joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000829e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2a4
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.1002ec50
add esp, 0xc
push 0x104
push ebx
call fcn.1000dbe7
add esp, 8
test eax, eax
js 0x1000842d
mov eax, dword [ebp + 8]
xor ecx, ecx
dec ecx
lea esi, [ebp - 0x2b0]
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
push eax
push esi
call fcn.10008494
push 0
call fcn.1000f8f5
add esp, 4
test al, al
je 0x10008386
lea edi, [ebp - 0x2a4]
mov ecx, edi
push 0
push 0x42
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f93e
mov ecx, edi
call fcn.10002820
push str.InvokeEdge:
push eax
call fcn.10003222
add esp, 8
mov edi, eax
push ebx
call fcn.100416d7
add esp, 4
push eax
push ebx
push edi
call fcn.100065e4
add esp, 0xc
push 0x1005d459
push eax
call fcn.10003222
add esp, 8
lea ecx, [ebp - 0x2b0]
movzx edx, byte [ecx + 0xb]
mov edi, edx
and edi, 0x7f
test dl, dl
cmovs edi, dword [ecx + 4]
cmovs ecx, dword [ecx]
push edi
push ecx
push eax
call fcn.100065e4
add esp, 0xc
lea ecx, [ebp - 0x2a4]
call fcn.1000fc9a
cmp byte [ebp - 0x2a5], 0
jns 0x10008395
mov esi, dword [ebp - 0x2b0]
xor eax, eax
push 1
push eax
push esi
push ebx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
setae bl
jae 0x10008414
mov edi, eax
push 2
call fcn.1000f8f5
add esp, 4
test al, al
je 0x10008414
lea esi, [ebp - 0x2a4]
mov ecx, esi
push 2
push 0x47
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f93e
mov ecx, esi
call fcn.10002820
push str.Could_not_start_Edge__Error:
push eax
call fcn.10003222
add esp, 8
mov ecx, eax
push edi
call fcn.100021e0
push 0x1005d459
push eax
call fcn.10003222
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
push eax
call fcn.10001dc0
mov ecx, esi
call fcn.1000fc9a
cmp byte [ebp - 0x2a5], 0
jns 0x1000847b
push dword [ebp - 0x2b0]
call fcn.1002afb4
add esp, 4
jmp 0x1000847b
mov esi, eax
push 2
call fcn.1000f8f5
add esp, 4
test al, al
je 0x10008479
lea edi, [ebp - 0x2a4]
mov ecx, edi
push 2
push 0x3c
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f93e
mov ecx, edi
call fcn.10002820
push 0x25
push str.Failed_to_get_current_stub_location:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push esi
call fcn.10001bb0
mov ecx, edi
call fcn.1000fc9a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, ebx
add esp, 0x2a4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10009024
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
push 0
call fcn.1000f8f5
add esp, 4
cmp edi, ebx
je 0x100090c8
test al, al
je 0x10009087
lea edi, [ebp - 0x9c]
mov ecx, edi
push 0
push 0x3a
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f93e
mov ecx, edi
call fcn.10002820
push 0x1c
push str.RepeatingTaskScheduler_Start
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, edi
call fcn.1000fc9a
sub esp, 0x10
movaps xmm0, xmmword [0x1005d530]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
xor eax, eax
push eax
push eax
push esi
push 0x10009110
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
test al, al
je 0x100090b3
lea esi, [ebp - 0x9c]
mov ecx, esi
push 0
push 0x36
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f93e
mov ecx, esi
call fcn.10002820
push 0x25
push str.No_tasks__skipping_scheduler_creation
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, esi
call fcn.1000fc9a
jmp 0x100090b3
Function at 0x1000b404
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.1002ec50
add esp, 0xc
push 0x104
push ebx
call fcn.1000dbe7
add esp, 8
test eax, eax
js 0x1000b549
mov edi, dword [ebp + 8]
push ebx
call fcn.100416d7
add esp, 4
add eax, 0x28
xor ecx, ecx
dec ecx
lea esi, [ebp - 0x224]
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov ecx, esi
push eax
call fcn.1000b59e
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
sar ecx, 1
push edi
push ebx
push str.__s____create_cache_container_d
push ecx
push eax
call fcn.1000b60f
add esp, 0x14
test eax, eax
js 0x1000b54d
xorps xmm0, xmm0
lea eax, [ebp - 0x268]
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
lea ecx, [ebp - 0x278]
movups xmmword [ecx], xmm0
mov edx, dword [ebp - 0x224]
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000b551
push 0xffffffffffffffff
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000b567
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call ebx
push dword [ebp - 0x278]
call ebx
lea ecx, [ebp - 0x268]
mov dword [ecx], esi
call fcn.10007c56
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, edi
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
jmp 0x1000b532
mov edi, eax
jmp 0x1000b525
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1000b525
lea eax, [ebp - 0x27c]
mov dword [eax], 0xffffffff
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1000b4fb
mov eax, dword [ebp - 0x27c]
test eax, eax
mov edi, 0x80004005
cmove edi, eax
jmp 0x1000b50f
Function at 0x1000b69b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1006700c]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov esi, 0x80070057
cmp eax, 0x104
jb 0x1000b718
lea esi, [ebp - 0x20]
mov dword [esi], 0xffffffff
call fcn.1000e377
mov ecx, 0x10054050
mov edx, 0x10054060
test al, al
cmovne edx, ecx
movups xmm0, xmmword [edx]
lea eax, [ebp - 0x1c]
movups xmmword [eax], xmm0
xor edi, edi
push esi
push edi
push edi
push eax
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
test eax, eax
jne 0x1000b718
push dword [ebp + 8]
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
mov eax, 0x80004005
cmove edi, eax
push dword [ebp - 0x20]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, edi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret

Function at 0x1000baea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x1000bb0c
mov word [edi], 0
mov esi, 0x80070002
cmp dword [ecx], 0
je 0x1000bb2c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor eax, eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
push esi
push 0x20119
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000bb5e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000bb16
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
add ebx, ebx
lea eax, [ebp - 0x18]
mov dword [eax], ebx
mov ebx, ecx
push eax
push edi
push esi
push 0
push str.CurrentVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x1000bba7
jle 0x1000bb93
movzx esi, si
or esi, 0x80070000
test ebx, ebx
je 0x1000bb16
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000bb16
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x1000bbcc
test edi, edi
je 0x1000bb93
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000bbd3
test al, 1
jne 0x1000bbcc
and eax, 0xfffffffe
cmp word [edi + eax - 2], 0
je 0x1000bb93
mov esi, 0x8007000d
jmp 0x1000bb93
mov word [edi], 0
jmp 0x1000bb93
Function at 0x1000bbda
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor esi, esi
cmp dword [ecx], 0
je 0x1000bc08
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebp
ret 4
lea eax, [ebp - 0x10]
mov dword [eax], 0xffffffff
xor ecx, ecx
lea edx, [ebp - 0x14]
mov dword [edx], ecx
sub esp, 0x24
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x1005df90]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000bc5c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000bbf3
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
test esi, esi
je 0x1000bcaa
push esi
call fcn.100416d7
add esp, 4
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.CurrentVersion
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test edi, edi
je 0x1000bbf3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000bbf3
mov esi, 0x8007000d
jmp 0x1000bc96

Function at 0x1000bcb2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor esi, esi
cmp dword [ecx], 0
je 0x1000bcde
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
xor eax, eax
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
push ecx
push 0x102
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000bd10
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000bccb
mov edi, dword [ebp - 0x10]
push str.CurrentVersion
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test edi, edi
je 0x1000bccb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000bccb
Function at 0x1000d6da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [esp + 0x28], eax
push 0x60
push 0
push 0x1005e1c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x1000d7d3
mov esi, eax
push 0
push str.EnterpriseModeSiteListConverter.xsl
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1000d7d3
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000d7d3
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x1000d7d3
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1000d7fc
mov edi, eax
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx], xmm0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov dword [ebx + 8], eax
test eax, eax
je 0x1000d7cc
mov edi, dword [ebp + 8]
mov word [esp + 0x10], 0xd
lea esi, [esp + 0xe]
mov word [esi], 0
mov eax, dword [edi]
mov ecx, dword [eax + 0xe8]
call dword [section..00cfg]
sub esp, 0x18
movaps xmm0, xmmword [esp + 0x28]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x14], esi
mov dword [esp], edi
call ecx
xor ecx, ecx
cmp word [esi], 0xffff
mov esi, 0x80004005
cmove esi, ecx
test eax, eax
cmovs esi, eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000d7e7
mov esi, 0x8007000e
jmp 0x1000d7c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, 0x8000ffff
jmp 0x1000d7e7

Function at 0x1000db58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1006700c]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
add eax, eax
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
xor eax, eax
push ecx
push edi
push eax
push 2
push eax
push str.CLSID1FD49718_1D00_4B19_AF5F_070AF6D5D54CInProcServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1000dbbc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
mov esi, 0x80004005
jmp 0x1000dba2
mov eax, dword [ebp - 0x10]
mov esi, 0x80070057
cmp eax, 2
jb 0x1000dba2
shr eax, 1
cmp eax, 1
je 0x1000dbb5
lea ecx, [eax - 1]
cmp word [edi + eax*2 - 2], 0x5c
mov eax, ecx
jne 0x1000dbcb
mov word [edi + ecx*2], 0
xor esi, esi
jmp 0x1000dba2
Function at 0x1000e04b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x10069a08]
mov ecx, dword [0x10068d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e09b
mov bl, byte [0x10069a04]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, ebx
add esp, 0x11c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10069a08
call fcn.1002b027
add esp, 4
cmp dword [0x10069a08], 0xffffffff
jne 0x1000e07e
mov eax, dword [0x10069a38]
mov ecx, dword [0x10068d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e1d1
mov bl, 1
cmp byte [0x10069a34], 0
je 0x1000e0f2
mov byte [0x10069a04], bl
push 0x10069a08
call fcn.1002b09d
add esp, 4
jmp 0x1000e07e
mov eax, dword [0x10069a40]
mov ecx, dword [0x10068d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e20e
cmp byte [0x10069a3c], 0
jne 0x1000e0dd
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.1002ec50
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x1000e0dd
lea eax, [ebp - 0x128]
mov dword [eax], ebx
push eax
push ebx
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x1000e0dd
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
je 0x1000e188
cmp eax, 6
je 0x1000e188
xor ebx, ebx
jmp 0x1000e0dd
mov bl, 1
mov eax, dword [ebp - 0x128]
cmp eax, 0x1b
ja 0x1000e1a3
mov ecx, 0xa07f7d0
bt ecx, eax
jb 0x1000e0dd
lea ecx, [eax - 0x77]
cmp ecx, 0xb
ja 0x1000e1b9
mov edx, 0xccd
bt edx, ecx
jb 0x1000e0dd
add eax, 0xffffffba
cmp eax, 0xe
ja 0x1000e181
mov ecx, 0x4005
bt ecx, eax
jb 0x1000e0dd
jmp 0x1000e181
push 0x10069a38
call fcn.1002b027
add esp, 4
cmp dword [0x10069a38], 0xffffffff
jne 0x1000e0d2
push 0x1c
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
setne byte [0x10069a34]
push 0x10069a38
call fcn.1002b09d
add esp, 4
jmp 0x1000e0d2
push 0x10069a40
call fcn.1002b027
add esp, 4
cmp dword [0x10069a40], 0xffffffff
jne 0x1000e113
xor eax, eax
mov dword [ebp - 0x124], eax
push 0x1100
push eax
push str.MDMRegistration.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x1000e271
push str.IsDeviceRegisteredWithManagement
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e271
mov ecx, eax
call dword [section..00cfg]
xor esi, esi
lea edi, [ebp - 0x124]
push esi
push esi
push edi
call ecx
cmp dword [edi], esi
setne cl
jmp 0x1000e288
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
xor ecx, ecx
test eax, eax
setns al
and al, cl
mov byte [0x10069a3c], al
push 0x10069a40
call fcn.1002b09d
add esp, 4
jmp 0x1000e113
Function at 0x1000e4d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.SCODEF
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x1000e541
mov edi, eax
mov dword [ebp - 0x14], 0
push str.msiso.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e588
mov ecx, 0x82
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e541
mov ecx, eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], 0
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push ebx
push eax
push edi
call ecx
test eax, eax
je 0x1000e583
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
je 0x1000e5a1
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000e5a1
mov edi, eax
xor eax, eax
dec eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
push ecx
push ecx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
setne bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e5a3
mov eax, dword [ebp - 0x14]
jmp 0x1000e547
push str.iertutil.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e541
mov ecx, 0x1e0
jmp 0x1000e518
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000e5b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [esp + 0x20], eax
xor edi, edi
dec edi
lea esi, [esp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
call fcn.1000e4d0
mov bl, 1
test al, al
je 0x1000e60c
xor eax, eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
push ebx
push 0x20119
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000e62e
xor ebx, ebx
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002ba3a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
je 0x1000e60a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000e60a
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea eax, [esp + 0x1c]
mov dword [eax], edi
mov edi, esp
mov dword [edi], 8
push edi
push ebx
mov ebx, ecx
push eax
push 0
push str.LatestUpsellAttemptedSessionTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e621
cmp dword [esp + 0x1c], 0xb
jne 0x1000e621
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
test ebx, ebx
je 0x1000e680
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
setns bl
jmp 0x1000e60c
Function at 0x1000e692
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [esp + 0x20], eax
xor ebx, ebx
call fcn.1000e5b7
test al, al
jne 0x1000e740
lea ecx, [esp + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x1005e2f0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
call fcn.100043cc
mov ebx, 0
test eax, eax
jne 0x1000e731
xor eax, eax
dec eax
lea ecx, [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
call fcn.1000e4d0
test al, al
je 0x1000e72f
movsd xmm0, qword [esp + 4]
lea eax, [esp + 0x18]
movsd qword [eax], xmm0
push 8
push eax
push 0xb
push 0
push str.LatestUpsellAttemptedSessionTime
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000e753
xor ebx, ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000e740
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002ba3a
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x1000e731

Function at 0x1000e7de
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [0x1006700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
mov dword [edi], esi
push edi
push 0x20119
push esi
push str.SoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e839
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x1000e862
xor eax, eax
mov dword [ebp - 0x14], eax
push edi
push 0x20119
push eax
push str.SoftwareMicrosoftEdgeIEToEdge
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000e8a4
mov ebx, eax
mov edi, dword [ebp - 0x18]
test esi, esi
je 0x1000e870
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, dword [ebp - 0x20]
mov ecx, 0x65e
cmove ecx, eax
test ebx, ebx
cmovne ecx, ebx
movzx esi, cx
or esi, 0x80070000
test ecx, ecx
cmovle esi, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ba3a
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
mov edi, ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test edi, edi
je 0x1000e862
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000e862