joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ae8f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
and dword [eax], 0
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov dword [ebp - 8], eax
jne 0x1000b001
push esi
mov esi, dword [ebp - 0x10]
test esi, esi
mov dword [ebp - 0xc], esi
je 0x1000afe6
push ebx
push edi
jmp 0x1000aed7
mov esi, dword [ebp - 0xc]
cmp dword [esi + 4], 2
jne 0x1000af7a
cmp dword [esi + 0x18], 0
je 0x1000af7a
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x1000af7a
push 0x10
pop edi
cmp eax, edi
jb 0x1000af7a
push 0x20
call dword [0x100a7090]
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
je 0x1000af8a
mov ecx, dword [esi]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [esi + 0xc]
push edi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
call dword [0x100a7090]
test eax, eax
pop ecx
mov dword [ebx + 0x18], eax
je 0x1000af93
mov esi, dword [esi + 0x18]
mov edi, eax
mov eax, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1000af61
push eax
call dword [0x100a709c]
test eax, eax
pop ecx
mov dword [ebx + 0x14], eax
je 0x1000afa3
cmp dword [ebp - 4], 0
jne 0x1000af6a
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000af74
mov dword [eax + 0x1c], ebx
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x14], ebx
mov esi, dword [esi + 0x1c]
test esi, esi
mov dword [ebp - 0xc], esi
jne 0x1000aed4
jmp 0x1000afbc
mov dword [ebp - 8], 8
jmp 0x1000afbc
push ebx
mov dword [ebp - 8], 8
call dword [0x100a7094]
jmp 0x1000afbb
push dword [ebx + 0x18]
mov dword [ebp - 8], 8
call dword [0x100a7094]
push ebx
call dword [0x100a7094]
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 0x10], esi
pop edi
pop ebx
je 0x1000afce
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], esi
je 0x1000afe1
push dword [ebp - 4]
call fcn.1000ae53
pop ecx
mov dword [ebp - 4], esi
jmp 0x1000aff5
cmp dword [ebp - 4], esi
jne 0x1000aff5
mov eax, 0x2af9
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x1000b353
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x48
push 1
mov ebx, eax
mov edi, ecx
call dword [0x100a70a0]
mov esi, eax
xor eax, eax
cmp esi, eax
pop ecx
pop ecx
mov dword [ebp - 4], 0xc
mov dword [edi + 0x3ac], esi
je 0x1000b405
mov dword [edi + 0x3a4], eax
mov dword [edi + 0x3a8], eax
mov dword [edi + 0x3a0], eax
mov dword [edi + 0x39c], ebx
or dword [esi + 4], 0xffffffff
push ebx
push dword [ebp + 8]
mov dword [esi], eax
lea eax, [esi + 0x10]
call fcn.1000b20f
test eax, eax
pop ecx
pop ecx
je 0x1000b405
lea ebx, [edi + 0x398]
push dword [ebx]
call fcn.100016ee
push dword [ebp + 8]
call dword [0x100a709c]
test eax, eax
pop ecx
pop ecx
mov dword [ebx], eax
je 0x1000b405
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1000b405
lea eax, [esi + 0x10]
push eax
push 0x1000b283
call fcn.10012a37
test eax, eax
pop ecx
pop ecx
mov dword [esi], eax
jne 0x1000b41f
call fcn.10064d53
mov eax, dword [eax]
mov dword [ebp - 4], eax
add edi, 0x398
push edi
call fcn.1000b301
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000b422
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ef79
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x31c
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x74]
xor edx, edx
push edi
xor edi, edi
cmp esi, 0xffffffff
mov dword [ebp + 0x64], edx
mov dword [ebp + 0x68], edx
jne 0x1000efad
cmp ebx, esi
jne 0x1000efad
mov eax, dword [ebp + 0x7c]
call fcn.1000ef5a
jmp 0x1000f14a
cmp dword [ebp + 0x7c], edx
jle 0x1000efc2
mov edi, dword [ebp + 0x7c]
call fcn.1001053f
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x64], eax
xor edx, edx
xor eax, eax
or ecx, 0xffffffff
inc eax
cmp esi, ecx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x1ac], edx
je 0x1000eff2
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], eax
mov ecx, esi
cmp ebx, 0xffffffff
mov dword [ebp - 0x2b0], edx
je 0x1000f049
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0xa8], edx
mov dword [ebp - 0x2ac], ebx
jbe 0x1000f025
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x1000f025
inc eax
cmp eax, dword [ebp - 0xa8]
jb 0x1000f013
cmp eax, dword [ebp - 0xa8]
jne 0x1000f043
cmp dword [ebp - 0xa8], 0x40
jae 0x1000f043
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 0xa8]
cmp ebx, ecx
jbe 0x1000f049
mov ecx, ebx
cmp dword [ebp + 0x7c], edx
jge 0x1000f052
xor ebx, ebx
jmp 0x1000f055
lea ebx, [ebp + 0x5c]
lea esi, [ecx + 1]
xor eax, eax
cmp dword [ebp + 0x7c], eax
jle 0x1000f074
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp + 0x60], edx
jmp 0x1000f079
jne 0x1000f07c
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1000f0d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1000f0af
cmp eax, 0x2714
jne 0x1000f0d9
cmp dword [ebp + 0x7c], 0
jle 0x1000f058
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call fcn.1001053f
push edx
push eax
call fcn.10010555
mov edi, dword [ebp + 0x7c]
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x1000f058
jmp 0x1000f0d9
test eax, eax
jge 0x1000f0de
or eax, 0xffffffff
jmp 0x1000f14a
jne 0x1000f0e4
xor eax, eax
jmp 0x1000f14a
xor esi, esi
cmp dword [ebp + 0x74], 0xffffffff
je 0x1000f116
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1000f100
inc esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1000f116
or esi, 4
cmp dword [ebp + 0x78], 0xffffffff
je 0x1000f148
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1000f132
or esi, 2
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1000f148
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x1001109c
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x100110a9
jmp dword [eax*4 + 0x10011104]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x10012de7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x10012e0b
