joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b13c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc4
mov eax, 0x1004ecc0
call fcn.100186c5
mov dword [ebp - 0xd0], ecx
mov esi, dword [ebp + 8]
movzx eax, word [ebp + 0x24]
xor ebx, ebx
push 0xa
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1000b27e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000b27e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0xc8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp dword [ebp - 0xc8], ebx
jne 0x1000b1a8
test edi, edi
je 0x1000b27e
cmp dword [ebp + 0x1c], ebx
jbe 0x1000b242
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], ebx
call fcn.10004d8f
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.1000470c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xc4]
call fcn.10005f94
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc4]
call fcn.10005804
lea esi, [edi + 1]
mov byte [ebp - 4], 2
push esi
call fcn.10033e7a
push esi
push ebx
push eax
mov dword [ebp - 0xcc], eax
call fcn.1002f640
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0xcc]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push esi
push dword [ebp - 0xc8]
call fcn.10003d28
add esp, 0x20
lea ecx, [ebp - 0x28]
call fcn.10002078
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002078
jmp 0x1000b244
mov esi, ebx
sub esp, 0x18
mov ecx, esp
push esi
call fcn.10001ebf
lea eax, [ebp - 0x58]
push eax
call fcn.1000667d
add esp, 0x1c
mov esi, dword [ebp - 0xd0]
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.1000c643
cmp dword [esi + 4], ebx
lea ecx, [ebp - 0x58]
seta bl
call fcn.10002078
lea ecx, [ebp + 0xc]
call fcn.10002078
mov al, bl
call fcn.1001866f
ret 0x20
Function at 0x1000d7ed
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x1004efa9
call fcn.100186c5
lea eax, [ebp - 0x70]
push eax
call fcn.1000d77c
mov ecx, eax
call fcn.10007f18
sub esp, 0x18
lea eax, [ebp - 0x70]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.10003fb8
call fcn.10006832
mov esi, eax
mov edi, edx
mov ecx, esi
add esp, 0x18
or ecx, edi
jne 0x1000d883
lea eax, [ebp - 0x58]
push eax
call fcn.1000d77c
mov ecx, eax
call fcn.10007a65
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
lea eax, [ebp - 0x58]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.10003fb8
call fcn.10006832
push 0xa
push edx
push eax
call fcn.1000f802
add esp, 0x24
lea ecx, [ebp - 0x58]
test eax, eax
jne 0x1000d977
mov byte [ebp - 4], bl
call fcn.10004033
cmp edi, ebx
jl 0x1000d8a1
jg 0x1000d88d
cmp esi, ebx
jbe 0x1000d8a1
push 3
push edi
push esi
call fcn.1000f834
add esp, 0xc
test eax, eax
jne 0x1000d97c
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x8c], esp
push ebx
call fcn.100392c6
push edx
push eax
push esi
call fcn.10006724
add esp, 0x10
mov byte [ebp - 4], 2
call fcn.1000d77c
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.10008022
lea eax, [ebp - 0x28]
push eax
call fcn.1000d77c
mov ecx, eax
call fcn.1000797b
mov esi, str.upgrade.exe
mov byte [ebp - 4], 3
push esi
call fcn.10033e5f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.10004080
push 8
pop esi
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000d974
lea eax, [ebp - 0x40]
push str.CMD_UPDATE_SILENCE
push eax
call fcn.1000ae10
cmp dword [ebp - 0x2c], esi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000f555
cmp dword [ebp - 0x14], esi
lea ecx, [ebp - 0x28]
push ebx
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], esi
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x40]
push ebx
push ecx
push eax
mov byte [ebp - 4], 5
call fcn.1000f6b3
add esp, 0x24
lea ecx, [ebp - 0x88]
call fcn.10004033
lea ecx, [ebp - 0x40]
call fcn.10004033
lea ecx, [ebp - 0x28]
call fcn.10004033
lea ecx, [ebp - 0x70]
call fcn.10004033
call fcn.1001866f
ret 4
Function at 0x1000d98c
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push 0x80
mov eax, 0x1004f00c
call fcn.100186c5
mov edi, ecx
mov bl, byte [ebp + 8]
mov byte [ebp - 0x8c], bl
call fcn.1000d77c
mov ecx, eax
call fcn.10007f90
test al, al
jne 0x1000dbad
lea eax, [ebp - 0x58]
push eax
call fcn.1000d77c
mov ecx, eax
call fcn.1000797b
push dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.1000d77c
mov ecx, eax
call fcn.10007e4b
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
lea eax, [ebp - 0x88]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.10003fb8
call fcn.10006832
push edx
push eax
call fcn.1000f870
add esp, 0x20
test eax, eax
jne 0x1000dae6
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], esi
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], esi
call fcn.10003fb8
mov esi, str.Female.exe
mov byte [ebp - 4], 2
push esi
call fcn.10033e5f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.10004080
lea eax, [ebp - 0x70]
push str.CMD_REPORT_SHELL
push eax
call fcn.1000ae10
pop ecx
pop ecx
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov byte [ebp - 4], 3
jb 0x1000da64
mov ecx, dword [ecx]
movzx eax, bl
xor eax, 1
inc eax
push eax
push ecx
lea eax, [ebp - 0x28]
push 0x10056ec8
push eax
call fcn.10006593
add esp, 0x10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.10004033
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
xor esi, esi
push esi
push 0xffffffffffffffff
push esi
push ecx
push eax
call fcn.1000f6b3
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.10004033
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.10004033
push esi
mov ecx, edi
call fcn.1000dbb5
test al, al
jne 0x1000db9a
push esi
mov ecx, edi
call fcn.1000d7ed
mov edi, str.Female.exe
push edi
call fcn.10033e5f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.10004080
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000db9a
lea eax, [ebp - 0x70]
push str.CMD_SOFT_DISPATCH
push eax
call fcn.1000ae10
pop ecx
pop ecx
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov byte [ebp - 4], 6
jb 0x1000db48
mov ecx, dword [ecx]
movzx eax, bl
xor eax, 1
inc eax
push eax
push ecx
lea eax, [ebp - 0x28]
push str._s_d
push eax
call fcn.10006593
add esp, 0x10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 8
call fcn.10004033
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
push esi
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x28]
push esi
push ecx
push eax
call fcn.1000f6b3
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.10004033
lea ecx, [ebp - 0x88]
call fcn.10004033
lea ecx, [ebp - 0x58]
call fcn.10004033
call fcn.1001866f
ret 4
Function at 0x1000ee22
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1006e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1000ee48
xor eax, eax
jmp 0x1000ef0a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000ee71
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x1000ee71
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1000ef0a
cmp dword [esi + 0x4c], 0
je 0x1000ef08
mov ecx, esi
call fcn.1000eb3b
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x1000ee9d
push dword [esi + 0x4c]
push eax
call fcn.1000dcdf
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x1000ef08
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x1000ef08
cmp eax, 1
jle 0x1000eed7
cmp eax, 3
jne 0x1000ef08
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1000ee8f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x1000eefa
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.10038179
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x1000ef08
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x1000ef0a
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018649
leave
ret 4
Function at 0x1000f377
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000f399
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d5e6
jmp 0x1000f450
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x1000f3ba
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1000f3bc
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x1000f444
jg 0x1000f3cf
test esi, esi
je 0x1000f444
test ecx, ecx
jl 0x1000f411
jg 0x1000f3d9
test eax, eax
je 0x1000f411
cmp ebx, ecx
jg 0x1000f3eb
jl 0x1000f3e3
cmp esi, eax
jae 0x1000f3eb
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1002f0c0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1000f417
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x1000f444
jg 0x1000f421
test esi, esi
je 0x1000f444
cmp dword [edi + 0x4c], 0
je 0x1000f444
mov ecx, edi
call fcn.1000eb3b
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.10039d0b
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc
Function at 0x1000f455
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000f477
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d6b5
jmp 0x1000f524
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1000f498
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000f49a
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1000f518
jg 0x1000f4ad
test esi, esi
je 0x1000f518
test ecx, ecx
jl 0x1000f4f1
jg 0x1000f4b7
test eax, eax
je 0x1000f4f1
cmp edi, ecx
jg 0x1000f4c9
jl 0x1000f4c1
cmp esi, eax
jae 0x1000f4c9
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1002f0c0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1000f4f4
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1000f518
jg 0x1000f4fe
test esi, esi
je 0x1000f518
cmp dword [ebx + 0x4c], 0
je 0x1000f518
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.10038179
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000f6b3
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1006e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000f6e2
push 2
pop eax
jmp 0x1000f767
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.1000f555
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.1002f640
add esp, 0x14
mov dword [ebp - 0x58], edi
test ebx, ebx
mov dword [ebp - 0x48], esi
mov ecx, 0x10056668
mov dword [ebp - 0x54], 0x40
mov eax, str.runas
cmove eax, ecx
cmp dword [ebp - 8], 8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 0
mov esi, eax
je 0x1000f75d
cmp dword [ebp + 0x10], 0
je 0x1000f75d
push dword [ebp + 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1c]
call fcn.10004033
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018649
leave
ret
Function at 0x1001168a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x10011734
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001175a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001175a
xor al, al
jmp 0x1001176e
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x1001194a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1006e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.10010181
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.10018649
leave
ret

Function at 0x1001214f
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x84
mov eax, 0x1004f434
call fcn.10018691
mov edi, ecx
call fcn.10012130
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.1000fff6
lea eax, [ebp - 0x24]
xor esi, esi
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], esi
push eax
call fcn.10012236
pop ecx
pop ecx
push 0x20
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.1000fe4d
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10010250
push dword [ebp - 0x18]
call fcn.10018644
push dword [ebp - 0x4c]
call fcn.10018644
push dword [ebp - 0x24]
call fcn.10018644
add esp, 0x18
mov dword [ebp - 0x90], 0x44
xor eax, eax
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x5e], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x88], esi
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x84], esi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x64], esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x30]
mov dword [ebp - 0x5c], esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10012215
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10012223
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
mov dword [edi], eax
push dword [ebp - 0x30]
call fcn.10018644
pop ecx
mov eax, esi
call fcn.1001865a
ret 0xc
Function at 0x10013cf2
Capabilities:
Identify system language via api

Disassembly:
push 0x24
mov eax, 0x1004f882
call fcn.10018691
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
cmp si, cx
jne 0x10013dc9
mov eax, ecx
xor ebx, ebx
shr cx, 0xa
and eax, 0x3ff
movzx esi, cx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.10013b9b
lea eax, [ebp - 0x30]
push eax
call fcn.10013c66
add esp, 0xc
mov edi, ebx
mov byte [ebp - 4], 1
mov ebx, esi
xor eax, eax
test edi, edi
cmove eax, ebx
cmp eax, dword [ebp - 0x14]
jae 0x10013db2
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + eax*4]
cmp dword [esi + 4], 0
je 0x10013db2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
call fcn.1000ff58
push dword [esi]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.10010327
push str..txt
lea ecx, [ebp - 0x24]
call fcn.10010327
push dword [ebp - 0x24]
push 0x10070730
call fcn.10013c77
pop ecx
pop ecx
test al, al
jne 0x10013dcf
push dword [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.10018644
pop ecx
inc edi
cmp edi, 2
jb 0x10013d53
push dword [ebp - 0x30]
call fcn.10018644
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10010d97
call fcn.1001865a
ret
push dword [esi]
mov ecx, 0x10070724
call fcn.10010108
push dword [ebp - 0x24]
call fcn.10018644
push dword [ebp - 0x30]
call fcn.10018644
pop ecx
jmp 0x10013dc0
Function at 0x10014064
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1004f928
call fcn.10018691
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.CZipContextMenu.0
mov dword [esi + 4], vtable.CZipContextMenu.1.0
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.1001002d
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
push 0x10070774
mov byte [ebp - 4], 2
mov word [esi + 0x40], bx
mov dword [ebp - 0x14], 0x60
mov dword [ebp - 0x18], 4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10014114
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.AppliedDPI
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, 0x60
je 0x1001414c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
push 0x30
addsd xmm0, qword [eax*8 + 0x10057b10]
pop eax
divsd xmm0, qword [0x10057b00]
mulsd xmm0, qword [0x10057af8]
cvttsd2si edi, xmm0
cmp edi, eax
cmovg edi, eax
push ebx
push edi
push edi
push 1
push 0xbf
push dword [0x1007076c]
call dword [sym.imp.USER32.dll_LoadImageW]
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.10015a0d
mov eax, esi
call fcn.1001865a
ret
Function at 0x10015e3a
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x1c
mov eax, 0x1004fc0c
call fcn.10018691
push str.CLSID_
lea ecx, [ebp - 0x1c]
call fcn.1000ffac
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov ebx, 0x10057b20
push ebx
call fcn.10010376
push 0x10057ce8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10010270
add esp, 0xc
mov edi, 0x80000000
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x28]
call fcn.10018644
pop ecx
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call fcn.10015b8d
test al, al
je 0x10015ed3
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10015ed3
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1c]
call fcn.10018644
xor eax, eax
pop ecx
inc eax
call fcn.1001865a
ret

Function at 0x10015f93
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x1004fc54
call fcn.10018691
cmp dword [ebp + 0xc], 1
jne 0x10015ff4
mov esi, dword [ebp + 8]
push 0x1388
sub esp, 0x18
mov dword [0x1007076c], esi
mov ecx, esp
mov dword [ebp + 8], esp
push str.SoftResCloudZip
call fcn.10001ebf
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.1000ada2
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1000b13c
push edi
push edi
push esi
call fcn.10015b1c
mov ecx, eax
call fcn.10008287
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x1001604d
cmp dword [ebp + 0xc], 0
jne 0x1001604d
mov eax, dword [0x10070770]
test eax, eax
je 0x1001604d
lea ecx, [ebp + 0xc]
xor edi, edi
push ecx
push eax
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1001603b
cmp dword [ebp + 0xc], 0x103
jne 0x1001603b
push edi
push dword [0x10070770]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push dword [0x10070770]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x10070770]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10070770], edi
xor eax, eax
inc eax
call fcn.1001865a
ret 0xc