joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004b06
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x398], eax
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
xor ebx, ebx
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.Path
push str.SoftwareMozillaPlugins_123juzi.com_npJuziAgent
push SysReAllocStringLen
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10004bc7
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004bc7
xor eax, eax
push esi
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.10012df0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x78]
push eax
push dword [0x1002e828]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
jne 0x10004bc7
inc ebx
mov ecx, dword [ebp + 0x398]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x39c
leave
ret

Function at 0x10004be0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10004b06
test eax, eax
jne 0x10004c68
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10012df0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x20c]
push eax
push dword [0x1002e828]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10004c39
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.Path
push str.SoftwareMozillaPlugins_123juzi.com_npJuziAgent
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.1000e51f
leave
ret
Function at 0x10005b1b
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x80], ebx
cmp dword [0x1002e878], esi
jne 0x10005c31
push edi
lea eax, [ebp - 0x78]
push eax
mov edi, str.lastchktime
mov eax, edi
mov dword [0x1002e878], 1
mov dword [ebp - 0x78], esi
call fcn.10008e5a
pop ecx
test eax, eax
jne 0x10005b71
mov dword [ebp - 0x78], esi
push esi
call fcn.1000ef72
pop ecx
cmp eax, dword [ebp - 0x78]
jb 0x10005b8e
mov ecx, eax
sub ecx, dword [ebp - 0x78]
cmp ecx, 0x2a30
jb 0x10005c30
push eax
mov ecx, edi
call fcn.10008f53
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
lea eax, [ebp - 0x7c]
push eax
push esi
push ebx
push 0x10005f21
push esi
push esi
mov dword [ebp - 0x7c], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
call fcn.10012df0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.hao123Juzi.exe
push eax
mov dword [ebp - 0x78], eax
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
je 0x10005c30
push str.Juzi.exe
push dword [ebp - 0x78]
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
je 0x10005c30
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
push ecx
push esi
push eax
push 0x10005cc0
push esi
push esi
mov dword [eax + 4], 1
mov dword [ebp - 0x7c], esi
call edi
push eax
call ebx
pop edi
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000e51f
add ebp, 0x198
leave
ret

Function at 0x10005e85
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push 0x20
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x10005f1b
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x10005f11
lea eax, [edi + 2]
push ebx
push eax
call fcn.1000e3b8
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x10005f10
lea eax, [edi + 2]
push eax
push esi
push ebx
call fcn.10012df0
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10005f09
cmp edi, dword [ebp - 4]
jne 0x10005f09
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xc], 1
call fcn.100026dc
push ebx
call fcn.1000ef67
pop ecx
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x1000654d
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push esi
mov dword [ebp - 0x80], eax
mov dword [eax + 0x28], 0x208
push edi
lea eax, [ebp - 0x7c]
xor edi, edi
push eax
mov esi, 0x1002641c
mov eax, esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
call fcn.10008e5a
pop ecx
test eax, eax
je 0x1000672c
cmp dword [ebp - 0x7c], edi
je 0x1000672c
push ebx
mov eax, esi
call fcn.10008ff9
xor eax, eax
push 0x7e
mov word [ebp + 0x8c], ax
lea eax, [ebp + 0x8e]
push edi
push eax
call fcn.10012df0
mov esi, str.chkupdate
push esi
lea ebx, [ebp + 0x8c]
call fcn.10008e95
add esp, 0x10
test eax, eax
je 0x1000672b
cmp word [ebp + 0x8c], di
je 0x1000672b
mov eax, esi
call fcn.10008ff9
cmp word [0x1002eb08], di
jne 0x10006606
call fcn.10006ce3
mov esi, eax
jmp 0x1000660b
mov esi, 0x1002eb08
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000672b
xor eax, eax
push 0x7e
mov word [ebp + 0x10c], ax
lea eax, [ebp + 0x10e]
push edi
push eax
call fcn.10012df0
add esp, 0xc
lea edx, [ebp + 0x10c]
mov ecx, esi
call fcn.1000878e
lea eax, [ebp + 0x10c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1000664b
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x10c]
push eax
push 0x1002d19c
call fcn.10011aa0
xor eax, eax
push 0x7e
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.10012df0
push 0xf0
lea ebx, [ebp - 0x74]
mov ecx, 0x1002d178
call fcn.100086c3
mov eax, ebx
push eax
lea eax, [ebp + 0x8c]
push eax
call fcn.1000ea21
add esp, 0x24
test eax, eax
jne 0x1000672b
push 0x7e
mov word [ebp + 0xc], ax
lea eax, [ebp + 0xe]
push edi
push eax
call fcn.10012df0
push 0x3f
lea edi, [ebp + 0xc]
call fcn.10008278
add esp, 0x10
test eax, eax
je 0x1000672b
mov eax, edi
push eax
call fcn.10006cbe
push eax
call fcn.100034e0
pop ecx
pop ecx
test eax, eax
jge 0x1000672b
push esi
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000671a
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000671a
push 0x1002750c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006713
call eax
mov edi, eax
neg edi
sbb edi, edi
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, esi
mov dword [ebp - 0x78], edi
call fcn.10008cc1
mov eax, dword [ebp - 0x80]
and dword [eax + 0x28], 0
pop ebx
mov ecx, dword [ebp + 0x18c]
mov eax, dword [ebp - 0x78]
pop edi
xor ecx, ebp
pop esi
call fcn.1000e51f
add ebp, 0x190
leave
ret 4
Function at 0x10007157
Capabilities:
Get mac address on windows
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x164
lea ebp, [esp - 4]
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x164], eax
push 0x14
mov eax, 0x100223fe
call fcn.10010edd
mov eax, dword [ebp + 0x170]
mov esi, 0x288
push esi
mov dword [ebp - 0x10], eax
call fcn.1000e3b8
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
xor ebx, ebx
cmp eax, 0x6f
jne 0x100071d5
mov eax, dword [ebp - 0x18]
dec eax
cmp eax, 0xfffe
ja 0x10007340
push dword [ebp - 0x14]
call fcn.1000ef67
push dword [ebp - 0x18]
call fcn.1000e3b8
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
jne 0x10007340
mov esi, dword [ebp - 0x14]
jmp 0x10007338
lea edi, [esi + 8]
cmp edi, ebx
je 0x10007336
cmp byte [edi], bl
je 0x10007336
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea ecx, [ebp]
call fcn.100025d3
push edi
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
call fcn.10009021
push str.Connection
lea eax, [ebp]
push eax
call fcn.10009021
mov eax, 0x104
push eax
mov dword [ebp - 0x1c], eax
xor edi, edi
lea eax, [ebp + 0x1d]
push ebx
inc edi
push eax
mov dword [ebp - 0x20], edi
mov byte [ebp + 0x1c], bl
call fcn.10012df0
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 0x10
jae 0x1000724b
lea eax, [ebp + 4]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push str.PnPInstanceId
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push 3
lea eax, [ebp + 0x1c]
push 0x10026908
push eax
call fcn.1000f9b4
add esp, 0xc
test eax, eax
je 0x1000729d
push 3
lea eax, [ebp + 0x1c]
push 0x1002690c
push eax
call fcn.1000f9b4
add esp, 0xc
test eax, eax
je 0x1000729d
push ebx
push edi
jmp 0x1000732a
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], ebx
je 0x100072b0
push 0x10026910
push eax
call fcn.10009021
xor edi, edi
cmp dword [esi + 0x190], ebx
jbe 0x1000731b
push 0x3f
lea eax, [ebp + 0x125]
push ebx
push eax
mov byte [ebp + 0x124], bl
call fcn.10012df0
movzx eax, byte [esi + edi + 0x194]
push eax
push str._.2X
lea eax, [ebp + 0x124]
push 0x40
push eax
call fcn.1000fa12
add esp, 0x1c
lea eax, [ebp + 0x124]
push eax
push dword [ebp - 0x10]
call fcn.10009021
cmp edi, dword [esi + 0x190]
jae 0x10007312
push 0x1002691c
push dword [ebp - 0x10]
call fcn.10009021
inc edi
cmp edi, dword [esi + 0x190]
jb 0x100072ba
lea eax, [esi + 8]
push eax
push dword [ebp - 0x10]
call fcn.10009021
push ebx
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.10001b16
mov esi, dword [esi]
cmp esi, ebx
jne 0x100071e5
push dword [ebp - 0x14]
call fcn.1000ef67
pop ecx
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0x14], ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x164]
xor ecx, ebp
call fcn.1000e51f
add ebp, 0x168
leave
ret
Function at 0x10007cb8
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x90
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
xor esi, esi
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x10007d94
push ebx
xor eax, eax
push 0x7e
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xe]
push esi
push eax
call fcn.10012df0
push str.umid
lea ebx, [ebp - 0x10]
call fcn.10008e95
add esp, 0x10
test eax, eax
je 0x10007d0b
cmp word [ebp - 0x10], si
jne 0x10007d76
push edi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
push 0x10007c7a
push esi
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0x493e0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10007d6a
push 0x80
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.10012df0
push str.umid
lea ebx, [ebp - 0x10]
call fcn.10008e95
add esp, 0x10
push dword [ebp - 0x14]
call edi
pop edi
cmp word [ebp - 0x10], si
je 0x10007d8f
lea eax, [ebp - 0x10]
push eax
push 0x1002548c
push 0x40
push dword [ebp - 0x1c]
call fcn.1000efc3
xor esi, esi
add esp, 0x10
inc esi
mov eax, esi
pop ebx
jmp 0x10007d96
xor eax, eax
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
pop esi
call fcn.1000e51f
add ebp, 0x74
leave
ret
Function at 0x10007f95
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
push 0x118
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
mov dword [ebp - 0xa8], 0x11c
call fcn.10012df0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call esi
test eax, eax
jne 0x10007ffb
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
test eax, eax
je 0x100080b6
mov eax, dword [ebp - 0x98]
sub eax, edi
je 0x100080b6
dec eax
je 0x100080b6
dec eax
jne 0x100080b6
mov eax, dword [ebp - 0xa4]
cmp eax, 0xa
jne 0x10008035
cmp dword [ebp - 0xa0], edi
jne 0x100080b6
mov al, 5
jmp 0x100080b8
cmp eax, 6
jne 0x1000805d
mov eax, dword [ebp - 0xa0]
cmp eax, 2
je 0x1000804a
cmp eax, 3
jne 0x1000804e
mov al, 3
jmp 0x100080b8
cmp eax, 1
jne 0x10008057
mov al, 2
jmp 0x100080b8
cmp eax, edi
jne 0x100080b6
jmp 0x10008053
cmp eax, 5
jne 0x100080b6
cmp dword [ebp - 0xa0], 2
jne 0x100080ab
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xcc], 0x24
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x100080b6
cmp byte [ebp + 0x72], 1
jne 0x100080b6
cmp word [ebp - 0xcc], 9
jmp 0x100080b2
cmp dword [ebp - 0xa0], 1
mov al, 1
je 0x100080b8
mov al, 4
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.1000e51f
add ebp, 0x78
leave
ret

Function at 0x10008154
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x294], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x298]
push eax
push 0x100259c4
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push SysReAllocStringLen
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x29c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000826a
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000826a
push esi
push edi
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.10012df0
push 0x3f
lea edi, [ebp - 0x84]
lea esi, [ebp - 0x290]
call fcn.10008278
add esp, 0x10
pop edi
pop esi
test eax, eax
je 0x1000826a
lea eax, [ebp - 0x84]
push 0x2e
push eax
call fcn.1000f096
pop ecx
pop ecx
test eax, eax
je 0x1000826a
add eax, 2
push 0x2e
push eax
call fcn.1000f096
pop ecx
pop ecx
test eax, eax
je 0x1000826a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x84]
push eax
push 0x1002548c
push 0x40
push dword [ebp - 0x294]
call fcn.1000efc3
xor eax, eax
add esp, 0x10
inc eax
jmp 0x1000826c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e51f
leave
ret
Function at 0x10008278
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3f90]
mov eax, 0x4010
call fcn.1001dd10
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x3f8c], eax
push ebx
xor ebx, ebx
test esi, esi
je 0x10008342
test edi, edi
je 0x10008342
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008342
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10008342
cmp eax, 0x2000
ja 0x10008342
lea ecx, [ebp - 0x74]
push ecx
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000833e
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10025620
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000833e
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
mov eax, dword [ebp + 0x3f98]
push 0x10025624
dec eax
push eax
push edi
call fcn.1000efc3
add esp, 0x1c
inc ebx
mov eax, ebx
jmp 0x10008344
xor eax, eax
mov ecx, dword [ebp + 0x3f8c]
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x3f90
leave
ret

Function at 0x1000835a
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
xor eax, eax
cmp esi, edi
je 0x100083e3
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.10012df0
add esp, 0xc
push edi
push 0x26
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100083e1
lea eax, [ebp - 0x20c]
push eax
push 0x1002548c
push 0x103
push esi
call fcn.1000efc3
add esp, 0x10
inc edi
mov eax, edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1000e51f
leave
ret

Function at 0x10008547
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push 1
mov ebx, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
xor ebp, ebp
push ebp
push esi
mov dword [esp + 0x20], ebp
call edi
mov eax, dword [esi]
cmp eax, ebp
jne 0x1000857d
push 0xf0000048
push 1
push ebx
push ebp
push esi
call edi
mov eax, dword [esi]
cmp eax, ebp
je 0x100085a6
push dword [esp + 0x14]
push ebp
push ebp
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000859d
mov dword [esp + 0xc], 1
jmp 0x100085a6
push ebp
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000878e
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor ebx, ebx
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x78], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100087ff
cmp esi, ebx
je 0x100087ff
push 0x100274d0
push edi
call fcn.1000f5d4
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x100088d9
lea eax, [ebp - 0x74]
push eax
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call fcn.10008547
pop ecx
test eax, eax
jne 0x10008819
push dword [ebp - 0x70]
call fcn.1000f846
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x59c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x5a0
leave
ret
push 0x3ff
lea eax, [ebp - 0x6b]
push ebx
xor edi, edi
push eax
inc edi
mov byte [ebp - 0x6c], bl
call fcn.10012df0
push dword [ebp - 0x70]
mov esi, 0x400
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.1000fd61
add esp, 0x1c
jmp 0x1000886e
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call fcn.100085af
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x10008872
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push esi
push 1
push eax
call fcn.1000fd61
add esp, 0x10
cmp eax, ebx
jne 0x10008846
xor eax, eax
push 0x206
mov word [ebp + 0x394], ax
lea eax, [ebp + 0x396]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
cmp edi, ebx
je 0x100088c3
push dword [ebp - 0x74]
lea edi, [ebp + 0x394]
call fcn.100085d4
pop ecx
test eax, eax
je 0x100088c3
mov eax, edi
push eax
push 0x1002548c
push 0x3f
push dword [ebp - 0x80]
call fcn.1000efc3
add esp, 0x10
mov dword [ebp - 0x78], 1
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
call fcn.10008698
push dword [ebp - 0x70]
call fcn.1000f846
add esp, 0xc
mov eax, dword [ebp - 0x78]
jmp 0x10008801
Function at 0x100088e1
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x10022569
call fcn.10010f46
mov ebx, ecx
xor esi, esi
push 0x10025689
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
mov edi, edx
mov dword [ebp - 0x34], esi
call fcn.100025d3
push 0x100274d8
push edi
mov dword [ebp - 4], esi
call fcn.1000f5d4
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
jne 0x10008939
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.1000442f
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001b16
mov eax, ebx
jmp 0x100089ba
push 2
push esi
push edi
call fcn.1000fe08
push edi
call fcn.1001002a
push esi
mov ebx, eax
push esi
push edi
mov dword [ebp - 0x34], ebx
call fcn.1000fe08
lea eax, [ebx + 1]
push eax
call fcn.1000e3b8
mov ebx, eax
add esp, 0x20
cmp ebx, esi
jne 0x1000896f
push edi
call fcn.1000f846
jmp 0x1000899f
mov eax, dword [ebp - 0x34]
inc eax
push eax
push esi
push ebx
call fcn.10012df0
push edi
push dword [ebp - 0x34]
push 1
push ebx
call fcn.1000fd61
push edi
call fcn.1000f846
add esp, 0x20
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100026dc
push ebx
call fcn.1000ef67
pop ecx
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.1000442f
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001b16
mov eax, dword [ebp - 0x30]
call fcn.10010fc9
ret
Function at 0x10008a67
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008b7d
push ebx
push edi
mov eax, 0xcd44
mov word [ebp - 0x10], ax
mov eax, 0x11d0
mov word [ebp - 0xe], ax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop edi
xor ebx, ebx
push 0x30
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0x14], 0xaac56b
mov byte [ebp - 0xc], 0x8c
mov byte [ebp - 0xb], 0xc2
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0xc0
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0xc2
mov byte [ebp - 6], 0x95
mov byte [ebp - 5], 0xee
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
call fcn.10012df0
lea eax, [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x60], 0x30
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x38], edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jl 0x10008b22
xor eax, eax
inc eax
jmp 0x10008b7b
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call sub.WINTRUST.dll_CryptCATAdminAcquireContext
test eax, eax
je 0x10008b7b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
xor edi, edi
call fcn.100089c0
add esp, 0xc
test eax, eax
je 0x10008b70
push ebx
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.WINTRUST.dll_CryptCATAdminEnumCatalogFromHash
cmp eax, ebx
je 0x10008b67
push ebx
push eax
push dword [ebp - 0x18]
inc edi
call sub.WINTRUST.dll_CryptCATAdminReleaseCatalogContext
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [ebp - 0x18]
call sub.WINTRUST.dll_CryptCATAdminReleaseContext
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e51f
leave
ret