joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x10002575
xor eax, eax
jmp 0x100025fd
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [ebp - 0xc], 0x400000
jbe 0x10002590
mov dword [ebp - 0x10], 0x400000
jmp 0x10002596
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
cmp dword [ebp - 0x18], 0
jne 0x100025ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100025fd
cmp dword [ebp - 8], 0
jne 0x100025f5
jmp 0x100025fb
cmp dword [ebp - 0xc], 0
ja 0x1000257e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x1000c0f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov eax, ecx
dec ecx
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
test eax, eax
je 0x1000c17c
inc ecx
mov ebx, dword [esi]
add esi, 4
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100b5118]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100b5118]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100b5118]
xor edx, edi
mov eax, ebx
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100b5118]
xor edx, edi
dec ecx
jne 0x1000c117
mov dword [ebp + 8], edx
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0xc]
and eax, 3
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x1000c1c7
mov eax, dword [ebp + 8]
shr eax, 8
movzx ecx, byte [ebp + 8]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
xor ecx, edx
xor eax, dword [ecx*4 + 0x100b5118]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1000c18b
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x1000c330
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1000c36c
xor eax, eax
jmp 0x1000c45e
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000c392
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000c45e
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0x14]
push eax
call fcn.10049ac0
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x1000c3c1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000c45e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jae 0x1000c405
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000c3f4
jmp 0x1000c405
cmp dword [ebp - 8], 0
jb 0x1000c403
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
jmp 0x1000c3c8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jae 0x1000c449
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10049e9a
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x1000c438
mov dword [ebp - 0x24], 0
jmp 0x1000c445
mov dword [ebp - 0x18], 0x8123
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
xor eax, eax
jmp 0x1000c45e
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x1000c470
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c4c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x1000c4e9
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret

Function at 0x1000cad0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x414], ax
push 0x40e
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.1004f5f0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.10049780
add esp, 0xc
mov dword [ebp - 0x41c], 0
jmp 0x1000cb35
mov ecx, dword [ebp - 0x41c]
add ecx, 1
mov dword [ebp - 0x41c], ecx
lea edx, [ebp - 0x414]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
add eax, 2
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x420]
mov dx, word [ecx]
mov word [ebp - 0x422], dx
add dword [ebp - 0x420], 2
cmp word [ebp - 0x422], 0
jne 0x1000cb50
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x428]
sar eax, 1
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [ebp - 0x42c]
jae 0x1000cbbe
mov edx, dword [ebp - 0x41c]
movzx eax, word [ebp + edx*2 - 0x414]
cmp eax, 0x2f
jne 0x1000cbb9
mov ecx, 0x5c
mov edx, dword [ebp - 0x41c]
mov word [ebp + edx*2 - 0x414], cx
jmp 0x1000cb26
lea eax, [ebp - 0x40e]
mov dword [ebp - 0x418], eax
mov ecx, 1
test ecx, ecx
je 0x1000cc33
push 0x100a51a0
mov edx, dword [ebp - 0x418]
push edx
call fcn.1000b810
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x1000cbfa
jmp 0x1000cc33
xor eax, eax
mov ecx, dword [ebp - 0x418]
mov word [ecx], ax
push 0
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x5c
mov ecx, dword [ebp - 0x418]
mov word [ecx], ax
mov edx, dword [ebp - 0x418]
add edx, 2
mov dword [ebp - 0x418], edx
jmp 0x1000cbca
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x1000d0b0
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 0x424]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x1000d0f7
xor al, al
jmp 0x1000d2d8
mov ecx, dword [ebp - 0x428]
push ecx
mov edx, dword [ebp - 0x424]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x1000d123
xor al, al
jmp 0x1000d2d8
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x434], eax
mov edx, dword [ebp - 0x428]
push edx
mov eax, dword [ebp - 0x424]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x438], eax
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x100a51c0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x42c], 0
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.1004f5f0
add esp, 0xc
cmp dword [ebp - 0x42c], 0
jne 0x1000d212
mov ecx, dword [0x100b777c]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str._s7z_03d.tmp
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.10049aa4
add esp, 0x14
lea ecx, [ebp - 0x414]
push ecx
call fcn.1000c090
add esp, 4
movzx edx, al
test edx, edx
je 0x1000d206
mov eax, dword [0x100b777c]
add eax, 1
mov dword [0x100b777c], eax
jmp 0x1000d1b1
mov dword [ebp - 0x42c], 1
jmp 0x1000d1b1
lea ecx, [ebp - 0x414]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.10049780
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xffffffff
jne 0x1000d25f
xor al, al
jmp 0x1000d2d8
mov dword [ebp - 0x418], 0
push 0
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d2a2
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1000d2d8
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.1000e040
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000d2cb
mov byte [ebp - 0x419], 1
jmp 0x1000d2d2
mov byte [ebp - 0x419], 0
mov al, byte [ebp - 0x419]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d357
mov byte [ebp - 1], 0x5a
mov dword [ebp - 8], 0
jmp 0x1000d318
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jae 0x1000d357
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x1000d355
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 1]
cmp eax, ecx
je 0x1000d355
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
jmp 0x1000d30f
mov esp, ebp
pop ebp
ret
Function at 0x1000d360
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], ecx
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x214], 0
push 0x100a51ec
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
call fcn.100497f1
add esp, 0xc
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x214], 0
je 0x1000d3e9
cmp dword [ebp - 0x228], 0
je 0x1000d3f0
xor al, al
jmp 0x1000d5fb
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call fcn.1004a817
add esp, 0xc
mov eax, dword [ebp - 0x214]
push eax
call fcn.1004a6b8
add esp, 4
mov dword [ebp - 0x224], eax
push 2
push 0
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.1004a817
add esp, 0xc
mov edx, dword [ebp - 0x214]
push edx
call fcn.1004a6b8
add esp, 4
sub eax, dword [ebp - 0x224]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x88
jae 0x1000d468
mov eax, dword [ebp - 0x214]
push eax
call fcn.1004a9c7
add esp, 4
xor al, al
jmp 0x1000d5fb
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
push 0
push 0x80
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.1004a817
add esp, 0xc
mov edx, dword [ebp - 0x214]
push edx
push 4
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.1004a07d
add esp, 0x10
mov ecx, dword [ebp - 0x214]
push ecx
push 4
push 1
lea edx, [ebp - 0x218]
push edx
call fcn.1004a07d
add esp, 0x10
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x224]
jbe 0x1000d4f0
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.1004a9c7
add esp, 4
xor al, al
jmp 0x1000d5fb
mov dword [ebp - 0x21c], 0
push 0x100a51f4
mov ecx, dword [ebp + 8]
call fcn.1000e0f0
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.100497f1
add esp, 0xc
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x21c], 0
je 0x1000d52f
cmp dword [ebp - 0x228], 0
je 0x1000d545
mov eax, dword [ebp - 0x214]
push eax
call fcn.1004a9c7
add esp, 4
xor al, al
jmp 0x1000d5fb
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.10049ac0
add esp, 4
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.1004a817
add esp, 0xc
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x218]
push edx
push 1
mov eax, dword [ebp - 0x220]
push eax
call fcn.1004a07d
add esp, 0x10
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1000d2f0
add esp, 8
mov eax, dword [ebp - 0x21c]
push eax
push 1
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1004a2e1
add esp, 0x10
mov eax, dword [ebp - 0x21c]
push eax
call fcn.1004a9c7
add esp, 4
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d6c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x1000
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10049ac0
add esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.1004f5f0
add esp, 0xc
mov eax, dword [ebp - 0x20]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x1000d827
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10049ac0
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call fcn.1004f5f0
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1000d7f7
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x100a51fc
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1000d7f7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x14]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
shr ecx, 0x10
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
shr edx, 0x10
push edx
push 0x100a5200
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000e040
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10049e9a
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x1000d818
mov dword [ebp - 0x2c], 0
jmp 0x1000d825
mov dword [ebp - 0x18], 0x8123
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
jmp 0x1000d834
push str.1.0.0.0
mov ecx, dword [ebp + 8]
call fcn.1000e040
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.10049e9a
add esp, 4
cmp dword [ebp - 0x24], 0
jne 0x1000d855
mov dword [ebp - 0x30], 0
jmp 0x1000d862
mov dword [ebp - 0x14], 0x8123
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x10011d00
Capabilities:
Copy file
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x414]
push edx
call fcn.10047640
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x100a554c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, 0x100b782c
call fcn.1000e0f0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x100b77c8
call fcn.1000e0f0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x430]
call fcn.1000dfe0
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x418]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10010350
lea ecx, [ebp - 0x430]
call fcn.1000e020
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret

Function at 0x10012090
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100b77e0
lea ecx, [ebp - 0x1c]
call fcn.10013da0
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x100120f3
mov ecx, 0x100b785c
call fcn.1000e0f0
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
jne 0x10012102
mov dword [ebp - 0x28], 1
jmp 0x10012109
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1c]
call fcn.1000e020
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret
Function at 0x10012280
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091b36
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.10047640
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x274]
push eax
call fcn.100123e0
add esp, 4
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 4], 0
push 0x100a55c4
mov edx, dword [ebp - 0x238]
push edx
lea eax, [ebp - 0x25c]
push eax
call fcn.100145d0
add esp, 0xc
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 1
push 0x100b77c8
mov edx, dword [ebp - 0x23c]
push edx
lea eax, [ebp - 0x230]
push eax
call fcn.10014610
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.1000e020
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.1000e020
lea ecx, [ebp - 0x230]
call fcn.1000e0f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x230]
call fcn.1000e0f0
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x230]
call fcn.1000e020
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret

Function at 0x100123e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x100a55c8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, 0x100b782c
call fcn.1000e0f0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000dfe0
mov edx, dword [ebp - 0x210]
or edx, 1
mov dword [ebp - 0x210], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret