joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064590
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10116880
add esp, 0xc
push 0
push 0
call fcn.10067d10
mov esi, eax
test esi, esi
jne 0x100645e3
push edi
lea ecx, [esp + 0xc]
push 0x1013fb04
push ecx
call fcn.1010d6a8
add esp, 0xc
jmp 0x100645f7
push esi
push edi
lea edx, [esp + 0x10]
push str._s_d
push edx
call fcn.1010d6a8
add esp, 0x10
lea ecx, [esp + 8]
call fcn.10062010
mov ebx, eax
test ebx, ebx
je 0x1006460b
cmp ebx, 0xffffffff
jne 0x1006464d
test esi, esi
jbe 0x1006464d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1006464d
push edi
lea eax, [esp + 0xc]
push 0x1013fb04
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 8]
call fcn.10062010
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1010d699
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x108
ret

Function at 0x10064670
Capabilities:
Check os version

Disassembly:
sub esp, 8
push esi
push edi
mov edi, str.commstrt_mutex
xor esi, esi
call fcn.10064590
mov dword [esp + 0xc], eax
test eax, eax
je 0x100646a0
lea eax, [esp + 0xc]
push eax
mov esi, 1
call fcn.100673f0
pop edi
mov eax, esi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100646f3
lea edi, [eax - 4]
cmp dword [0x1019e748], esi
jne 0x100646d2
mov dword [0x1019e748], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100646d2
cmp al, 6
jb 0x100646d2
mov dword [0x1019e74c], edi
jmp 0x100646da
cmp dword [0x1019e74c], esi
je 0x100646f3
push ebx
lea ebx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.1004b960
cmp byte [esp + 0xf], 3
pop ebx
mov eax, edi
jne 0x100646f5
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x10064700
Capabilities:
Check os version

Disassembly:
sub esp, 8
push esi
push edi
mov edi, str.ctserver_mutex
xor esi, esi
call fcn.10064590
mov dword [esp + 0xc], eax
test eax, eax
je 0x10064730
lea eax, [esp + 0xc]
push eax
mov esi, 1
call fcn.100673f0
pop edi
mov eax, esi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10064783
lea edi, [eax - 4]
cmp dword [0x1019e748], esi
jne 0x10064762
mov dword [0x1019e748], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10064762
cmp al, 6
jb 0x10064762
mov dword [0x1019e74c], edi
jmp 0x1006476a
cmp dword [0x1019e74c], esi
je 0x10064783
push ebx
lea ebx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.1004b960
cmp byte [esp + 0xf], 3
pop ebx
mov eax, edi
jne 0x10064785
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x10064cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016f780
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push esi
call sym.EncDec.dll_IsSystemUser
test eax, eax
je 0x10064db0
call fcn.10064670
test eax, eax
jne 0x10064db0
mov dword [ebp + 0x10], 1
lea eax, [ebp + 0x10]
push eax
push str.ShowMsgWait
mov ecx, 0x101482cc
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
test al, al
jne 0x10064d46
mov eax, dword [ebp + 0x10]
mov edi, str.ShowMsgWait
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
call fcn.10031430
cmp dword [ebp + 0x10], esi
je 0x10064e99
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xa
push eax
call fcn.1010dced
add esp, 4
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x10064e2f
push edi
push 0x1013fb04
push eax
call fcn.1010d6a8
lea ecx, [ebp - 0x28]
push ecx
push esi
push 0x10067210
call fcn.1010d93f
add esp, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x10064e2f
cmp dword [ebp - 0x20], esi
jne 0x10064e2f
call fcn.100326c0
jmp 0x10064da0
push 1
call fcn.100647a0
mov edi, eax
cmp edi, esi
je 0x10064e99
push str.ShowMsg
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x10064ddd
push 2
call fcn.100647a0
jmp 0x10064e99
cmp dword [ebp + 0x10], esi
jne 0x10064e0c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call eax
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xa
push eax
call fcn.1010dced
add esp, 4
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0x10064e4f
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push 0x1013fb04
push eax
call fcn.1010d6a8
lea eax, [ebp - 0x28]
push eax
push esi
push 0x10067210
call fcn.1010d93f
add esp, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x10064e2f
cmp dword [ebp - 0x20], esi
jne 0x10064e2f
call fcn.100326c0
jmp 0x10064e75
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10065470
Capabilities:
Access the windows event log

Disassembly:
sub esp, 8
push esi
mov esi, eax
push esi
call fcn.10065200
add esp, 4
test eax, eax
je 0x100654e1
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
test esi, esi
je 0x100654e1
mov ecx, dword [esp + 0x14]
add ecx, 0x20000000
cmp edi, 3
jne 0x100654b6
lea eax, [edi - 2]
jmp 0x100654c2
xor eax, eax
cmp edi, 2
setne al
lea eax, [eax + eax + 2]
push 0
lea edx, [esp + 8]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 8
ret
Function at 0x10065bf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.systemcurrentcontrolsetcontrolcomputernamecomputername
mov ebx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call edi
test esi, esi
jne 0x10065c7b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push esi
push esi
push str.computername
push edx
mov dword [esp + 0x2c], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10065c69
push eax
call edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10065c80
mov eax, dword [esp + 0x10]
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10065c80
push esi
call edi
xor esi, esi
cmp byte [ebx], 0
mov eax, ebx
je 0x10065c8d
inc eax
cmp byte [eax], 0
jne 0x10065c87
sub eax, ebx
mov ebp, eax
test esi, esi
je 0x10065ca3
cmp byte [ebx], 0
je 0x10065ca3
cmp ebp, 0xf
jl 0x10065d34
push 0x103
lea ecx, [esp + 0x21]
push 0
push ecx
mov byte [esp + 0x28], 0
call fcn.10116880
add esp, 0xc
push str.Hostname
lea eax, [esp + 0x1c]
lea edi, [esp + 0x20]
mov ecx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x104
call fcn.100315c0
cmp byte [esp + 0x1c], 0
je 0x10065d34
mov esi, 1
mov eax, edi
cmp ebp, 0xf
jne 0x10065d1c
inc eax
cmp byte [eax], 0
jne 0x10065cf3
lea edx, [esp + 0x1c]
sub eax, edx
cmp eax, 0xf
jbe 0x10065d2c
mov ecx, edx
mov eax, edx
sub ebx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x10065d10
jmp 0x10065d2c
lea edx, [esp + 0x1c]
sub ebx, edx
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x10065d22
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x120]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x114
ret
Function at 0x10066060
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
test byte [0x101a3958], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jne 0x10066082
or dword [0x101a3958], 1
call esi
mov dword [0x101a3954], eax
xor edi, edi
cmp dword [0x1018cd34], 1
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
je 0x100660b3
call esi
sub eax, dword [0x101a3954]
cmp eax, 0x6d60
ja 0x100660b3
mov eax, dword [0x1018cd34]
pop edi
pop esi
add esp, 0x10
ret
call esi
mov dword [0x101a3954], eax
push edi
lea eax, [esp + 0xc]
push eax
push edi
call fcn.10065f80
add esp, 0xc
cmp eax, 0x7a
jne 0x10066246
mov ecx, dword [esp + 8]
push ebx
push ecx
call fcn.1010dced
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x10066237
push 1
lea edx, [esp + 0x10]
push edx
push ebx
call fcn.10065f80
add esp, 0xc
test eax, eax
jne 0x1006622e
push 4
call fcn.1010dced
mov esi, eax
add esp, 4
cmp esi, edi
je 0x1006622e
lea eax, [esp + 0x10]
push eax
push esi
call fcn.100662f0
add esp, 8
cmp eax, 0x6f
jne 0x10066210
push ebp
push esi
call fcn.1010dc10
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1010dced
mov ebp, eax
add esp, 8
mov dword [esp + 0x18], ebp
cmp ebp, edi
jne 0x10066164
push ebx
call fcn.1010dc10
add esp, 4
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x1018cd34], eax
pop esi
add esp, 0x10
ret
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.100662f0
add esp, 8
test eax, eax
jne 0x100661f1
mov edi, dword [ebx]
xor esi, esi
test edi, edi
jbe 0x100661c3
lea edx, [ebx + 0x224]
mov eax, ebp
xor ecx, ecx
test ecx, ecx
jne 0x100661a3
mov ebp, dword [eax + 0x19c]
cmp ebp, dword [edx - 0x20]
jne 0x10066199
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x10066188
test ecx, ecx
je 0x100661b4
mov eax, dword [edx]
cmp eax, 3
je 0x100661e6
cmp eax, 4
je 0x100661e6
cmp eax, 5
je 0x100661e6
mov ebp, dword [esp + 0x18]
inc esi
add edx, 0x35c
cmp esi, edi
jb 0x10066184
mov esi, dword [esp + 0x1c]
push ebx
call fcn.1010dc10
push ebp
call fcn.1010dc10
add esp, 8
pop ebp
pop ebx
pop edi
mov dword [0x1018cd34], esi
mov eax, esi
pop esi
add esp, 0x10
ret
mov ebp, dword [esp + 0x18]
mov esi, 1
jmp 0x100661c7
push ebx
call fcn.1010dc10
push ebp
call fcn.1010dc10
add esp, 8
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x1018cd34], eax
pop esi
add esp, 0x10
ret
push ebx
call fcn.1010dc10
push esi
call fcn.1010dc10
add esp, 8
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x1018cd34], eax
pop esi
add esp, 0x10
ret
push ebx
call fcn.1010dc10
add esp, 4
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x1018cd34], eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop edi
mov dword [0x1018cd34], eax
pop esi
add esp, 0x10
ret
Function at 0x10067b30
Capabilities:
Check os version

Disassembly:
push ecx
push ebx
mov ebx, 1
test byte [0x101a37e0], bl
jne 0x10067b72
or dword [0x101a37e0], ebx
cmp dword [0x1019e748], 0
jne 0x10067b68
mov dword [0x1019e748], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10067b68
cmp al, 6
jb 0x10067b68
mov dword [0x1019e74c], ebx
mov eax, dword [0x1019e74c]
mov dword [0x101a37dc], eax
mov eax, dword [0x1018cd38]
cmp eax, 0xffffffff
jne 0x10067b86
call fcn.1004c7c0
mov dword [0x1018cd38], eax
cmp eax, 2
jle 0x10067bd1
call fcn.1004c6e0
test eax, eax
je 0x10067bd1
cmp dword [0x101a37dc], 0
je 0x10067ba6
call fcn.1004b350
test eax, eax
jne 0x10067bd1
cmp esi, 0xfffffffe
jne 0x10067bb9
lea ecx, [esp + 4]
push ecx
push 0
call fcn.10067d10
jmp 0x10067bbd
mov dword [esp + 4], esi
call fcn.10067f00
cmp eax, dword [esp + 4]
je 0x10067bd1
test eax, eax
je 0x10067bd1
xor eax, eax
pop ebx
pop ecx
ret
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10067d10
Capabilities:
Check os version

Disassembly:
sub esp, 8
test byte [0x101a37f8], 1
push ebx
push ebp
push esi
mov esi, 1
jne 0x10067d34
or dword [0x101a37f8], esi
call fcn.1004f9f0
mov dword [0x101a37f4], eax
mov eax, 2
test byte [0x101a37f8], al
jne 0x10067d74
or dword [0x101a37f8], eax
cmp dword [0x1019e748], 0
jne 0x10067d6a
mov dword [0x1019e748], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10067d6a
cmp al, 6
jb 0x10067d6a
mov dword [0x1019e74c], esi
mov eax, dword [0x1019e74c]
mov dword [0x101a37f0], eax
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x10067d7e
mov dword [ebx], esi
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10067d8d
mov dword [ebp], 0
cmp dword [0x101a37f4], 0
jne 0x10067da1
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [0x101a270c], 0
jne 0x10067dc3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101a270c], eax
test eax, eax
je 0x10067d96
cmp eax, 0xffffffff
je 0x10067d96
cmp dword [0x101a271c], 0
jne 0x10067e22
mov ecx, str.Wtsapi32.dll
call fcn.10032000
mov dword [0x101a271c], eax
test eax, eax
je 0x10067d96
cmp eax, 0xffffffff
je 0x10067d96
mov ecx, dword [0x101a270c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push ecx
call esi
mov edx, dword [0x101a271c]
push str.WTSQuerySessionInformationA
push edx
mov dword [0x101a2710], eax
call esi
mov dword [0x101a2714], eax
mov eax, dword [0x101a271c]
push str.WTSFreeMemory
push eax
call esi
mov dword [0x101a2718], eax
mov eax, dword [0x101a2710]
test eax, eax
je 0x10067d96
cmp dword [0x101a2714], 0
je 0x10067d96
cmp dword [0x101a2718], 0
je 0x10067d96
push edi
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x10067e5f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 8
xor esi, esi
push edi
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [0x101a2714]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x10067e99
cmp dword [esp + 0x14], 4
jne 0x10067e99
cmp ebx, esi
je 0x10067e99
xor ecx, ecx
cmp dword [eax], esi
sete cl
mov dword [ebx], ecx
cmp eax, esi
je 0x10067ea8
push eax
call dword [0x101a2718]
mov dword [esp + 0x10], esi
mov esi, edi
test ebp, ebp
je 0x10067eb1
mov dword [ebp], edi
cmp dword [0x101a37f0], 0
je 0x10067ebf
test edi, edi
jbe 0x10067ebf
dec edi
call fcn.10067be0
test eax, eax
je 0x10067ed3
call fcn.10067b30
test eax, eax
jne 0x10067ed3
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10069280
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x320
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebp
mov ebp, dword [esp + 0x328]
push esi
push edi
push 0x103
lea eax, [esp + 0x221]
push 0
push eax
mov byte [esp + 0x228], 0
call fcn.10116880
add esp, 0xc
lea edi, [esp + 0x21c]
mov byte [ebp], 0
call fcn.10039e30
cmp eax, 1
jne 0x100693ca
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.10116880
push 0x103
lea edx, [esp + 0x125]
push 0
push edx
mov byte [esp + 0x12c], 0
call fcn.10116880
add esp, 0x18
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea ecx, [esp + 0x10]
push ecx
call edi
cmp byte [esp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x1006934f
lea eax, [esp + 0xc]
lea esp, [esp]
inc eax
cmp byte [eax], 0
jne 0x10069330
lea edx, [esp + 0xc]
sub eax, edx
je 0x1006934f
cmp byte [esp + eax + 0xb], 0x5c
je 0x1006934f
push 0x10149ea8
mov eax, edx
push eax
call esi
push str.eserv.ini
lea ecx, [esp + 0x10]
push ecx
call esi
push 1
push 0
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x100693ca
lea edx, [esp + 0xc]
push edx
push 0x104
lea eax, [esp + 0x11c]
push eax
push 0x1013f817
push str.FTPDownloadDir
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x114], 0
je 0x100693ca
lea ecx, [esp + 0x114]
push 0
push ecx
call fcn.10044cc0
add esp, 8
test eax, eax
je 0x100693ca
lea esi, [esp + 0x114]
call fcn.10049c80
mov edx, esi
push edx
push ebp
call edi
mov ecx, dword [esp + 0x328]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1010d699
add esp, 0x320
ret 4
Function at 0x1006aab0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x748
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x744], eax
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x645]
push ebx
push eax
mov byte [esp + 0x64c], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [esp + 0x225]
push ebx
push ecx
mov byte [esp + 0x22c], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea edx, [esp + 0x53d]
push ebx
push edx
mov byte [esp + 0x544], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.10116880
lea ecx, [esp + 0x1c]
add esp, 0xc
push ecx
lea edx, [esp + 0x224]
lea ecx, [esp + 0x644]
call fcn.10056870
add esp, 4
cmp byte [esp + 0x10], bl
jne 0x1006ab76
cmp byte [esp + 0x220], bl
je 0x1006ab76
lea ecx, [esp + 0x10]
lea edx, [esp + 0x220]
call fcn.10043ff0
lea edx, [esp + 0x220]
push edx
push 0x104
lea eax, [esp + 0x540]
push eax
push 0x1013fc40
push str.InstalledForEScan
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ecx, ecx
cmp byte [esp + 0x538], 0x30
setne cl
mov dword [esp + 0xc], ecx
cmp byte [esp + 0x10], bl
je 0x1006abd0
lea edx, [esp + 0x10]
push ebx
push edx
call fcn.10044cc0
add esp, 8
test eax, eax
je 0x1006abd0
lea eax, [esp + 0x10]
push eax
jmp 0x1006abd8
lea ecx, [esp + 0x640]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call edi
cmp dword [esp + 0xc], ebx
jne 0x1006ad06
push 0x103
lea edx, [esp + 0x435]
push ebx
push edx
mov byte [esp + 0x43c], bl
call fcn.10116880
add esp, 0xc
push 0x104
lea eax, [esp + 0x434]
push eax
push 0x1013f817
mov edx, str.InstallDirectory
mov ecx, str.MailScan
call fcn.100436c0
add esp, 0xc
cmp byte [esp + 0x430], bl
je 0x1006ad06
lea ecx, [esp + 0x430]
push ebx
push ecx
call fcn.10044cc0
add esp, 8
cmp eax, 1
jne 0x1006ad06
push 0x103
lea edx, [esp + 0x32d]
push ebx
push edx
mov byte [esp + 0x334], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea eax, [esp + 0x11d]
push ebx
push eax
mov byte [esp + 0x124], bl
call fcn.10116880
add esp, 0xc
push esi
lea ecx, [esp + 0x32c]
push ecx
call edi
mov ecx, esi
call fcn.10049c40
push str.AVPLITE
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push esi
call fcn.10044cc0
add esp, 8
test eax, eax
je 0x1006acfb
push esi
lea eax, [esp + 0x11c]
push eax
call edi
lea ecx, [esp + 0x118]
call fcn.10049c40
push str..avs
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x120]
call fcn.10044660
add esp, 8
test eax, eax
je 0x1006ad06
lea edx, [esp + 0x328]
push edx
push esi
call edi
mov ecx, dword [esp + 0x74c]
pop edi
pop ebx
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
Function at 0x1006afe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor esi, esi
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0x10
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x1006b073
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
push str.Control_PanelDesktop
push closesocket
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1006b058
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push esi
push esi
push esi
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x1006b073
push esi
lea edx, [esp + 0xc]
push edx
push esi
push 0x72
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret

Function at 0x1006b200
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
push eax
push 1
xor edi, edi
push edi
push str.ClusterResourceTypesMicrosoft_Exchange_Information_Store
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1006b250
mov ecx, dword [esp + 8]
push esi
push esi
push esi
push esi
push str.DllName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1006b245
lea edi, [esi + 1]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1006bd80
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x830
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x82c], eax
push ebp
push esi
xor ebp, ebp
mov esi, ecx
push edi
mov dword [esp + 0x10], ebp
cmp esi, ebp
je 0x1006bec5
cmp byte [esi], 0
je 0x1006bec5
cmp ebx, ebp
je 0x1006bec5
push ebp
push esi
mov byte [ebx], 0
call fcn.1004dcf0
add esp, 8
push esi
test eax, eax
jne 0x1006be87
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x820], ebp
call esi
push 0x1013f817
lea ecx, [esp + 0x418]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
push ebp
push 0x1006bc90
mov dword [esp + 0x828], ebp
call fcn.1010d93f
add esp, 0xc
mov dword [esp + 0x824], eax
cmp eax, 0xffffffff
je 0x1006be96
cmp dword [esp + 0x81c], ebp
jne 0x1006be33
mov esi, 5
call fcn.100326d0
cmp dword [esp + 0x81c], ebp
je 0x1006be20
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x2710
jae 0x1006be6b
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 5
call ebp
cmp dword [esp + 0x818], 1
je 0x1006be75
call esi
sub eax, edi
cmp eax, 0x2710
jb 0x1006be50
xor ebp, ebp
cmp dword [esp + 0x818], 1
jne 0x1006beb2
cmp byte [esp + 0x414], 0
je 0x1006be96
lea eax, [esp + 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x82c]
xor ecx, esp
call fcn.1010d699
add esp, 0x830
ret
mov eax, dword [esp + 0x828]
cmp eax, ebp
je 0x1006be96
mov dword [eax], 1
jmp 0x1006be96
mov ecx, dword [esp + 0x838]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x830
ret