling
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x9c], eax
test dword [ebp + 0xa8], 0x10000
push ebx
push esi
push edi
je 0x100119a4
mov edi, dword [ebp + 0xa8]
shr edi, 0x11
and edi, 1
jmp 0x100119aa
mov edi, dword [0x10052e70]
mov esi, 0xff
and dword [ebp + 0xa8], esi
xor ebx, ebx
cmp dword [0x10052e7c], ebx
jne 0x10011a9c
push dword [ebp + 0xa8]
call fcn.1000a70f
pop ecx
movzx ecx, al
cmp ecx, dword [ebp + 0xa8]
je 0x100119e3
movzx ax, al
jmp 0x10011b47
push esi
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.1002aa10
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [0x10052c3c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
push esi
push 1
push dword [ebp + 0xa8]
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov byte [ebp - 0x75], al
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [0x10052e68], ebx
je 0x10011a39
xor ax, ax
jmp 0x10011b47
cmp byte [ebp - 0x75], bl
jle 0x10011a4d
movsx eax, byte [ebp - 0x75]
push eax
call fcn.1002c923
test eax, eax
pop ecx
jne 0x10011a31
push esi
push 1
push dword [ebp + 0xa8]
xor eax, eax
mov word [ebp - 0x7c], bx
lea edi, [ebp - 0x7a]
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
push esi
push ebx
push 2
lea ecx, [ebp - 0x7c]
push ecx
movzx eax, ax
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp + 0xa8]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov ax, word [ebp - 0x7c]
cmp ax, 0x12
je 0x10011a31
cmp ax, 0x11
jne 0x10011b47
jmp 0x10011a31
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx esi, ax
cmp esi, 0x409
jne 0x10011ae2
push 0x10c
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.1002aa10
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [ebp - 0x71], 0x31
jne 0x10011ae2
mov esi, 0x80000409
push esi
push dword [ebp + 0xa8]
call fcn.1000a7fd
mov byte [ebp - 0x75], al
call fcn.10004d4a
movzx eax, byte [ebp - 0x75]
push eax
call fcn.1002c8a9
add esp, 0xc
test eax, eax
je 0x10011b25
cmp dword [0x10052e64], ebx
jne 0x10011b16
cmp edi, ebx
sete al
jmp 0x10011b1b
cmp edi, ebx
setne al
dec al
and eax, 0x20
sub byte [ebp - 0x75], al
jmp 0x10011b42
movzx ax, byte [ebp - 0x75]
push esi
push eax
push edi
push dword [ebp + 0xa8]
call fcn.1000ab1d
add esp, 0x10
cmp al, bl
je 0x10011b42
mov byte [ebp - 0x75], al
movzx ax, byte [ebp - 0x75]
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae45
add ebp, 0xa0
leave
ret 4
Function at 0x1001893d
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x100189d1
mov edi, 0x104
push edi
lea eax, [ebp - 0x7f]
push ebx
push eax
mov byte [ebp - 0x80], bl
call fcn.1002aa10
add esp, 0xc
push edi
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, str.TrustFireSKS.dll
push edi
lea eax, [ebp - 0x80]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100189c1
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.1002b3e0
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi], eax
je 0x100189fb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TN_Init
push dword [esi]
call edi
push str.TN_Exit
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.TN_Encipher
push dword [esi]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 8], eax
cmp dword [esi + 4], ebx
je 0x10018a0f
cmp dword [esi + 8], ebx
je 0x10018a0f
cmp dword [esi + 0xc], ebx
je 0x10018a0f
xor eax, eax
inc eax
jmp 0x10018a11
xor eax, eax
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae45
add ebp, 0x8c
leave
ret
Function at 0x100190ed
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xa0
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push ebx
push esi
mov esi, dword [ebp + 0x78]
push edi
xor ebx, ebx
push 0x90
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [ebp - 0x28], ebx
call fcn.1002aa10
mov edi, dword [ebp + 0x7c]
push edi
push ebx
push esi
call fcn.1002aa10
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x24], 6
jne 0x10019174
push str.SHGetFolderPathA
push str.shell32.dll
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10019166
push esi
push ebx
push ebx
push 0x1c
push ebx
call eax
push str.LowINITECHINISAFE_Web_V6INICRYPTOSDK.DLL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x100191e4
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push str.CLSID286A75C3_11FB_4FB4_AC4A_4DD1B0750050InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10019193
xor eax, eax
jmp 0x100191e7
lea eax, [ebp - 0x30]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 0x2c]
je 0x100191b6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001918f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002ae60
test eax, eax
pop ecx
je 0x1001918f
push 0x5c
push esi
call fcn.1002c259
cmp eax, ebx
pop ecx
pop ecx
je 0x1001918f
push str.INICRYPTOSDK.DLL
push esi
mov byte [eax], bl
call fcn.1002b3f0
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae45
add ebp, 0x70
leave
ret 8
Function at 0x1001a842
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0x10
mov eax, 0x1003fe66
call fcn.1002b89f
mov dword [ebp - 0x10], ecx
call fcn.10004af8
inc dword [0x10052c48]
lea ecx, [ebp - 0x18]
call fcn.10024f90
push 1
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts00000412
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.10025010
test eax, eax
mov edi, 0x104
lea esi, [edi + 1]
je 0x1001a8e4
push edi
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.1002aa10
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push str.Layout_File
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
call fcn.100250c0
lea eax, [ebp]
push str.KBDDV.DLL
push eax
call fcn.1002c5b5
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [0x10052fa0], eax
push edi
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.1002aa10
add esp, 0xc
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.XecureURLConfig.exe
lea eax, [ebp]
push esi
push eax
call fcn.1002cbb9
lea eax, [ebp]
push eax
call fcn.1001f720
mov ecx, dword [ebp - 0x10]
add esp, 0x10
mov dword [ecx + 0x1524], eax
call fcn.10021950
test eax, eax
je 0x1001a937
mov dword [0x10052f8c], 1
cmp dword [0x10052fa8], ebx
mov esi, 0x10052fa4
jne 0x1001a976
cmp dword [0x10052c48], 1
jne 0x1001a984
push 0x2800
push str._event_CKConfig2
push str._event_CKConfig1
push str._mtx_CKConfig
push str._mmf_CKConfig
push ebx
mov ecx, esi
call fcn.100220f0
cmp dword [0x10052fa8], ebx
je 0x1001a984
push 4
push 0x10052f9c
mov ecx, esi
call fcn.10022470
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10024ff0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.1002ae45
add ebp, 0x10c
leave
ret
Function at 0x1001e5f0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x50], eax
cmp dword [ebp + 8], 0
jne 0x1001e610
xor eax, eax
jmp 0x1001e70c
mov dword [ebp - 4], 0
push 0x3c
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], 0x824
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], 0x824
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], 0x2000000
lea eax, [ebp - 0x44]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x824
mov ecx, dword [ebp - 8]
and ecx, 0x3e000000
mov dword [ebp - 0x880], ecx
mov edx, dword [ebp - 8]
and edx, 0xc0000000
mov dword [ebp - 0x884], edx
mov eax, dword [ebp - 0x880]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x878]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001e6ad
xor eax, eax
jmp 0x1001e70c
lea ecx, [ebp - 0x878]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x87c]
push edx
mov eax, dword [ebp - 0x884]
push eax
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001e6dd
xor eax, eax
jmp 0x1001e70c
cmp dword [ebp + 0xc], 0
je 0x1001e6f1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x87c]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
cmp dword [ebp + 0x18], 0
je 0x1001e707
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x87c]
mov cx, word [eax + 0x18]
mov word [edx], cx
mov eax, 1
mov ecx, dword [ebp - 0x50]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret
Function at 0x1001f080
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001f0be
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x44]
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx]
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], eax
jmp 0x1001f11f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2ee2
jne 0x1001f11f
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x44]
push ecx
mov ecx, dword [ebp - 8]
call fcn.1001ea90
test eax, eax
je 0x1001f11f
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001f11f
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x44]
mov eax, dword [ebp + 0x10]
add edx, dword [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001f280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040358
mov eax, dword fs:[0]
push eax
mov eax, 0x107c
call fcn.1002bb30
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x68], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x64]
call fcn.1001e720
mov dword [ebp - 4], 0
push 0
push 0x3e8
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x64]
call fcn.1001e850
test eax, eax
je 0x1001f3fe
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1078], 0
mov byte [ebp - 0x106c], 0
push 0xfff
push 0
lea ecx, [ebp - 0x106b]
push ecx
call fcn.1002aa10
add esp, 0xc
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0xffffffff
je 0x1001f3d3
mov dword [ebp - 0x107c], 0x1000
lea eax, [ebp - 0x1074]
push eax
mov ecx, dword [ebp - 0x107c]
push ecx
lea edx, [ebp - 0x106c]
push edx
lea ecx, [ebp - 0x64]
call fcn.1001f080
cmp dword [ebp - 0x1074], 0
jne 0x1001f36c
jmp 0x1001f399
push 0
lea eax, [ebp - 0x1078]
push eax
mov ecx, dword [ebp - 0x1074]
push ecx
lea edx, [ebp - 0x106c]
push edx
mov eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
test ecx, ecx
jne 0x1001f344
mov edx, dword [ebp - 0x1070]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
lea ecx, [ebp - 0x64]
call fcn.1001eea0
mov dword [ebp - 0x1080], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1001e830
mov eax, dword [ebp - 0x1080]
jmp 0x1001f41d
push 1
lea ecx, [ebp - 0x64]
call fcn.1001eea0
mov dword [ebp - 0x1084], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1001e830
mov eax, dword [ebp - 0x1084]
jmp 0x1001f41d
mov dword [ebp - 0x1088], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1001e830
mov eax, dword [ebp - 0x1088]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x68]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret

Function at 0x1001f4b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x118], 0
push 0x104
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.1002aa10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._shell32.dll
lea edx, [ebp - 0x118]
push edx
call fcn.1002b3f0
add esp, 8
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
push str.IsUserAnAdmin
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001f545
call dword [ebp - 4]
test eax, eax
jne 0x1001f545
mov dword [ebp - 0xc], 0
jmp 0x1001f54c
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret