joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e013
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b40d8
mov eax, dword fs:[0]
push eax
mov eax, 0x8440
call fcn.100886b0
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x844c], ecx
mov eax, dword [ebp - 0x844c]
cmp dword [eax + 0x70], 0
je 0x1009e265
and word [ebp - 0x8444], 0
push 0x208
push 0
lea eax, [ebp - 0x8442]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x8444]
push eax
call fcn.10072223
add esp, 0xc
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009e0bc
push 0
lea eax, [ebp - 0x8444]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1001901e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100380c9
push 0x100c5524
lea ecx, [ebp - 0x10]
call fcn.10038018
and word [ebp - 0x8234], 0
push 0x208
push 0
lea eax, [ebp - 0x8232]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x8234]
push eax
call fcn.1009bdfc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
lea eax, [ebp - 0x8234]
push eax
push 0x100c5530
push 0x100c5548
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and word [ebp - 0x401c], 0
push 0x4002
push 0
lea eax, [ebp - 0x401a]
push eax
call fcn.10071bb0
add esp, 0xc
and word [ebp - 0x8024], 0
push 0x4002
push 0
lea eax, [ebp - 0x8022]
push eax
call fcn.10071bb0
add esp, 0xc
push section.Downlaod
call fcn.1006eefb
pop ecx
push eax
push section.Downlaod
push 0x2002
lea eax, [ebp - 0x401c]
push eax
call fcn.1009bda6
add esp, 0x10
push 0x10102008
call fcn.1006eefb
pop ecx
push eax
push 0x10102008
push 0x2002
lea eax, [ebp - 0x8024]
push eax
call fcn.1009bda6
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
lea eax, [ebp - 0x8024]
push eax
push 0x100c555c
push 0x100c556c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
lea eax, [ebp - 0x401c]
push eax
push 0x100c5580
push 0x100c5594
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x8448]
call fcn.100107ef
mov byte [ebp - 4], 1
push dword [0x10106014]
push 0x100c55a8
lea eax, [ebp - 0x8448]
push eax
call fcn.10016117
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
lea ecx, [ebp - 0x8448]
call fcn.10010f80
push eax
push 0x100c55b0
push 0x100c55bc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8448]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1002370d
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006ef11
leave
ret 4
Function at 0x1009e281
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4108
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
call fcn.100ac81d
pop ecx
and dword [ebp - 4], 0
push 0x100c54c0
lea ecx, [ebp - 0x10]
call fcn.1000a113
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.10010f80
test eax, eax
je 0x1009e35a
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.10010f80
mov dword [ebp - 0x3c], eax
push 0
push 0x100c54f4
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
push 0xa
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call fcn.100735fa
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100c54fc
push 0x100c5508
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x16
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.10071bb0
add esp, 0xc
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003e5d
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006ef11
leave
ret
Function at 0x1009ec0b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push dword [ebp + 8]
call fcn.1000171b
call fcn.1009dcb9
add esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009ec3b
xor eax, eax
inc eax
jmp 0x1009ec3d
xor eax, eax
leave
ret

Function at 0x1009ee62
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push edi
call fcn.1005b3cd
movzx eax, al
test eax, eax
je 0x1009ee91
push section.DLLShare
push str.EntryPoint__g_szCmdline_s
push 0xd2
push 0x100c5dc0
call fcn.1005b25c
add esp, 0x10
push section.DLLShare
call fcn.1006eefb
pop ecx
test eax, eax
jne 0x1009eec5
call fcn.1005b3cd
movzx eax, al
test eax, eax
je 0x1009eec3
push str.EntryPoint__g_szCmdline_is_empty
push 0xd2
push 0x100c5e68
call fcn.1005b25c
add esp, 0xc
jmp 0x1009ef34
and dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.10071bb0
add esp, 0xc
and dword [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x81
and word [ebp - 0x30], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push section.DLLShare
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1009ef34
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret 0x10
Function at 0x1009f419
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CServiceLauncher.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0
je 0x1009f47d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x1009f468
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.100018b0
movzx eax, al
test eax, eax
jne 0x1009f468
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10004ff5
push eax
call fcn.100ab904
pop ecx
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0xcc
call fcn.10001789
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10001789
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10001789
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10001789
mov ecx, dword [ebp - 4]
call fcn.1003687d
leave
ret

Function at 0x1009f599
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CQQExternalShellLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.100018b0
movzx eax, al
test eax, eax
jne 0x1009f5ee
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1009f5ee
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.100018b0
movzx eax, al
test eax, eax
jne 0x1009f618
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10001789
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10001789
mov ecx, dword [ebp - 4]
call fcn.100365ba
leave
ret
Function at 0x100a0044
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4f84
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
push 0x100c5ec8
lea ecx, [ebp - 0x440]
call fcn.1000171b
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x448]
add eax, 4
push eax
lea ecx, [ebp - 0x440]
call fcn.100017b4
push 0x100c5ecc
lea ecx, [ebp - 0x440]
call fcn.10004f45
push 0x100c5ed0
lea ecx, [ebp - 0x440]
call fcn.10004f45
push dword [ebp + 8]
lea ecx, [ebp - 0x440]
call fcn.10004f45
lea ecx, [ebp - 0x440]
call fcn.10004ff5
push eax
push 0x208
push section.DLLShare
call fcn.1007298c
add esp, 0xc
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [0x100fd2ec]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x100c5ed4
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.10074bd8
add esp, 0xc
and word [ebp - 0x424], 0
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.100a8f4c
add esp, 0x14
mov dword [ebp - 0x444], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.10001789
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef11
leave
ret 4
Function at 0x100a0c77
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b50e2
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0x100c5950
lea ecx, [ebp - 0x48]
call fcn.1000171b
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.100017b4
push 0x100c5954
lea ecx, [ebp - 0x48]
call fcn.10004f45
push 0x100c5958
lea ecx, [ebp - 0x48]
call fcn.10004f45
push dword [ebp + 8]
lea ecx, [ebp - 0x48]
call fcn.10004f45
lea ecx, [ebp - 0x48]
call fcn.10004ff5
push eax
call fcn.1009de6e
pop ecx
test eax, eax
jne 0x100a0d12
and dword [ebp - 0x4c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001789
mov eax, dword [ebp - 0x4c]
jmp 0x100a0e20
mov ecx, dword [ebp - 0x5c]
call fcn.100a0787
test eax, eax
jne 0x100a0d36
and dword [ebp - 0x50], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001789
mov eax, dword [ebp - 0x50]
jmp 0x100a0e20
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004ff5
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a0d64
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100c595c
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004ff5
push eax
push 0x277f
push dword [0x100fd2ec]
call fcn.1009e4aa
add esp, 0x14
test eax, eax
jne 0x100a0da6
and dword [ebp - 0x54], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001789
mov eax, dword [ebp - 0x54]
jmp 0x100a0e20
push 0x100c5970
mov eax, dword [ebp - 0x5c]
add eax, 0xcc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000ab6a
add esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0x100c5980
lea ecx, [ebp - 0x2c]
call fcn.10004ff5
push eax
push 0x451
push dword [0x100fd2ec]
call fcn.1009e4aa
add esp, 0x14
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004ff5
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.1009e013
mov dword [ebp - 0x58], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10001789
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001789
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef11
leave
ret 4
Function at 0x100a0e39
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.1000a156
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x98], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10010f80
test eax, eax
je 0x100a0eb0
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10010f80
mov dword [ebp - 0x14], eax
push 0
push 0x100c5928
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call dword [eax + 0x18]
cmp eax, 0x64
jne 0x100a0eb0
mov eax, dword [0x10106014]
dec eax
mov dword [0x10106014], eax
cmp dword [0x10106014], 0xffffffff
jne 0x100a0eb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10106018], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10010f80
test eax, eax
je 0x100a0eed
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10010f80
mov dword [ebp - 0x18], eax
push 0
push str.EnableLsp
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a0eed
call fcn.1003714d
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp - 0x10]
push 0x1009cf0e
push 0
push 0
call fcn.100728de
add esp, 0x18
push eax
lea ecx, [ebp - 0xc]
call fcn.1003d925
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.100362e2
lea ecx, [ebp - 0xc]
call fcn.10020d23
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.10010f80
test eax, eax
je 0x100a0f5e
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x98]
jmp 0x100a0f60
xor eax, eax
leave
ret 4
Function at 0x100a0f64
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5128
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x228]
call fcn.10023593
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10023593
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.100107ef
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x100a1006
push 0x100c5768
lea ecx, [ebp - 0x228]
call fcn.10039cae
push eax
push dword [0x100f9140]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
push 0x100c5790
lea ecx, [ebp - 0x230]
call fcn.10039cae
push eax
push dword [0x100f913c]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
lea ecx, [ebp - 0x228]
call fcn.10010f80
push eax
lea ecx, [ebp - 0x22c]
call fcn.10003e87
push 0x100c57a0
lea ecx, [ebp - 0x22c]
call fcn.1000a113
lea ecx, [ebp - 0x230]
call fcn.10010f80
push eax
lea ecx, [ebp - 0x22c]
call fcn.1000a113
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x20a
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10071bb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x22c]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x100c57a4
lea eax, [ebp - 0x224]
push eax
push 0x277e
push dword [0x100fd2ec]
call fcn.1009e4aa
add esp, 0x14
lea eax, [ebp - 0x224]
push eax
call fcn.10037cf6
mov ecx, eax
call fcn.100373a8
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10003e5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1000abe4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000abe4
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef11
leave
ret
Function at 0x100a114d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5158
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x3c]
call fcn.10037562
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call fcn.1000a156
and dword [ebp - 0x1c], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x20], 0
je 0x100a1230
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x1009d1cd
push 0
push 0
call fcn.100728de
add esp, 0x18
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x100a1227
push 0x64
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x100a11f1
jmp 0x100a121e
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x3c], 1
jne 0x100a1219
cmp dword [0x100fd2e8], 0
jne 0x100a1219
mov ecx, dword [ebp - 0x4c]
call fcn.1009ba6b
test eax, eax
je 0x100a1219
mov dword [0x100fd2e8], 1
xor eax, eax
inc eax
jne 0x100a11d9
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10016f20
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef11
leave
ret 4
Function at 0x100a3852
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, 0x100fd3c0
call fcn.100a9cd2
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x6c], eax
mov ecx, dword [ebp - 0x14]
call fcn.1009d29a
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], eax
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x100a3894
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0x4c
call fcn.1000a156
push dword [ebp - 0x14]
call fcn.10011c08
mov ecx, eax
call fcn.1009f63b
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x40], 0
jbe 0x100a38d2
push 0
push 0
push dword [ebp - 0x14]
push 0x100a3831
push 0
push 0
call fcn.100728de
add esp, 0x18
mov dword [ebp - 8], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a390d
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x6c], 0
je 0x100a38e5
mov ecx, 0x100fd3c0
call fcn.100a9229
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100a3909
push 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x100a390d
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x100a3914
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0xc], eax
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a39e2
and dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.10071bb0
add esp, 0xc
mov dword [ebp - 0x118], 0x100
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0x100c747c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100a39d2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.KAV7NEEDREBOOT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100a39d9
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1006ef11
leave
ret
Function at 0x100a39f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x228], 0
and dword [ebp - 0x224], 0
and dword [ebp - 0x230], 0
and dword [ebp - 0x220], 0
and dword [ebp - 0x218], 0
and dword [ebp - 0x22c], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10071bb0
add esp, 0xc
and dword [ebp - 4], 0
or dword [ebp - 0x21c], 0xffffffff
and dword [ebp - 0x214], 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x100a3a83
xor eax, eax
jmp 0x100a3b14
push dword [ebp - 0x230]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x100a3aa5
xor eax, eax
jmp 0x100a3b14
push dword [ebp - 0x230]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x100a3ac7
xor eax, eax
jmp 0x100a3b14
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x100a3ae6
xor eax, eax
jmp 0x100a3b14
push dword [ebp + 8]
push dword [ebp - 0x218]
call fcn.10036319
pop ecx
pop ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x228], eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1006ef11
leave
ret

Function at 0x100a4149
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x14], ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
push dword [ebp - 0x10]
push 0x100a403c
push 0
push 0
call fcn.100728de
add esp, 0x18
push eax
lea ecx, [ebp - 0xc]
call fcn.1003d925
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100362e2
lea ecx, [ebp - 0xc]
call fcn.10020d23
mov ecx, dword [ebp - 0x10]
call fcn.10010f80
neg eax
sbb eax, eax
neg eax
leave
ret 8