joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000514f
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x4c
mov eax, 0x1004a92c
call fcn.10032dfa
push 4
pop esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
push eax
push str._fci
push str.Softwareprojonepodlp_smpcache_
mov ebx, reloc.WS2_32.dll_bind
push ebx
mov edi, ecx
mov dword [ebp - 0x4c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10005193
cmp dword [ebp - 0x54], esi
jne 0x10005193
mov eax, dword [ebp - 0x50]
jmp 0x10005195
xor eax, eax
cmp eax, 1
jne 0x100052a5
lea ecx, [ebp - 0x2c]
mov byte [edi], al
call fcn.10003183
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100051b8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100051d3
push str.cstate_not_found
call fcn.10013d73
pop ecx
jmp 0x10005299
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x48]
call fcn.10002038
push str.__init
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.1000596e
xor edi, edi
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x100051fe
lea eax, [ebp - 0x44]
push eax
call fcn.10025fe8
mov esi, eax
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x10005216
cmp esi, 0xffffffff
jne 0x1000524a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.start_cstate__init_failed:__d
call fcn.10013d73
mov eax, edi
pop ecx
inc edi
cmp eax, 0x1e
pop ecx
jg 0x10005285
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.1000316d
jmp 0x100051f2
push str.wait_for_fill_client_info_before_online
call fcn.10013975
mov dword [esp], 0x493e0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10005274
push str.fille_client_info_wait_time_out_
call fcn.10013d73
pop ecx
push str._fci
push str.Softwareprojonepodlp_smpcache_
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x4c]
call fcn.1000316d
push 0
push 1
lea esi, [ebp - 0x48]
call fcn.1000233d
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000233d
call fcn.10032e7d
ret
Function at 0x100052ab
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x1004a8ef
call fcn.10032dfa
push str.init_hardware_custom_info
call fcn.10013975
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10003183
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x100052da
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100052f2
push str.cstate_not_found
call fcn.10013d73
pop ecx
jmp 0x1000535c
lea eax, [ebp - 0x48]
push eax
lea esi, [ebp - 0x2c]
call fcn.10002038
push str.__hardwareCustom
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.1000596e
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000531b
lea eax, [ebp - 0x28]
push eax
call fcn.10025fe8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000533d
cmp eax, 0xffffffff
je 0x1000533d
push str.cstate__hardwareCustom_executed
call fcn.10013975
jmp 0x10005347
push str.cstate__hardwareCustom_exec_failed
call fcn.10013d73
pop ecx
lea eax, [ebp - 0x4c]
call fcn.1000316d
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000233d
push 0
push 1
lea esi, [ebp - 0x48]
call fcn.1000233d
call fcn.10032e7d
ret
Function at 0x1000572f
Capabilities:
Create thread

Disassembly:
push 0x14c
mov eax, 0x1004bbee
call fcn.10032dfa
xor edi, edi
push edi
mov esi, ecx
push edi
lea eax, [ebp - 0x70]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
call fcn.1001c8c4
push 2
pop ebx
mov dword [ebp - 4], ebx
cmp esi, edi
je 0x100057a6
push esi
lea ecx, [ebp - 0x54]
call fcn.10001fa2
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x34], 1
call fcn.1001884e
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x54]
push ecx
mov dword [ebp - 4], 4
push eax
mov dword [ebp - 0x34], 3
call fcn.100188b2
test al, al
je 0x100057a6
cmp byte [ebp - 0x68], 7
mov byte [ebp - 0x2d], 0
je 0x100057aa
mov byte [ebp - 0x2d], 1
test byte [ebp - 0x34], bl
je 0x100057be
and dword [ebp - 0x34], 0xfffffffd
lea eax, [ebp - 0x158]
call fcn.10005933
mov dword [ebp - 4], ebx
test byte [ebp - 0x34], 1
je 0x100057d2
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.10002245
cmp byte [ebp - 0x2d], 0
je 0x10005832
push esi
lea ecx, [ebp - 0x54]
call fcn.10001fa2
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 5
call fcn.100011b4
pop ecx
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 8
jb 0x10005804
mov eax, dword [eax + 4]
jmp 0x10005807
add eax, 4
push eax
push str.invalid_client_info:_s
call fcn.10013d73
pop ecx
pop ecx
push edi
push 1
lea esi, [ebp - 0x8c]
call fcn.1000233d
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.10002245
jmp 0x10005921
push str.BB68C37F
mov edi, str.Softwareprojonepodlp_smpcache_
push reloc.WS2_32.dll_bind
mov ecx, edi
lea esi, [ebp - 0x2c]
call fcn.10026e8b
mov eax, esi
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 7
call fcn.100011f4
push dword [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.1000609a
add esp, 0x14
mov bl, al
neg bl
push 0
sbb bl, bl
push 1
lea ecx, [ebp - 0x8c]
inc bl
mov byte [ebp - 4], 7
call fcn.10002245
test bl, bl
je 0x10005915
push str.client_info_changed__record_now
call fcn.10013975
pop ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa8]
call fcn.10001fa2
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 9
call fcn.100011b4
cmp dword [eax + 0x18], 8
pop ecx
jb 0x100058cb
mov eax, dword [eax + 4]
jmp 0x100058ce
add eax, 4
push 0
push eax
mov ebx, str.BB68C37F
mov esi, reloc.WS2_32.dll_bind
call fcn.10026d88
xor edi, edi
push edi
push 1
lea esi, [ebp - 0xc4]
call fcn.1000233d
push edi
push 1
lea ecx, [ebp - 0xa8]
call fcn.10002245
push edi
push edi
push edi
push 0x1000567e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000233d
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x70]
call fcn.1001bc27
call fcn.10032e7d
ret
Function at 0x10006232
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x42c
lea ebp, [esp - 4]
mov eax, dword [0x10061060]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push 0x44
mov eax, 0x10049944
call fcn.10032d91
and dword [ebp - 0x18], 0
mov esi, edx
cmp dword [esi + 0x14], 0xc8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
jbe 0x10006280
push 0x10050cd0
mov esi, edi
call fcn.10002018
mov eax, edi
jmp 0x10006372
xor eax, eax
push 0x40e
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.10033d90
add esp, 0xc
push 0x208
lea eax, [ebp + 0x1c]
mov edi, str.cachekvstore
push eax
mov ebx, edi
xor ecx, ecx
call fcn.10024e3c
push esi
lea ecx, [ebp - 0x34]
call fcn.100011b4
cmp dword [eax + 0x18], 8
pop ecx
jb 0x100062c4
mov eax, dword [eax + 4]
jmp 0x100062c7
add eax, 4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp + 0x1c]
push eax
call ebx
push 0
push 1
lea esi, [ebp - 0x34]
call fcn.1000233d
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10006364
lea eax, [ebp]
push 3
push eax
call fcn.100061d6
pop ecx
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x14], esi
je 0x10006354
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x10006311
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
lea eax, [ebp + 0x1c]
push eax
call ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x50]
call fcn.100011b4
cmp dword [eax + 0x18], 8
pop ecx
jb 0x1000633f
mov eax, dword [eax + 4]
jmp 0x10006342
add eax, 4
push eax
lea eax, [ebp + 0x1c]
push eax
call ebx
push esi
push 1
lea esi, [ebp - 0x50]
call fcn.1000233d
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea esi, [ebp]
call fcn.1000233d
mov esi, dword [ebp - 0x14]
lea eax, [ebp + 0x1c]
push eax
call fcn.10002018
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.1003186a
add ebp, 0x430
leave
ret

Function at 0x100064fd
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x10049921
call fcn.10032d91
call fcn.10006473
push 0
push str.OneClientWnd
mov edi, eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10006559
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10006540
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1000658e
push edi
push esi
call fcn.1002758e
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1000658e
push edi
push str._location_d
lea ecx, [ebp - 0x28]
call fcn.10026cac
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x10006578
mov eax, dword [eax + 4]
jmp 0x1000657b
add eax, 4
mov ecx, eax
call fcn.10006395
push 0
push 1
lea esi, [ebp - 0x28]
call fcn.1000233d
call fcn.10032e69
ret
Function at 0x100066f6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x10061060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x118
