joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068290
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x100682c0
mov edi, str.360SE.EXE
mov dword [ebp - 0x418], str.360SE_Browser
jmp 0x100682cf
mov edi, str.IEXPLORE.EXE
mov dword [ebp - 0x418], str.Internet_Explorer
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.102134e7
add esp, 0xc
lea eax, [ebx + 0x1c]
test esi, esi
jne 0x100682ef
lea eax, [ebx + 4]
cmp dword [eax + 0x14], 8
jb 0x100682f7
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1020eeb0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0x18
test esi, esi
je 0x10068432
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068330
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0x10219d7c
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push edi
push str.SOFTWAREClientsStartMenuInternet
push 0x1021b408
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.10068700
mov edx, dword [ebp - 0x418]
add esp, 0x14
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068387
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push 1
push 0x10219d7c
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.shellopencommand
push edi
push str.SOFTWAREClientsStartMenuInternet
push 0x1021bd0c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.10068700
lea ecx, [ebp - 0x414]
add esp, 0x18
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100683e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0x10219d7c
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClientsStartMenuInternet
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x18
push str.IEXPLORE.EXE
push 1
push 0x10219d7c
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x18
push str.IEXPLORE.EXE
push 1
push 0x10219d7c
push str.SOFTWAREClientsStartMenuInternet
push SysReAllocString
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
Function at 0x1007a390
Capabilities:
Get common file path
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
add ebx, 0x90
push edi
mov dword [ebp - 0x428], esi
mov edi, dword [esi]
add edi, 0xc0
cmp dword [ebx + 4], 0
jne 0x1007a4dd
mov eax, dword [0x1025a378]
cmp eax, 0xffffffff
je 0x1007a430
cmp dword [0x1025a37c], 0xffffffff
je 0x1007a430
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x1007a432
mov eax, dword [0x1025a380]
test eax, eax
je 0x1007a432
lea ecx, [ebp - 0x420]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025a378]
call esi
push dword [ebp - 0x420]
push dword [0x1025a37c]
call esi
mov esi, dword [ebp - 0x424]
jmp 0x1007a432
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.102134e7
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1007a48d
lea eax, [ebx + 8]
push eax
push ebx
push 0x100
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1008fd30
add esp, 0x14
push 0
push 0x19
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1007a4bf
lea eax, [ebx + 8]
push eax
push ebx
push 0x100
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1008fd30
add esp, 0x14
push esi
mov ecx, 0x1025a378
call fcn.10009a80
cmp dword [ebx + 4], 0
jne 0x1007a4d7
xor bl, bl
jmp 0x1007a55f
mov esi, dword [ebp - 0x428]
test edi, edi
je 0x1007a4e8
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea eax, [ebp - 0x41c]
mov ecx, edi
push eax
call fcn.1007f440
cmp dword [ebp - 0x418], 0
je 0x1007a52b
push dword [ebp + 8]
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x41c]
push 0x100
push eax
call fcn.10099680
test al, al
jne 0x1007a51f
xor bl, bl
jmp 0x1007a52d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x418]
add dword [ecx + 0x1c], eax
mov bl, 1
mov eax, dword [ebp - 0x41c]
push dword [eax + 4]
lea eax, [ebp - 0x41c]
push eax
mov ecx, eax
call fcn.10020a40
push 0x40
push dword [ebp - 0x41c]
call fcn.102134ff
add esp, 8
test edi, edi
je 0x1007a55f
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1007a587
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1007a587
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x1007a587
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 8
Function at 0x1007a5a0
Capabilities:
Get common file path
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
add ebx, 0xa0
push edi
mov dword [ebp - 0x220], esi
mov edi, dword [esi]
add edi, 0xe0
cmp dword [ebx + 4], 0
jne 0x1007a70c
mov eax, dword [0x1025a378]
cmp eax, 0xffffffff
je 0x1007a638
cmp dword [0x1025a37c], 0xffffffff
je 0x1007a638
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], 0
test eax, eax
jne 0x1007a642
mov eax, dword [0x1025a380]
test eax, eax
je 0x1007a642
lea ecx, [ebp - 0x218]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025a378]
call esi
push dword [ebp - 0x218]
push dword [0x1025a37c]
call esi
jmp 0x1007a642
mov dword [ebp - 0x21c], 0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0xc
call fcn.100e9430
test eax, eax
je 0x1007a6a5
push 2
call fcn.100e67d0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.10004ba0
lea esi, [eax + 0x10]
lea eax, [ebx + 8]
push eax
push ebx
push 0x200
push 0
push esi
call fcn.1008fd30
add esp, 0x1c
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1007a6e9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1007a6e9
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1007a6ce
push str.MicrosoftInternet_ExplorerQuick_Launch_
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebx + 8]
push eax
push ebx
push 0x200
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1008fd30
add esp, 0x14
push dword [ebp - 0x21c]
mov ecx, 0x1025a378
call fcn.10009a80
cmp dword [ebx + 4], 0
jne 0x1007a706
xor bl, bl
jmp 0x1007a78e
mov esi, dword [ebp - 0x220]
test edi, edi
je 0x1007a717
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
call fcn.1007f440
cmp dword [ebp - 0x210], 0
je 0x1007a75a
push dword [ebp + 8]
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x214]
push 0x200
push eax
call fcn.10099680
test al, al
jne 0x1007a74e
xor bl, bl
jmp 0x1007a75c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x210]
add dword [ecx + 0x1c], eax
mov bl, 1
mov eax, dword [ebp - 0x214]
push dword [eax + 4]
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
call fcn.10020a40
push 0x40
push dword [ebp - 0x214]
call fcn.102134ff
add esp, 8
test edi, edi
je 0x1007a78e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1007a7b6
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1007a7b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x1007a7b6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 8
Function at 0x10084940
Capabilities:
Get common file path
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
je 0x1008496d
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1025a378]
push esi
cmp eax, 0xffffffff
je 0x100849cf
cmp dword [0x1025a37c], 0xffffffff
je 0x100849cf
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], esi
test esi, esi
jne 0x100849d9
mov eax, dword [0x1025a380]
test eax, eax
je 0x100849d9
lea ecx, [ebp - 0x210]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025a378]
call esi
push dword [ebp - 0x210]
push dword [0x1025a37c]
call esi
jmp 0x100849d9
mov dword [ebp - 0x214], 0
call fcn.100e9430
test eax, eax
je 0x10084a24
push 1
call fcn.100e67d0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.10004ba0
lea esi, [eax + 0x10]
lea eax, [ebx + 8]
push eax
push ebx
push 0x400
push 0
push esi
call fcn.1008fd30
add esp, 0x1c
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10084a24
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
call fcn.100e9490
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10084a82
xor eax, eax
lea edi, [ebp - 0x20c]
push eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
test eax, eax
je 0x10084a82
push str.MicrosoftWindowsStart_MenuProgramsAccessories_
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebx + 8]
push eax
push ebx
push 0x400
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1008fd30
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x20c]
push eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
lea esi, [ebx + 8]
test eax, eax
je 0x10084abe
push esi
push ebx
push 0x400
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.1008fd30
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x20c]
push eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
push 0x16
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop edi
test eax, eax
je 0x10084afc
push esi
push ebx
push 0x400
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.1008fd30
add esp, 0x14
push dword [ebp - 0x214]
mov ecx, 0x1025a378
call fcn.10009a80
cmp dword [ebx + 4], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret
Function at 0x1009cee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x11
lea esi, [ebp + 8]
lea edi, [ebp - 0x8c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x11
lea esi, [ebp + 0x4c]
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x90]
mov edx, dword [ebp - 8]
mov dword [esi + 0x40], edx
test edx, edx
jle 0x1009cf43
jmp 0x1009cf30
mov cl, byte [ebp + eax - 0x48]
xor cl, byte [ebp + eax - 0x8c]
mov byte [esi + eax], cl
inc eax
cmp eax, edx
jl 0x1009cf30
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10212f74
mov esp, ebp
pop ebp
ret
Function at 0x1009eac0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x1009ec1b
mov eax, dword [ebp - 0x214]
xor esi, esi
test eax, eax
je 0x1009eb4c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
test esi, esi
jne 0x1009ec1b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x1009ebe7
lea esp, [esp]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.1009eac0
mov esi, eax
test esi, esi
jne 0x1009ec1b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x208], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1009eba0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x1009ebfe
push eax
call ebx
mov dword [ebp - 0x214], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], 0
call fcn.1009e3d0
mov esi, eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x1009ec28
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
Function at 0x1009ede0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [0x10219950]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x1009ee50
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1009ee50
call fcn.1009e300
mov esi, eax
jmp 0x1009ef3c
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1009ee73
call fcn.1009e300
jmp 0x1009ef2f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1009ee8b
call fcn.1009e300
jmp 0x1009ef2f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x1009eea6
mov esi, 0x8007000e
jmp 0x1009ef31
mov ecx, 2
mul ecx
test edx, edx
ja 0x1009ef6a
jb 0x1009eec0
cmp eax, 0xffffffff
ja 0x1009ef6a
cmp eax, 0x400
jbe 0x1009eee3
push eax
lea ecx, [ebp - 0x408]
call fcn.10025720
cmp dword [ebp - 0x408], 0
jne 0x1009eeef
mov esi, 0x8007000e
jmp 0x1009ef31
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1009ef0f
call fcn.1009e300
jmp 0x1009ef2f
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.1009ec40
mov esi, eax
test edi, edi
je 0x1009ef3c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x1009ef55
lea ecx, [ebp - 0x408]
call fcn.100265c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.100030c0
int3
Function at 0x100c6b80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x10256bfc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100c6c89
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 8]
push 0x10219d7c
mov dword [ebp - 8], eax
call fcn.10004a70
test al, al
jne 0x100c6bcb
push 0
push 0x10219d7c
lea ecx, [ebp - 8]
call fcn.10004050
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x100c6bda
push 0x10256bf0
jmp 0x100c6be4
cmp eax, 2
jne 0x100c6bec
push 0x10256bf4
lea ecx, [ebp - 8]
call fcn.10004870
push esi
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x100c6c61
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push esi
push dword [0x10256bec]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100c6c35
add dword [ebp - 4], ecx
jmp 0x100c6c45
mov eax, dword [ebp - 4]
test eax, eax
jle 0x100c6c61
test ecx, ecx
jns 0x100c6c61
add eax, ecx
mov dword [ebp - 4], eax
js 0x100c6c61
push 4
lea eax, [ebp - 4]
push eax
push 4
push esi
push dword [0x10256bec]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100c6c79
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10256bfc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100030c0
int3
Function at 0x100d6220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push 0x18
mov dword [esi], vtable.CExtAntiPluginBase.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.10213511
push 0x20
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.10213511
xor ecx, ecx
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x28], eax
lea eax, [esi + 0x3c]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push ecx
mov dword [eax + 0x10], ecx
push eax
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x100d62fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100d62f4
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100d646c
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
push 0x18
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.10213511
push 0x18
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
call fcn.10213511
push 0x1c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x70], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
call fcn.10213511
push 0x28
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
call fcn.10213511
push 0x28
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0xa4], eax
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
call fcn.10213511
add esp, 0x14
mov dword [eax], eax
push 0
push 1
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 1
mov dword [esi + 0xac], eax
push 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x54], eax
mov eax, esi
pop esi
ret
push eax
call fcn.100030c0
int3
Function at 0x100e4020
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push esi
push eax
call fcn.100e6750
mov esi, eax
add esp, 4
mov ecx, dword [esi]
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x100e4049
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x100e405f
call fcn.10003980
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x100e4101
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [esi]
push 0x16
push str._safemon360Cactus.tpi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.100258c0
mov edx, dword [ebp - 8]
or edi, 0xffffffff
add esp, 0x14
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100e40a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100e40e6
call fcn.100a43d0
test eax, eax
je 0x100e40e6
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
push esi
mov ecx, 0x1024ea08
call fcn.101cb6f0
test eax, eax
je 0x100e40e6
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x100e40e6
cmp eax, 0xffffffff
je 0x100e40e6
mov byte [0x10258384], 1
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
pop edi
jg 0x100e40fc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100030c0
int3

Function at 0x100e4360
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
push edi
mov edi, dword [ebp + 8]
push SysReAllocString
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x100e43c2
push esi
push SysReAllocString
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100e43bb
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x100e43d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x100e4465
cmp word [esi], 0
je 0x100e4465
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100e43f0
sub eax, edx
xor ecx, ecx
sar eax, 1
mov edx, 2
lea ebx, [eax + 1]
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10213535
mov edi, eax
add esp, 4
test edi, edi
je 0x100e4465
push esi
push ebx
push edi
call fcn.1020eeb0
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x100e444e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100e444e
push edi
call fcn.100e43d0
add esp, 4
push edi
call fcn.10213517
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret