joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406913
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406274
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406985
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406985
cmp dword [ebp + 0x18], 1
je 0x40698a
cmp dword [ebp + 0x18], 2
je 0x40698a
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x40698f
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x4069f2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406a3c
test edi, edi
jne 0x4069ff
mov word [esi], ax
jmp 0x406a3e
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b39
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b5b
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406dd8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5914], 0
push esi
jne 0x406e12
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406de9
mov dword [ecx*4 + 0x7a5910], edx
inc ecx
cmp ecx, 0x100
jl 0x406de4
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406e3c
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7a5910]
inc esi
sub edx, 1
jne 0x406e24
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x73b72628
sub eax, 0x737709c2
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2b815a5f
sub dword [ebp - 0x48], 0xdd2f1514
mov dword [ebp - 0x44], 0x24156be7
sub dword [ebp - 0x44], 0xf1e21fa2
mov dword [ebp - 0x40], 0x6f89dc0c
sub dword [ebp - 0x40], 0x233d97de
mov dword [ebp - 0x3c], 0x9e2b0f0
sub dword [ebp - 0x3c], 0x9e2b0f0
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xaef55a68
sub dword [ebp - 0x48], 0x3a82f112
mov dword [ebp - 0x44], 0x2ca9298c
add dword [ebp - 0x44], 0x14c337e9
mov dword [ebp - 0x40], 0x77b8d6c1
add dword [ebp - 0x40], 0xebb695ab
mov dword [ebp - 0x3c], 0xfc5d681e
sub dword [ebp - 0x3c], 0xfc5d681e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x9a5d723e
sub eax, 0x9a1d4212
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d96e
push 0
call eax
mov ecx, 0x646f
mov ebx, eax
mov edx, 0xc6612a53
sub edx, 0xc620ba53
add edx, dword [ebp - 0x38]
mov edi, 0xaba1331d
xor dword [ebp - 0x20], 0xc2c7b9d6
mov esi, dword [edx]
add dword [ebp - 0x30], 0xa0eddc64
add esi, edi
add dword [ebp - 0x1c], edx
mov dword [ebx], esi
add dword [ebp - 0xc], 0xdbb7ea92
add ebx, 4
add edx, 0x6cb0b207
add edx, 0x934f4dfd
loop 0x401d77
add eax, 0x1848f
mov ebx, eax
add eax, 0xad105dce
add eax, 0x52efa237
mov ecx, 0xb5cfd14e
add ecx, 0x4a702eb2
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x37731b13
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5c307437
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001d20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp edx, 0xffffffff
jne 0x10001d3c
call fcn.10001dc0
movzx edx, ax
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x103
lea eax, [ebp - 0x208]
push esi
push eax
push 0x1004
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push 0x1008a3b8
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.10034470
add esp, 0x10
xor ecx, ecx
mov eax, 0x1008a358
pop edi
pop esi
mov edx, dword [ebp + 0xc]
cmp edx, dword [eax]
je 0x10001da9
add eax, 8
inc ecx
cmp eax, 0x1008a388
jb 0x10001d95
jmp 0x10001dbb
push 1
pop ebx
push dword [ecx*8 + 0x1008a35c]
mov ecx, dword [ebp + 8]
call fcn.10025db0
mov eax, ebx
pop ebx
leave
ret

Function at 0x10002969
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.1000ea60
cmp dword [0x100a2a28], 0
je 0x100029af
lea eax, [ebp + 0xc]
and byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x1000]
push dword [ebp + 8]
push 0xfff
push eax
call fcn.1000ea03
and byte [ebp - 1], 0
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret
Function at 0x10002abb
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
call fcn.100029b1
test eax, eax
je 0x10002b1d
xor ebx, ebx
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0xc], ebx
jb 0x10002b1d
cmp dword [ebp + 0xc], 3
jbe 0x10002aee
cmp dword [ebp + 0xc], 5
jne 0x10002b1d
mov dword [ebp + 0xc], 0x1007e860
jmp 0x10002af5
mov dword [ebp + 0xc], 0x1007e850
push 0x12
push ebx
push ebx
push dword [ebp + 0xc]
call dword [0x100a2a2c]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x10002b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceCfg:_pfnSetupDiGetClassDevsW_failed_errno_ld__n
call fcn.10002969
pop ecx
pop ecx
xor eax, eax
pop ebx
leave
ret
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x45b]
mov byte [ebp - 0x45c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1c
mov esi, 0x400
pop edx
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], edx
push 6
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp + 0xc]
push ebx
push dword [ebp - 4]
call dword [0x100a2a34]
test eax, eax
je 0x10002c30
lea eax, [ebp - 0x5c]
inc dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x45c]
push esi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0x45c], 6
push dword [ebp - 4]
call dword [0x100a2a38]
test eax, eax
je 0x10002c15
push ebx
push ebx
push 3
push ebx
push 3
lea eax, [ebp - 0x458]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10002c09
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x24]
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 0x14]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x10002c09
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x20]
je 0x10002c2a
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 8]
jmp 0x10002b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceCfg:_pfnSetupDiGetDeviceInterfaceDetailW_failed_errno_ld__n
call fcn.10002969
pop ecx
pop ecx
jmp 0x10002c30
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [0x100a2a30]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
jmp 0x10002b1f
Function at 0x10005b56
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1000e330
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10005b8e
push 1
pop eax
jmp 0x10005c35
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x10005bf9
cmp byte [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10005bb4
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x10005bb0
cmp byte [edi + 0x2e], 0
je 0x10005c11
test al, al
je 0x10005c11
push ecx
call fcn.1000e330
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10005c11
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.1000e250
push 0x1008b8d8
push esi
call fcn.1000e250
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10005b56
add esp, 0x20
mov byte [ebx + esi - 1], 0x2a
and byte [ebx + esi], 0
mov dword [ebp + 8], eax
jmp 0x10005c11
push dword [ebp + 0x14]
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov byte [ebx + esi - 1], 0x2a
cmp dword [ebp + 8], 0
je 0x10005c29
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10005b95
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005cf8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1000e8ea
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10005d30
push 1
pop eax
jmp 0x10005de4
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x10005da5
cmp word [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10005d5c
mov ax, word [edi + 0x2e]
cmp ax, 0x2e
jne 0x10005d57
cmp word [edi + 0x30], 0
je 0x10005dc0
test ax, ax
je 0x10005dc0
push ecx
call fcn.1000e8ea
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10005dc0
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.1000e89b
push 0x1008b8dc
push esi
call fcn.1000e89b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10005cf8
add esp, 0x20
mov word [esi + ebx*2 - 2], 0x2a
and word [esi + ebx*2], 0
mov dword [ebp + 8], eax
jmp 0x10005dc0
push dword [ebp + 0x14]
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov word [esi + ebx*2 - 2], 0x2a
cmp dword [ebp + 8], 0
je 0x10005dd8
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005d37
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100064f9
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10006666
push esi
call fcn.1000e330
test eax, eax
pop ecx
je 0x10006666
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006666
test bl, 1
je 0x10006540
and ebx, 0xfffffffe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x1000665d
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.1000e240
lea eax, [ebp - 0x104]
push 0x1008b8d8
push eax
call fcn.1000e250
and dword [ebp - 0x244], 0
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x240]
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006653
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x218]
push 0x1008b910
push eax
call edi
test eax, eax
je 0x10006636
lea eax, [ebp - 0x218]
push 0x1008b90c
push eax
call edi
test eax, eax
je 0x10006636
and byte [ebp - 0x348], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x347]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push eax
call fcn.1000e240
lea eax, [ebp - 0x104]
push 0x1008b84c
push eax
call fcn.1000e250
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1000e250
lea eax, [ebp - 0x348]
push eax
call fcn.100064f9
add esp, 0x1c
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100065b5
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
jmp 0x10006668
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10006668
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1000666c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10006802
push esi
call fcn.1000e8ea
test eax, eax
pop ecx
je 0x10006802
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10004528
add esp, 0x1c
test eax, eax
je 0x10006802
cmp dword [ebp - 4], 0xffffffff
je 0x10006802
test byte [ebp - 4], 1
je 0x100066ce
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 4], 0x10
je 0x100067f9
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
call fcn.1000e8c5
lea eax, [ebp - 0x210]
push 0x1008b8dc
push eax
call fcn.1000e89b
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x45c]
mov dword [ebp - 0x460], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x100067ed
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x434]
push 0x1008b91c
push eax
call edi
test eax, eax
je 0x100067cc
lea eax, [ebp - 0x434]
push 0x1008b918
push eax
call edi
test eax, eax
je 0x100067cc
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x666]
mov word [ebp - 0x668], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x668]
push eax
call fcn.1000e8c5
lea eax, [ebp - 0x210]
push 0x1008b914
push eax
call fcn.1000e89b
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000e89b
lea eax, [ebp - 0x668]
push eax
call fcn.1000666c
add esp, 0x1c
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000674b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
jmp 0x10006804
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10006804
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1000684b
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push dword [ebp + 0xc]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006916
test bl, 1
je 0x1000687f
and ebx, 0xfffffffe
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x10006916
and byte [ebp - 0x204], 0
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
mov ebx, str._s.bak_08X
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.1000ea8f
and dword [ebp - 4], 0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
cmp eax, 0xffffffff
je 0x10006906
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
lea eax, [ebp - 0x204]
push dword [ebp + 0xc]
push ebx
push eax
call fcn.1000ea8f
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x100068cd
xor eax, eax
jmp 0x10006925
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10006af6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
call fcn.1003a070
test eax, eax
je 0x10006b13
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
je 0x10006b7c
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x10006b7c
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.1000eaf0
push esi
call fcn.1006e388
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10006b7c
push esi
push ebx
push edi
call fcn.1000eaf0
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x10006b7c
push esi
xor ebx, ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
call fcn.10003bd7
add esp, 0x10
test eax, eax
je 0x10006b7c
push dword [ebp + 0xc]
call fcn.1000e8ea
pop ecx
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x100071b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push 2
push 0
push 0xffffffffffffffb8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and byte [ebp - 0x4c], 0
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x4c]
push 0x48
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x100071f9
xor eax, eax
leave
ret
cmp dword [ebp - 4], 0x48
jb 0x100071f5
push 0x10
lea eax, [ebp - 0x4c]
push str._TOSDEX_End__
push eax
call fcn.1000f830
add esp, 0xc
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x100089bf
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x208]
push 0x104
push eax
push str.TEC_OCULAR__AGENT_V3_MUTEX_SCDT_SECURITYDOMAIN
call fcn.100041ea
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x208]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
je 0x10008a23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10008a2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10008a31
push 1
pop ebx
cmp dword [0x100a5cb0], 0
je 0x10008a5d
push ebx
lea eax, [ebp - 0x208]
push esi
push eax
push edi
push str.CTATClientTray::GetSecurityDomainLogonState____d____s____08x____d_
push str.AgentTR
push 0xffffffffffffffff
push 0x100a541c
call fcn.10037a50
add esp, 0x20
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x10008b0b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
push str.TEC_OCULAR__AGENT_V3_MUTEX_OAGENTTRAY
call fcn.10004293
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
pop edi
jne 0x10008b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
inc eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
leave
ret

Function at 0x100094fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x10009574
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.10009c91
test eax, eax
jne 0x10009551
push esi
mov esi, str.TRMenuShl_extension
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push str.B30370BA_F8EA_485F_9C31_B51603CBEF61
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x10009566
cmp dword [ebp - 4], edi
je 0x1000955f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x10009580
cmp dword [ebp - 4], edi
je 0x10009574
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x100a2b98
call fcn.1000b311
pop edi
leave
ret