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x10012e3c
cmp dword [esi + 8], 0
jne 0x10012e2c
push 0x10098340
push dword [eax + 8]
call fcn.100659fb
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x10012e2c
or eax, 0xffffffff
jmp 0x10012e62
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.10068e51
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10012e4a
cmp edi, dword [ebp + 0xc]
jbe 0x10012e60
test ebx, ebx
jne 0x10012e5a
push dword [esi + 8]
call fcn.10065a88
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x10014440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10014459
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10014496
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10014492
nop word [eax + eax]
cmp esi, edx
jae 0x10014496
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10014480
cmp esi, edx
jb 0x1001449d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10014780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x100a7070]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
mov ebx, ecx
mov eax, edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
push ecx
push 0xf003f
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001483d
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x200
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x10014828
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
call fcn.10014780
mov esi, eax
test esi, esi
jne 0x10014852
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x200
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x100147f0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.1004450b
mov esp, ebp
pop ebp
ret
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x424]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004450b
mov esp, ebp
pop ebp
ret

Function at 0x100149e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100149f0
xor eax, eax
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
ret
Function at 0x10014c60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008128b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x100a7070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], edx
push ecx
lea ecx, [ebp - 0x240]
xor ebx, ebx
call fcn.10018a60
push 0x22c
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.1005d9b0
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10014d33
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10014d2c
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x240]
call fcn.10063e01
add esp, 8
test eax, eax
je 0x10014d19
lea eax, [ebp - 0x23c]
push eax
push esi
call edi
test eax, eax
jne 0x10014cf0
jmp 0x10014d2c
mov ecx, dword [ebp - 0x244]
mov ebx, 1
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10014d74
mov esi, dword [edx]
push edx
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp ecx, 0x10097a44
jne 0x10014d70
mov ecx, dword [esi + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10014d74
mov ecx, esi
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004450b
mov esp, ebp
pop ebp
ret
Function at 0x10014da0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100a7070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
cmp dword [edi - 0xc], 0
jne 0x10014dd1
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004450b
mov esp, ebp
pop ebp
ret
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1005d9b0
add esp, 0xc
cmp dword [edi - 0xc], 0
jl 0x10014e31
push str._ALLUSERSPROFILE_
push edi
call fcn.1005ca26
add esp, 8
test eax, eax
je 0x10014e31
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x10014e31
push ecx
lea edx, [ebp - 0x210]
mov ecx, str._ALLUSERSPROFILE_
call fcn.10015010
add esp, 4
test eax, eax
je 0x10014dbf
lea eax, [ebp - 0x210]
push eax
push str._ALLUSERSPROFILE_
jmp 0x10014feb
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x10014e81
push str._APPDATA_
push eax
call fcn.1005ca26
add esp, 8
test eax, eax
je 0x10014e81
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x10014e81
push ecx
lea edx, [ebp - 0x210]
mov ecx, str._APPDATA_
call fcn.10015010
add esp, 4
test eax, eax
je 0x10014dbf
lea eax, [ebp - 0x210]
push eax
push str._APPDATA_
jmp 0x10014feb
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x10014ed1
push str._TEMP_
push eax
call fcn.1005ca26
add esp, 8
test eax, eax
je 0x10014ed1
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x10014ed1
push ecx
lea edx, [ebp - 0x210]
mov ecx, str._TEMP_
call fcn.10015010
add esp, 4
test eax, eax
je 0x10014dbf
lea eax, [ebp - 0x210]
push eax
push str._TEMP_
jmp 0x10014feb
push ecx
push str._SYSTEM_
mov ecx, esi
call fcn.10018620
cmp eax, 0xffffffff
je 0x10014f0e
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10014dbf
lea eax, [ebp - 0x210]
push eax
push str._SYSTEM_
jmp 0x10014feb
push ecx
push str._WINDOWS_
mov ecx, esi
call fcn.10018620
cmp eax, 0xffffffff
je 0x10014f4b
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10014dbf
lea eax, [ebp - 0x210]
push eax
push str._WINDOWS_
jmp 0x10014feb
push ecx
push str._CUR_DIR_
mov ecx, esi
call fcn.10018620
cmp eax, 0xffffffff
je 0x10014fa2
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1005d9b0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
push str._CUR_DIR_
jmp 0x10014feb
push ecx
push str._PROGRAMFILES_
mov ecx, esi
call fcn.10018620
cmp eax, 0xffffffff
je 0x10014ff9
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1005d9b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
push str._PROGRAMFILES_
mov ecx, esi
call fcn.10018660
mov ecx, esi
call fcn.10015140
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1004450b
mov esp, ebp
pop ebp
ret
Function at 0x10015010
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100a0ae8
push 0x1005f5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100a7070]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], edx
mov eax, ecx
mov dword [ebp - 0x20], eax
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x10015110
test edx, edx
je 0x10015110
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp ebx, 1
jb 0x10015110
cmp ebx, 0x103
ja 0x10015110
mov dword [ebp - 4], esi
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10044ce6
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x100150b0
mov dword [ebp - 4], 0xfffffffe
jmp 0x10015110
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.1005d9b0
add esp, 0xc
push ebx
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100150ef
cmp eax, 0x103
ja 0x100150ef
push eax
push esi
push 0x103
push dword [ebp - 0x24]
call fcn.10064e60
add esp, 0x10
mov edi, 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x10015110
test esi, esi
je 0x1001511d
push esi
call fcn.10044ce1
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015190
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100812c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100a7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.100138c0
mov ecx, eax
test ecx, ecx
jne 0x100151cc
push 0x80004005
call fcn.100142e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x10097a44
jne 0x100151e1
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x100151e3
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
lea eax, [ebp - 0x10]
push str._s_del__x
push eax
call fcn.10019da0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x10015249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call fcn.10064d66
add esp, 8
push 4
push 0
test eax, eax
je 0x1001523a
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edi, edi
jmp 0x1001524e
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10015249
xor edi, edi
jmp 0x1001524e
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10015297
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x10097a44
jne 0x10015295
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100160d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100814ab
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x100a7070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0xc]
cmp dword [ecx - 0xc], 0
je 0x10016150
mov eax, dword [edi + 8]
cmp dword [eax - 0xc], 0
je 0x10016150
mov eax, dword [edi + 0x10]
cmp dword [eax - 0xc], 0
je 0x10016150
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push eax
mov eax, dword [ebp + 8]
or eax, 0x20019
push eax
push 0
push ecx
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001616f
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004450b
mov esp, ebp
pop ebp
ret 4
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 2
push 0
push eax
mov dword [ebp - 0x22c], 0x105
call fcn.1005d9b0
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [edi + 8]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x224]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10016150
cmp dword [ebp - 0x228], 1
jne 0x10016150
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.10018a60
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], esi
call fcn.10014880
mov eax, dword [ebp - 0x220]
mov esi, 1
mov edx, esi
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x105
or edx, ecx
jge 0x10016235
push 0x105
lea ecx, [ebp - 0x220]
call fcn.100195b0
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.10018bc0
mov eax, dword [ebp - 0x220]
mov edi, dword [edi + 0x10]
mov ecx, dword [eax - 8]
sub esi, dword [eax - 4]
sub ecx, 0x105
or esi, ecx
jge 0x10016278
push 0x105
lea ecx, [ebp - 0x220]
call fcn.100195b0
mov eax, dword [ebp - 0x220]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.10018bc0
lea ecx, [ebp - 0x220]
call fcn.100149e0
lea ecx, [ebp - 0x220]
mov esi, eax
call fcn.10018360
mov eax, esi
jmp 0x10016152
Function at 0x10017da0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10017dbd
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.10017e20
test eax, eax
je 0x10017db6
push esi
push edi
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 8]
je 0x10017e00
mov eax, ebx
mov ebx, dword [edi]
test ebx, ebx
je 0x10017df8
mov esi, dword [ebx + 0x10]
cmp esi, dword [ebx + 0x14]
je 0x10017df8
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x10017e09
add esi, 4
cmp esi, dword [ebx + 0x14]
jne 0x10017de2
mov eax, dword [ebp - 4]
add edi, 4
cmp edi, dword [eax + 8]
jne 0x10017dd4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [ebx + 0xc], 1
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a1b0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100a7070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
test eax, eax
je 0x1001a2b6
cmp eax, 4
je 0x1001a2b6
cmp eax, 8
je 0x1001a2b6
push edi
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1001a2a1
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1005d9b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push esi
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x1001a26e
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.1005d9b0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1001a29a
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
call fcn.1001a2d0
test eax, eax
je 0x1001a29a
lea edx, [ebp - 0x20c]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001a277
sub edx, esi
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.10019610
mov esi, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004450b
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004450b
mov esp, ebp
pop ebp
ret 8