joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a7c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
and byte [ebp - 0x10], 0
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0xf]
and byte [ebp - 0x618], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
push dword [ebp + 8]
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x617]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x618]
push 0x400
push eax
push 0x404284
push str.NotUseDefaultDllPath
push 0x404240
call ebx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push 0xa
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401de7
cmp byte [ebp - 0x10], 0x31
jne 0x401b09
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00401e7a
jmp 0x401bdf
and byte [ebp - 0x218], 0
push esi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
mov esi, 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x218]
push esi
push eax
push 0
push str.DllPath
push str.DefaultValue
call ebx
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push dword [ebp + 0xc]
push eax
call fcn.00401d63
lea eax, [ebp - 0x114]
pop esi
test eax, eax
je 0x401b99
lea eax, [ebp - 0x114]
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
pop ecx
test eax, eax
pop ecx
jne 0x401bab
cmp byte [ebp - 0x114], 0x5c
je 0x401bab
push dword [ebp + 0x14]
lea eax, [ebp - 0x114]
push dword [ebp + 0x10]
push eax
jmp 0x401af9
cmp dword [ebp + 0x10], 0
je 0x401bdf
cmp dword [ebp + 0x14], 0
jle 0x401bdf
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, dword [ebp + 0x14]
pop ecx
jae 0x401bdf
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [0x40401c]
add esp, 0xc
pop edi
pop ebx
leave
ret 0x10
Function at 0x401be5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x104]
push 0x104
xor edi, edi
push eax
push edi
push str.Path
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x104]
test ecx, ecx
je 0x401ca2
mov cl, byte [ebp - 0x104]
test cl, cl
je 0x401ca2
cmp cl, 0x20
je 0x401c51
cmp cl, 9
jne 0x401c57
mov cl, byte [eax + 1]
inc eax
jmp 0x401c43
lea eax, [ebp - 0x104]
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
pop ecx
test eax, eax
pop ecx
jne 0x401c8c
cmp byte [ebp - 0x104], 0x5c
je 0x401c8c
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
mov ecx, ebx
push dword [ebp + 0xc]
push eax
push esi
call fcn.00401e7a
jmp 0x401ccc
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
mov ecx, ebx
push dword [ebp + 0xc]
push eax
call fcn.00401be5
jmp 0x401ccc
cmp dword [ebp + 0xc], edi
je 0x401ccc
cmp dword [ebp + 0x10], edi
jle 0x401ccc
cmp esi, edi
je 0x401ccc
push esi
call sub.MSVCRT.dll_strlen
cmp eax, dword [ebp + 0x10]
pop ecx
jae 0x401ccc
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [0x40401c]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40240d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
mov byte [ebp - 0x400], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x4024b9
mov esi, 0x400
lea ecx, [ebp - 0x400]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40246e
lea eax, [ebp - 0x400]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x40246e
mov byte [eax + 1], bl
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x4024b9
push esi
lea eax, [ebp - 0x400]
push str.UpdateUpdate.exe
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcat]
add esp, 0xc
test eax, eax
je 0x4024b9
push 1
push ebx
lea eax, [ebp - 0x400]
push str._CreateResourceOnly
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
pop eax
jmp 0x4024bb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100338e8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10033927
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10033927
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10033927
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10033927
cmp dword [ecx + 0x74], 0xe
jbe 0x10033927
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10034e9b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100487a8
push 0x100487a0
push str.FlsAlloc
push 0x1f
call fcn.10034db7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034ecf
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004319c]
call esi
jmp 0x10034ed5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10034f19
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100487b8
push 0x100487b0
push str.FlsGetValue
push 0x21
call fcn.10034db7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034f50
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004319c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10034f58
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100487c0
push 0x100487b8
push str.FlsSetValue
push 0x22
call fcn.10034db7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034f92
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1004319c]
call esi
pop esi
pop ebp
ret 8
pop esi
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10039d86
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
adc byte [ebx + 0xff685f0], cl
invalid
test dword [eax], eax
add byte [eax], al
push ebx
push esi
call fcn.10039d4f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10038ca1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039dd0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10039e22
push edi
push eax
call fcn.1003564a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10039df0
call fcn.10034c64
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10039e21
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10038ca1
add esp, 0x20
test eax, eax
jne 0x10039e0f
push edi
call fcn.10034c64
jmp 0x10039e17
push ebx
call fcn.10034c64
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1003f6c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003f6ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003f6ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1005ebf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x1005ed52
cmp edi, esi
je 0x1005ed52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x1005ed42
add edi, 4
jmp 0x1005eca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1005ecb8
mov dword [ebp - 4], 2
jmp 0x1005ecd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1005eccf
mov dword [ebp - 4], 1
jmp 0x1005ecd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1005ed52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x1005ed10
mov byte [ecx + 2], 0x3d
jmp 0x1005ed1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x1005ed2c
mov byte [ecx], 0x3d
jmp 0x1005ed32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1005eca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10138b6f
Capabilities:
Authenticate hmac

Disassembly:
or cl, 0x6a
mov ecx, dword [ebp]
cmp bh, 0x37
test bh, 0xcc
lea ebp, [ebp + 4]
lodsd eax, dword [esi]
add al, 0
add byte [eax], al
test edx, ebx
xor ecx, ebx
add ecx, 0x256d20f9
stc
ror ecx, 1
xor ecx, 0x3f67260e
aas
cmp esi, eax
neg ecx
clc
ror ecx, 3
jmp 0x1026f875
push ebp
pushfd
mov ebp, 0x59c702c3
call fcn.1023cba4
dec eax
jno 0x10138b60
lcall 0xf972, 0x7e2cef8d
jl 0x10138b4a
jge 0x10138b90
in al, 0x5b
test byte [ecx + 0x2306f4fb], 0x82
sti
fld dword [edi + 0x34]
push es
and eax, dword [edx + 0x3447d9fb]
jle 0x10138baf
mov byte [0x8d7e2671], al
int1
mov byte [edx], bl
jle 0x10138b51
push ecx
lds eax, [esi]
sub dh, 0x36
cmp ecx, dword [edi]
jle 0x10138bd6
sbb dh, bh
out dx, eax
jge 0x10138bf7
cmp esi, ebp
add dword [edx + 0x78d3974], eax
jle 0x10138b3c
xchg dword [esi - 0x6c9f8b27], esi
dec esp
retf
bound edx, qword [eax]
invalid
jb 0x10138c39
sub eax, dword [ebx]
fst dword [ebp + 0x1c]
mov ch, 0x9f
hlt
insb byte es:[edi], dx
xchg byte [edi - 0x155c8d50], dl
xor dword [esi], 0xffffffbc
js 0x10138ba4
inc edx
inc edx
ror dword [edi - 0xb], 0xdb
or esi, ebx
push eax
imul ecx, dword [0x9e5405a4], 0x4d5306f2
push esp
and edx, dword [ebx + 0x6c1f4fe1]
loope 0x10138c8a
pop ds
insb byte es:[edi], dx
xchg esi, eax
sbb dword [edx - 0x7a], 0xcd9ceb8d
stosd dword es:[edi], eax
jo 0x10138cb2
xlatb
out 0x68, eax
mov byte [esi], 0x90
dec ecx
call 0xa67c219e
cld
mov byte [0x20eba43e], al
mov dl, 0x91
test dword [ebp - 0x4b], edi
xchg edx, eax
lodsd eax, dword [esi]
mov ecx, 0x526e9d57
out 0x96, eax
xchg esi, eax
call 0x1d05da39
call 0x1d05da39
mov esi, 0x77a10642
aad 0x72
out 0x14, al
cmp dword [esi + 0x3a], ebp
cmc
dec edi
jle 0x10138c15
jmp 0x10138caa
cwde
retf
jle 0x10138c6b
cld
push ebp
dec ebx
push eax
pop ebx
fdiv dword [edi - 0x4031e105]
mov ah, 0x42
pop ds
invalid
mov bh, 0xfb
push ds
into
mov edi, 0x8e1f42b4
mov cl, 0xe
invalid
xor ebx, ecx
add esi, ecx
jmp 0x10332937
inc ecx
jmp 0x10210506
jmp esi

Function at 0x102b5cfe
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x6b13d
mov eax, dword [esp + 0x10]
sub word [esp + 0x10], 0x173e
pop ss
xor cl, byte [esp + 0x12]
and word [esp + 0x10], 0x5702
call fcn.1033487b
por mm7, qword [edi]
fidivr word [ecx + 0x39]
psubusw mm6, qword [edx]
xchg byte [0x923d8b22], bl
aad 0x88
mov eax, dword [0x810572b6]
sbb dword [esi], eax
sub al, byte [ebp - 0x7cb0de93]
clc
lds esi, [esi + 0x7b]
jbe 0x102b5d10
shl dword [edi], 1
invalid

Function at 0x10319802
Capabilities:
Encode data using xor

Disassembly:
call fcn.10139dab
clc
dec eax
or ah, byte [esi - 0x46bfe051]
mov esi, 0xd7025149
mov ecx, 0xc2eb3717
scasb al, byte es:[edi]
sbb dword [ebx], esp
invalid

Function at 0x1031f7f4
Capabilities:
Encode data using xor

Disassembly:
call fcn.100d01ab
xor al, 6
jo fcn.1031f7f4
ret
Function at 0x103c2e48
Capabilities:
Encode data using xor

Disassembly:
bswap ebx
call fcn.101e1aa8
dec ecx
jmp 0x1024644a
jne 0x1039e3bb
pop esi
stc
rol cl, 0x39
shrd cx, dx, 0xb0
not edx
or ecx, ebp
shr cl, cl
mov dword [ebp], edx
lea edi, [edi - 4]
setns ch
mov ecx, dword [edi]
test eax, 0x7e2a0c3b
xor ecx, ebx
jmp 0x1033878d
inc eax
jmp 0x1038ed95
ror ecx, 1
clc
sub ecx, 0x48ec4f5b
not ecx
ror ecx, 1
xor ebx, ecx
stc
clc
add esi, ecx
jmp esi
xor edx, 0x31bf727b
jmp 0x100c0f7d
movzx esi, byte [eax]
test si, 0x408e
xor esi, edx
cmp eax, ebx
and esi, 0xff
cmp cx, 0x169f
clc
mov esi, dword [esi*4 + 0x101f61c0]
shr edx, 8
cmp ah, 6
xor edx, esi
jmp 0x102e9663
and dword [esp + 0x18], 0x710d16a1
test byte [esp + 0x18], dh
mov edx, dword [esp + 0x30]
push esp
and al, 0x30
jb 0x100c0f76
call fcn.102b50d0
mov eax, 0xc1abf007
sbb byte [edx*2 - 0x17767c6], cl
or al, 0xd4
out 0x4a, eax
std
mov dword [0x9854e945], eax
mov esi, 0x2a096345
call 0x4c659eae
push ebp
cmp bh, ch
xor byte [edi - 0x1a5045a3], al
adc dword [edi], esp
push esp
stosd dword es:[edi], eax
mov byte [0xe2bcbe8], al
aaa
mov ebp, dword [ecx - 0x46]
mov esp, 0xd44d0cb6
inc edi
adc byte [ebx - 0x7d9546b4], 0x21
mov ebp, 0x20953526
or eax, 0x72c80483
push esp
add bl, byte [edi + 0x62]
mov bl, 0x86
dec ecx
xor word [edi + 0x2803680c], bp
jb 0x103c2e55
daa
test eax, 0xd35724e6
push ebp
or ecx, dword [eax]
jmp esp

Function at 0x10a1a904
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x109efece
mov eax, dword [eax + ecx + 0x7c]
push ebx
jmp 0x10a37251
ret
mov dword [ebp - 4], edx
cmp ah, 0x74
cmc
test edx, edx
jmp 0x10483a26
ja 0x10a17e35
mov eax, esi
clc
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x10957c95
je 0x109fa5c6
sub eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0x108aed47
mov eax, dword [ecx + 0x3c]
test esi, 0x2a0a5ca9
cmp dword [eax + ecx], 0x4550
jmp 0x10a91948
mov edi, dword [edx + ecx + 0x18]
test sp, 0x602c
test edi, edi
jmp 0x10990f6a
push ebp
mov ebp, esp
bsr ecx, edx
mov ecx, dword [ebp + 8]
stc
sub esp, 0x114
clc
cmp eax, 0x1281798
test dx, bx
push esi
test ecx, ecx
je 0x109efece
mov esi, dword [ebp + 0xc]
clc
cmp bx, bx
stc
test esi, esi
jmp 0x10ad590b
push edi
mov dword [ebp - 0x10], eax
cmp dx, 0x20ac
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x1099c870
jne 0x109efece
mov edx, dword [eax + ecx + 0x78]
jmp 0x1091884d
je 0x109efece
mov eax, 0x5a4d
cmc
test bl, 0x43
cmp word [ecx], ax
jmp 0x109efec8
Function at 0x10024ad
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100923c]
push esi
push edi
mov dword [ebp - 4], eax
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001730
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
push 1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.ADVPACK.dll_GetVersionFromFile
mov eax, dword [ebp - 0x10c]
cmp eax, 0x40047
pop edi
pop esi
jae 0x100252d
xor eax, eax
jmp 0x1002552
cmp eax, 0x50000
jae 0x1002539
xor eax, eax
inc eax
jmp 0x1002552
cmp eax, 0x50032
jae 0x1002544
push 2
jmp 0x1002551
cmp eax, 0x60000
jae 0x100254f
push 3
jmp 0x1002551
push 4
pop eax
mov ecx, dword [ebp - 4]
call fcn.01005857
leave
ret
Function at 0x100279e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x100923c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x114]
push eax
push 0x20019
xor esi, esi
push esi
mov edi, 0x1001370
push edi
push 0x80000002
mov dword [ebp - 0x118], esi
call ebx
test eax, eax
jne 0x1002957
lea eax, [ebp - 0x110]
push eax
push 0x20019
push esi
push 0x1001398
push dword [ebp - 0x114]
call ebx
test eax, eax
jne 0x100294b
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10016d0
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push esi
mov ecx, edi
sub ecx, eax
push esi
push esi
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x11c], ecx
lea ecx, [ebp - 0x11c]
lea eax, [ebp + eax - 0x108]
push ecx
push eax
mov dword [ebp - 0x120], eax
push esi
jmp 0x100292b
lea eax, [ebp - 0x10c]
push eax
push 0x2001f
push esi
push dword [ebp - 0x120]
push dword [ebp - 0x114]
call ebx
test eax, eax
jne 0x10028b8
push 0x100174c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x100174c
push 1
push esi
push 0x100173c
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10013a4
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
lea eax, [ebp - 0x10c]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x1002902
push dword [ebp - 0x10c]
push esi
push esi
call sub.ADVPACK.dll_RegRestoreAll
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
inc dword [ebp - 0x118]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push dword [ebp - 0x118]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x1002867
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005857
leave
ret

Function at 0x1002969
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100923c]
push esi
push edi
mov dword [ebp - 4], eax
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001750
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
push edi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.ADVPACK.dll_GetVersionFromFile
cmp dword [ebp - 0x10c], 0x419
jne 0x10029e4
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.01005857
leave
ret
Function at 0x10029f7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100923c]
push ebx
push esi
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
mov word [ebp - 0xc], bx
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x14], bx
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x84]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x10013f0
push 0x80000001
mov dword [ebp - 0x8c], ebx
call esi
test eax, eax
jne 0x1002a92
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x1001774
push dword [ebp - 0x84]
mov dword [ebp - 0x80], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002a86
push 0x2c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.01005d6c
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x88]
push eax
push edi
push ebx
push 0x1001334
push 0x80000002
call esi
test eax, eax
jne 0x1002b22
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push 0x1001760
push dword [ebp - 0x88]
mov dword [ebp - 0x80], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002b09
push 0x2e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.01005d6c
mov cx, word [ebp - 0x14]
mov ax, word [ebp - 0x12]
movzx edx, cx
movzx esi, ax
shl edx, 0x10
or edx, esi
cmp edx, 0x40047
jl 0x1002b09
cmp word [ebp - 0xc], cx
ja 0x1002b09
jne 0x1002b0e
cmp word [ebp - 0xa], ax
jb 0x1002b0e
xor esi, esi
inc esi
jmp 0x1002b14
mov esi, dword [ebp - 0x8c]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002b25
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.01005857
leave
ret
Function at 0x1002b39
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100923c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
mov esi, 0x1009148
lea eax, [ebp - 0x10c]
push eax
push 0x2001f
push 0
push dword [esi - 4]
push dword [esi - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c09
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [esi]
mov dword [ebp - 0x110], 0x104
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002bfd
lea eax, [ebp - 0x108]
push eax
call edi
lea ecx, [ebp - 0x108]
dec ecx
add eax, ecx
jmp 0x1002bcb
cmp byte [eax], 0x20
jne 0x1002bd5
mov byte [eax], 0
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
jae 0x1002bc2
lea eax, [ebp - 0x108]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
push 0
push dword [esi]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
cmp esi, 0x10091a8
jl 0x1002b59
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01005857
leave
ret