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.10033d90
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x124], 5
lea edi, [ebx + 0x3bc]
setne al
mov esi, 0x10051e00
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
dec eax
and eax, 3
add eax, 0x67
movsd dword es:[edi], dword [esi]
mov word [ebx + 0x3d4], ax
mov eax, dword [ebx]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x14]
xor esi, esi
push eax
inc esi
push 2
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x24], 0x412
mov dword [ebx + 0x20], 0x20
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0x1388
push esi
push dword [ebx]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, ebx
call fcn.1000695e
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003186a
leave
ret
Function at 0x100067ab
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x1004b235
call fcn.10032d91
push str.CryptEnabled
call fcn.100061f3
neg eax
sbb eax, eax
neg eax
pop ecx
jne 0x100067d4
push 0x10051f2c
jmp 0x1000694c
lea eax, [ebp - 0x54]
push str.Softwareprojonepodlpkeyrulemain_
push eax
call fcn.1002a0f9
mov eax, dword [eax + 0x1c]
pop ecx
pop ecx
xor ecx, ecx
cmp ecx, eax
lea eax, [ebp - 0x54]
sbb esi, esi
push eax
neg esi
call fcn.1000bbe1
test esi, esi
jne 0x10006811
push 0x10051f38
push dword [ebp + 8]
call fcn.10002316
xor eax, eax
inc eax
jmp 0x10006956
push 0x10051f44
lea ecx, [ebp - 0x34]
call fcn.10001fa2
and dword [ebp - 4], 0
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x50]
call fcn.10006232
cmp dword [eax + 0x18], 8
jb 0x10006838
mov eax, dword [eax + 4]
jmp 0x1000683b
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
test eax, eax
push 1
lea esi, [ebp - 0x50]
setne bl
call fcn.1000233d
push 0
test bl, bl
sete bl
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call fcn.10002245
test bl, bl
je 0x10006881
push 0x10051f48
push dword [ebp + 8]
call fcn.10002316
push 2
pop eax
jmp 0x10006956
push str.PersonMode
call fcn.100061f3
pop ecx
test eax, eax
je 0x100068a1
push 0x10051f70
push dword [ebp + 8]
call fcn.10002316
push 3
jmp 0x1000687b
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push str.dlpOnline
push str.Softwareprojonepodlpdlpcore_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100068d6
cmp dword [ebp - 0x14], esi
jne 0x100068d6
mov eax, dword [ebp - 0x18]
jmp 0x100068d9
xor eax, eax
inc eax
test eax, eax
jne 0x100068ee
push 0x10051fd0
push dword [ebp + 8]
call fcn.10002316
mov eax, esi
jmp 0x10006956
mov esi, str.CryptoMode
push esi
call fcn.100061f3
pop ecx
cmp eax, 2
jne 0x10006906
push 0x10051ffc
jmp 0x1000694c
push esi
call fcn.100061f3
pop ecx
test eax, eax
jne 0x10006947
call fcn.100273ac
test eax, eax
je 0x10006933
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call fcn.10029f02
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x10]
pop ecx
jne 0x10006947
push 0x10052008
push dword [ebp + 8]
call fcn.10002316
push 5
jmp 0x1000687b
push str.ck8
push dword [ebp + 8]
call fcn.10002316
xor eax, eax
call fcn.10032e69
ret 4
Function at 0x100074aa
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x1004a8b2
call fcn.10032dfa
lea ecx, [ebp - 0x2c]
call fcn.10003183
xor esi, esi
push 8
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
pop ebx
cmp dword [ebp - 0x14], ebx
jae 0x100074d1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
test eax, eax
je 0x10007686
push str..orp
mov edi, closesocket
push edi
call fcn.10027166
add esp, 0xc
test al, al
jne 0x10007524
push str.register_.orp_handler
call fcn.10013975
mov eax, dword [ebp - 0x28]
pop ecx
cmp dword [ebp - 0x14], ebx
jae 0x1000750e
lea eax, [ebp - 0x28]
push 0x65
mov ebx, str.offlineRule
push eax
mov edx, ebx
mov ecx, str..orp
call fcn.10027415
jmp 0x10007596
push esi
push edi
mov ecx, str.offlineRule_shellopencommand
lea esi, [ebp - 0x48]
call fcn.10026e8b
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
jae 0x10007544
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], ebx
jae 0x1000754f
lea eax, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, str.offlineRule
test eax, eax
jne 0x10007586
push str.register_.orp_handler_due_to_path_not_matched
call fcn.10013975
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x10007577
lea eax, [ebp - 0x28]
push 0x65
push eax
mov edx, ebx
mov ecx, str..orp
call fcn.10027415
push 0
push 1
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.1000233d
push 0
mov esi, str..orp2
push esi
push edi
call fcn.10027166
add esp, 0xc
test al, al
jne 0x100075ce
push str.register_.orp2_handler
call fcn.10013975
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x100075c2
lea eax, [ebp - 0x28]
push 0x65
push eax
mov edx, ebx
mov ecx, esi
call fcn.10027415
call fcn.10015e47
test eax, eax
je 0x10007684
push 0
mov ebx, str..oml
push ebx
push edi
call fcn.10027166
add esp, 0xc
test al, al
jne 0x10007618
push str.register_.oml_handler
call fcn.10013975
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x10007607
lea eax, [ebp - 0x28]
push 0x66
push eax
mov edx, str.offlineLicense
mov ecx, ebx
call fcn.10027415
jmp 0x10007684
push 0
push edi
mov ecx, str.offlineLicense_shellopencommand
lea esi, [ebp - 0x48]
call fcn.10026e8b
pop ecx
pop ecx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x1000763a
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10007646
lea eax, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x10007678
push str.register_.oml_handler_due_to_path_not_matched
call fcn.10013975
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x10007669
lea eax, [ebp - 0x28]
push 0x66
push eax
mov edx, str.offlineLicense
mov ecx, ebx
call fcn.10027415
push 0
push 1
lea esi, [ebp - 0x48]
call fcn.1000233d
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000233d
call fcn.10032e7d
ret
Function at 0x1000778a
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x10061060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x41c], 0
mov eax, str.clientinfo.exe
mov dword [ebp - 0x480], eax
mov ecx, str.cstate.exe
mov dword [ebp - 0x478], eax
mov eax, str.clientstat.exe
push ebx
push esi
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], eax
mov eax, str.poda32.exe
mov edx, str.pobus32.exe
mov ecx, str.pobus64.exe
push edi
mov dword [ebp - 0x498], str.aspda.exe
mov dword [ebp - 0x494], str.assistda.exe
mov dword [ebp - 0x490], str.asphost.exe
mov dword [ebp - 0x48c], str.assisthost.exe
mov dword [ebp - 0x488], str.asphs.exe
mov dword [ebp - 0x484], str.assisths.exe
mov dword [ebp - 0x468], str.poagent32.exe
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], str.poagent64.exe
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], str.pohost32.exe
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], str.pohost64.exe
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x448], str.rcserver.exe
mov dword [ebp - 0x444], str.assists.exe
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x43c], str.gxbus32.exe
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], str.gxbus64.exe
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], str.gxda32.exe
mov dword [ebp - 0x428], str.poda64.exe
mov dword [ebp - 0x424], str.gxda64.exe
mov edi, 0x206
mov esi, 0x104
xor eax, eax
push edi
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.10033d90
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10033d90
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x41c]
mov ebx, dword [ebp + eax*8 - 0x494]
xor ecx, ecx
call fcn.10024e3c
push esi
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x41c]
mov ebx, dword [ebp + eax*8 - 0x498]
xor ecx, ecx
call fcn.10024e3c
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x418]
push eax
call ebx
test eax, eax
je 0x10007973
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
je 0x10007973
lea eax, [ebp - 0x210]
push eax
push str.delete_old_file:__s
call fcn.10013ae0
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [ebp - 0x41c]
cmp dword [ebp - 0x41c], 0xf
jb 0x100078c7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003186a
leave
ret
Function at 0x10008bf2
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0x48
mov eax, 0x10049264
call fcn.10032d91
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
call fcn.10002068
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
xor edi, edi
push 0x10
mov dword [ebp - 4], ebx
inc edi
push ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov esi, dword [ebp - 0x14]
push 4
call fcn.10031e2e
pop ecx
cmp eax, ebx
je 0x10008c3e
lea ecx, [ebp - 0x38]
mov dword [eax], ecx
jmp 0x10008c40
xor eax, eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0xd]
mov dword [ebp - 4], edi
mov byte [ebp - 0xd], bl
push eax
mov eax, esi
lea ebx, [ebp - 0x38]
call fcn.100090e0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
mov esi, eax
cmp eax, dword [ebp - 0x28]
jbe 0x10008c6d
call fcn.10031d00
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], esi
lea esi, [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.1000d5a3
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
xor esi, esi
push esi
push 0x10
push esi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x10008ce4
cmp ebx, esi
je 0x10008ce4
mov esi, dword [ebx + 0x1c]
jmp 0x10008cd9
mov eax, dword [esi + 0xc]
cmp word [eax], 2
jne 0x10008cd6
push dword [eax + 4]
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [ebp - 0x54]
call fcn.10001fa2
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 3
push eax
mov eax, dword [ebp + 8]
call fcn.100020b3
push 0
push edi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.10002245
mov esi, dword [esi + 8]
test esi, esi
jne 0x10008c9d
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x10008c98
cmp dword [ebp - 0x2c], esi
je 0x10008cf2
push dword [ebp - 0x2c]
call fcn.10031d3a
pop ecx
push dword [ebp - 0x38]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call fcn.10031d3a
mov eax, dword [ebp + 8]
pop ecx
call fcn.10032e69
ret

Function at 0x10008de3
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
cmp dword [0x1006b5a8], edi
jne 0x10008e30
mov dword [0x1006b5a8], 1
call fcn.10008d0d
xor esi, esi
push edi
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push esi
push 0x10008a8e
push edi
push edi
mov dword [esi*4 + 0x1006b59c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 3
jl 0x10008e01
pop edi
pop esi
pop ecx
ret
Function at 0x1000a285
Capabilities:
Check if file exists

Disassembly:
push 0x88
mov eax, 0x1004d3c7
call fcn.10032dfa
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], ecx
cmp eax, ebx
je 0x1000a2dd
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000a2dd
push 1
lea ecx, [ebp - 0x30]
call fcn.100154b3
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1000a2c8
lea eax, [ebp - 0x2c]
push ebx
call fcn.1002553d
test eax, eax
jne 0x1000a2e5
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10002245
xor al, al
call fcn.10032e7d
ret
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1000a2f1
lea eax, [ebp - 0x2c]
push 0x32e3
push eax
push str.https:___s:_d_globalSmallFile
lea esi, [ebp - 0x4c]
call fcn.10026d0a
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 0x94]
call fcn.1001c8c4
sub esp, 0x18
mov byte [ebp - 4], 4
mov esi, esp
mov dword [ebp - 0x70], esp
push str.hardwareinfo
call fcn.1001b9d6
lea eax, [ebp - 0x94]
push eax
mov edx, str.type
mov byte [ebp - 4], 5
call fcn.1001cb62
mov edi, eax
mov byte [ebp - 4], 4
call fcn.1001bcaa
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x70], esp
push dword [ebp - 0x74]
call fcn.1001b9d6
lea eax, [ebp - 0x94]
push eax
mov edx, str.name
mov byte [ebp - 4], 6
call fcn.1001cb62
mov edi, eax
mov byte [ebp - 4], 4
call fcn.1001bcaa
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x70], esp
push ebx
call fcn.1001b991
lea eax, [ebp - 0x94]
push eax
mov edx, str.clean
mov byte [ebp - 4], 7
call fcn.1001cb62
mov edi, eax
mov byte [ebp - 4], 4
call fcn.1001bcaa
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x68]
call fcn.1001cfe3
mov byte [ebp - 4], 8
cmp dword [ebp - 0x50], 0x10
mov ecx, dword [ebp - 0x64]
jae 0x1000a3c7
lea ecx, [ebp - 0x64]
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x1000a3d3
lea eax, [ebp - 0x48]
push ebx
push ebx
push ebx
push ebx
push ecx
push str.desc
push dword [ebp - 0x78]
push str.file
push eax
call fcn.10013f6e
push ebx
test eax, eax
push 1
lea ecx, [ebp - 0x68]
setne byte [ebp - 0x69]
call fcn.10002245
lea esi, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.1001bc27
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.10002245
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10002245
mov al, byte [ebp - 0x69]
jmp 0x1000a2df