joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x1002fb98
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x1002fb8d
cmp dword [edi + 0x7c], ebx
je 0x1002fba7
call fcn.1002ff80
push ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.1002f990
add esp, 0x10
test eax, eax
je 0x1002fbce
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.1010dced
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x1002fc10
push 0x4000
call fcn.1010dced
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
cmp eax, ebx
jne 0x1002fc1c
push ebp
call fcn.1010dc10
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
jne 0x1002fc65
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.1002eae0
test eax, eax
jne 0x1002fc65
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x1002fc8f
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x1002fc98
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
movzx eax, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [ebp + 0x70]
mov dword [ebp + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
cmp esi, ebx
je 0x1002fcd5
mov cl, byte [esi]
cmp cl, bl
je 0x1002fcd5
call fcn.1002e820
add esi, 1
jne 0x1002fcc5
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10030000
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push ebp
mov ebp, dword [esp + 0xc]
push edi
jne 0x100300b5
cmp dword [esi + 4], 0xffffffff
jne 0x100300b5
lea edi, [esi + 0x140]
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10030030
sub eax, edx
mov cl, byte [eax + esi + 0x13f]
cmp cl, 0x5c
je 0x1003005a
cmp cl, 0x2f
je 0x1003005a
mov byte [eax + esi + 0x140], 0x2f
mov byte [eax + esi + 0x141], 0
cmp ebp, 1
jne 0x1003007a
push ebp
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1003007a
mov eax, 0x2000000
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ebp
push ecx
push ebx
call fcn.1002ef30
add esp, 0x10
test eax, eax
jne 0x1003009b
mov eax, dword [esp + 0x10]
pop edi
pop ebp
ret 8
call fcn.1002f440
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebp
ret 8
pop edi
mov eax, 0x1000000
pop ebp
ret 8

Function at 0x100306a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
mov ebp, dword [esp + 0x218]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x220]
cmp ebp, ebx
je 0x10030730
push 0x104
lea eax, [esp + 0x114]
push ebp
push eax
call fcn.1010ffa3
lea eax, [esp + 0x11c]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x100306f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100306f0
sub eax, edx
je 0x1003070e
lea ecx, [esp + eax + 0x10f]
mov al, byte [ecx]
cmp al, 0x2f
je 0x1003070c
cmp al, 0x5c
jne 0x1003070e
mov byte [ecx], bl
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10030730
push ebx
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi]
cmp al, bl
je 0x100307f2
push esi
mov esi, edi
mov ecx, edi
nop
cmp al, 0x2f
je 0x10030748
cmp al, 0x5c
jne 0x1003074a
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
cmp al, bl
jne 0x10030740
cmp esi, edi
je 0x1003077f
sub esi, edi
push esi
lea eax, [esp + 0x118]
push edi
push eax
call fcn.101162d0
lea ecx, [esp + 0x120]
push ecx
push ebp
mov byte [esp + esi + 0x128], bl
call fcn.100306a0
add esp, 0x14
mov byte [esp + 0x10], bl
pop esi
cmp ebp, ebx
je 0x1003079b
push 0x104
lea edx, [esp + 0x10]
push ebp
push edx
call fcn.1010ffa3
add esp, 0xc
lea eax, [esp + 0xc]
mov byte [esp + 0x10f], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100307b0
sub eax, edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x10]
push edi
push edx
call fcn.1010ffa3
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x113], bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100307f2
push ebx
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x214]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x20c
ret
Function at 0x100312a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x424
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [esp + 0x428]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x438]
push edi
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0
mov ebp, eax
test eax, eax
je 0x100312f2
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebp, [esp + 0x228]
push str.Random...
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [esp + 0x18]
lea edi, [esp + 0x24]
mov ecx, ebp
mov edx, ebx
call fcn.100315c0
cmp al, 1
jne 0x10031336
mov edx, edi
push esi
push edx
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x10031336
push eax
jmp 0x10031406
xor edi, edi
cmp esi, edi
je 0x10031366
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push 0x20006
push edi
push str.REG_SZ
push edi
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
je 0x1003136d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1003140e
cmp byte [esi], 0x25
mov ebx, 1
jne 0x10031389
lea edx, [esi + 1]
push 0x25
push edx
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x100313a6
cmp byte [esi], 0x22
jne 0x100313ab
cmp byte [esi + 1], 0x25
jne 0x100313ab
lea eax, [esi + 2]
push 0x25
push eax
call fcn.1010d780
add esp, 8
test eax, eax
je 0x100313ab
mov ebx, 2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100313b0
mov ecx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
push esi
push ebx
push edi
push ecx
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, edi
je 0x100313f6
cmp eax, edi
je 0x100313eb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1003140e
cmp eax, edi
je 0x10031405
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x424
ret 8
Function at 0x10031430
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebp
xor ebp, ebp
cmp dword [0x1018cc8c], 0xffffffff
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
jne 0x1003146a
push 0x1018cc8c
push str.RegDebug
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
test al, al
jne 0x1003146a
mov dword [0x1018cc8c], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0xc]
push ecx
push edi
mov ecx, ebx
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], eax
call fcn.10031670
cmp al, 1
jne 0x100314b8
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 8]
jne 0x100314b8
cmp dword [0x1018cc8c], ebp
je 0x100314aa
push str._REGDEBUG__Same_Value...
push ebp
call fcn.10053700
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
pop ebp
add esp, 0x10
ret
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push ebp
push 0x20006
push ebp
push str.REG_DWORD
push ebp
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebp
je 0x100314f2
cmp dword [0x1018cc8c], ebp
je 0x10031538
push esi
push str._REGDEBUG__Error_in_RegCreateKeyExx._LastErr:_u
jmp 0x1003152f
mov eax, dword [esp + 8]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push ebp
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 8]
cmp esi, ebp
je 0x10031547
cmp eax, ebp
je 0x10031521
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], ebp
cmp dword [0x1018cc8c], ebp
je 0x10031538
push esi
push str._REGDEBUG__Error_in_RegSetValueEx._LastErr:_u
push ebp
call fcn.10053700
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor al, al
pop ebp
add esp, 0x10
ret
cmp eax, ebp
je 0x10031556
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], ebp
cmp dword [0x1018cc8c], ebp
je 0x100315af
cmp ebx, ebp
je 0x10031597
cmp edi, ebp
je 0x1003158a
mov ecx, dword [esp + 0xc]
push ecx
push edi
push ebx
push str._REGDEBUG__Success_in_writing_to__s__s____d
push ebp
call fcn.10053700
add esp, 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret
mov edx, dword [esp + 0xc]
push edx
push ebx
push str._REGDEBUG__Success_in_writing_to__s_NULL____d
jmp 0x100315a6
cmp edi, ebp
je 0x100315af
mov eax, dword [esp + 0xc]
push eax
push edi
push str._REGDEBUG__Success_in_writing_to_NULL__s____d
push ebp
call fcn.10053700
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret
Function at 0x100315c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
mov dword [esp + 4], 0
test esi, esi
je 0x100315de
cmp dword [esi], 0
jbe 0x100315de
test edi, edi
je 0x100315de
mov byte [edi], 0
lea eax, [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10031603
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test esi, esi
je 0x10031649
test eax, eax
je 0x10031639
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
add esp, 8
ret 4
test eax, eax
je 0x1003165c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
pop esi
add esp, 8
ret 4

Function at 0x10031670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 1
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100316a6
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test esi, esi
je 0x100316f5
test eax, eax
je 0x100316e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
add esp, 0xc
ret 8
test eax, eax
je 0x10031708
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
pop esi
add esp, 0xc
ret 8

Function at 0x10031720
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1003174a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 4
mov eax, dword [esp + 8]
mov ecx, dword [esp]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 4]
test esi, esi
je 0x10031785
test eax, eax
je 0x10031777
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
pop ecx
ret 4
test eax, eax
je 0x10031798
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x100317b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x101482cc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x100317f9
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
push ebx
push eax
call edi
test eax, eax
jne 0x1003187c
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003187c
add eax, 0x40
push eax
call fcn.1004e860
mov ecx, dword [esp + 0xc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10031880
lea edx, [esp + 0xc]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push ecx
call edi
test eax, eax
je 0x10031869
push esi
call fcn.1010dc10
mov edx, dword [esp + 0xc]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x10032000
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x1016bb30
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11c], bl
push 0x103
push ebx
lea eax, [ebp - 0x11b]
push eax
call fcn.10116880
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.10116880
add esp, 0x18
cmp edi, ebx
je 0x100321b3
cmp byte [edi], bl
je 0x100321b3
push 0x5c
push edi
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x1003218b
call fcn.1004f190
test eax, eax
je 0x10032111
lea esi, [ebp - 0x11c]
call fcn.1005b520
cmp byte [ebp - 0x11c], bl
je 0x10032111
mov ecx, esi
lea edx, [ebp]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x100320c0
lea ecx, [ebp]
call fcn.10049c40
mov eax, edi
mov edx, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100320d6
sub eax, edx
lea edi, [ebp]
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x100320e3
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100321bc
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x11c], bl
je 0x1003218b
lea ecx, [ebp - 0x11c]
lea edx, [ebp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x10032134
lea ecx, [ebp]
call fcn.10049c40
mov eax, edi
mov edx, edi
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10032150
sub eax, edx
lea edi, [ebp]
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10032160
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100321bc
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100321bc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x108
mov esp, ebp
pop ebp
ret
Function at 0x10032860
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x110], eax
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0xc], ebp
lea esi, [ebp + 1]
cmp dword [0x1019e748], ebp
je 0x10032892
mov eax, dword [0x1019e74c]
mov dword [esp + 8], eax
jmp 0x100328b6
mov dword [0x1019e748], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100328ac
cmp al, 6
jb 0x100328ac
mov dword [0x1019e74c], esi
mov ecx, dword [0x1019e74c]
mov dword [esp + 8], ecx
lea edx, [esp + 0xc]
push edx
push str.Debug
mov ecx, 0x101482cc
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
cmp dword [esp + 0xc], ebp
je 0x100328eb
mov eax, dword [esp + 0x120]
push eax
push str.EnableDisableWindowsFirewall____u
push ebp
call fcn.10053700
add esp, 0xc
call fcn.1004f9f0
test eax, eax
je 0x10032a1c
call fcn.1004c7c0
cmp eax, 2
jle 0x1003290c
cmp dword [esp + 8], ebp
je 0x10032a1c
push edi
push 0x103
lea ecx, [esp + 0x1d]
push ebp
push ecx
call fcn.10116880
add esp, 0xc
mov ecx, 8
cmp dword [esp + 0x124], esi
jne 0x1003293e
mov ebp, esi
mov esi, str.netsh_firewall_set_opmode_enable
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003294b
mov esi, str.netsh_firewall_set_opmode_disable
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
mov eax, ebp
mov edi, str.WinFW
mov ebx, str.SOFTWAREMicroWorld
call fcn.10031430
pop ebx
test al, al
jne 0x10032979
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Error_setting_WinFW_value_to__u__LastError:__u
push 0
call fcn.10053700
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x100329b5
lea edx, [esp + 0x14]
push edx
push str.WinFW
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0xffffffff
call fcn.10031670
mov eax, dword [esp + 0x14]
push eax
push str.WinFW:__d
push 0
call fcn.10053700
add esp, 0xc
push 0
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x28]
push ecx
push 0
xor edx, edx
xor ecx, ecx
call fcn.10047950
cmp dword [esp + 0xc], 0
je 0x10032a1b
cmp dword [esp + 0x124], 1
jne 0x100329f3
mov ecx, 0xa
mov esi, str.netsh_advfirewall_set_allprofiles_state_on
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x10032a03
mov ecx, 0xb
mov esi, str.netsh_advfirewall_set_allprofiles_state_off
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
push 0
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x28]
push edx
push 0
xor edx, edx
xor ecx, ecx
call fcn.10047950
pop edi
mov ecx, dword [esp + 0x118]
pop esi
pop ebp
xor ecx, esp
call fcn.1010d699
add esp, 0x114
ret
Function at 0x10033960
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x10033a46
cmp byte [edi], 0
je 0x10033a46
inc eax
cmp byte [eax], 0
jne 0x10033974
sub eax, edi
push ebx
push esi
cmp eax, 0x104
jbe 0x100339a2
mov eax, edi
inc eax
cmp byte [eax], 0
jne 0x10033987
sub eax, edi
lea esi, [eax + eax + 0x20]
push esi
call fcn.1004e860
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100339d3
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x100339cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100339cd
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call ebx
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop edi
ret
cmp byte [edi], 0x5c
jne 0x100339f9
cmp byte [edi + 1], 0x5c
jne 0x100339f9
shr esi, 1
lea eax, [edi + 2]
dec esi
cmp byte [eax], 0x3f
jne 0x100339f1
push edi
push 0x1014a840
jmp 0x10033a02
push eax
push str._UNC_S
jmp 0x10033a02
push edi
shr esi, 1
push str.__S
dec esi
push esi
push ebx
call fcn.10111bf1
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x10033a37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10033a37
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call edi
mov esi, eax
push ebx
call fcn.1010dc10
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
ret

Function at 0x10033a60
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x10033b69
cmp word [ebx], 0
je 0x10033b69
lea edx, [eax + 2]
jmp 0x10033a80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10033a80
sub eax, edx
sar eax, 1
push esi
push edi
cmp eax, 0x104
jbe 0x10033ac2
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10033aa0
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 0x20]
push esi
call fcn.1004e860
mov edi, eax
add esp, 4
test edi, edi
jne 0x10033af3
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x10033aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10033aed
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
cmp word [ebx], 0x5c
jne 0x10033b1c
cmp word [ebx + 2], 0x5c
jne 0x10033b1c
shr esi, 1
lea eax, [ebx + 4]
dec esi
cmp word [eax], 0x3f
jne 0x10033b14
push ebx
push 0x10150150
jmp 0x10033b25
push eax
push str._UNC_s
jmp 0x10033b25
push ebx
shr esi, 1
push str.__s
dec esi
push esi
push edi
call fcn.10111bf1
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x10033b5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10033b5a
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call ebx
mov esi, eax
push edi
call fcn.1010dc10
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
ret