joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074180
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x14
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
xor edx, edx
push edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
lea edx, [esp + 4]
push edx
mov edx, dword [eax + 4]
push edx
push eax
push 0xc
lea eax, [esp + 0x18]
push eax
push 0x2d1400
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10127db1
add esp, 0x14
ret 4
Function at 0x10075210
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x114
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x10075351
push ebx
lea eax, [esp + 0x10]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, reloc.WS2_32.dll_bind
mov dword [esp + 0x10], 0x104
mov byte [edi], 0
call fcn.10059d80
cmp byte [edi], 0
je 0x100752cc
call fcn.100610e0
test eax, eax
je 0x100752cc
call fcn.1006bbf0
test eax, eax
je 0x100752f3
mov eax, str.Common_AppData
mov ecx, ebx
call fcn.1005a090
test eax, eax
jne 0x100752f3
push 0x103
push eax
mov byte [esp + 0x18], al
lea eax, [esp + 0x19]
push eax
call fcn.1012e060
add esp, 0xc
push edi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
call fcn.10065200
push str.microsoft
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push 0
push eax
call fcn.100612a0
add esp, 8
test eax, eax
jne 0x100752f3
push edi
mov byte [edi], 0
call fcn.100746d0
add esp, 4
cmp byte [edi], 0
je 0x10075351
call fcn.100610e0
cmp eax, 1
jne 0x100752f3
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov ecx, edi
call fcn.10059a70
cmp byte [edi], 0
je 0x10075351
cmp dword [esp + 0x124], 0
jne 0x10075321
mov esi, edi
call fcn.10065240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10127db1
add esp, 0x114
ret
push 0
push edi
call fcn.100612a0
add esp, 8
test eax, eax
jne 0x1007534a
mov byte [edi], al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10127db1
add esp, 0x114
ret
mov ecx, edi
call fcn.10065200
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x114
ret
Function at 0x1007a4e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10184f28
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x224], eax
je 0x1007a556
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
sub ecx, dword [edi + 0x224]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, 0x384
jbe 0x1007a62e
call esi
mov dword [edi + 0x224], eax
mov dword [ebp - 0x1c], 1
lea esi, [edi + 0x218]
lea ebx, [edi + 0x21c]
push ebx
mov ecx, edi
call fcn.1006ac60
add esp, 4
test eax, eax
jne 0x1007a62e
mov eax, dword [esi]
test eax, eax
je 0x1007a62e
cmp dword [edi + 0x20c], eax
jne 0x1007a5bd
mov edx, dword [edi + 0x220]
cmp edx, dword [edi + 0x214]
jne 0x1007a5bd
mov ecx, dword [ebx]
cmp ecx, dword [edi + 0x210]
jne 0x1007a5bd
cmp dword [edi + 0x224], 0
jne 0x1007a62e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x224], eax
jmp 0x1007a62e
mov dword [edi + 0x20c], eax
mov edx, dword [ebx]
mov dword [edi + 0x210], edx
mov eax, dword [ebx + 4]
mov dword [edi + 0x214], eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x224], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [edi + 0x208]
push edx
mov ecx, esi
mov edx, edi
call fcn.1007a6d0
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ad50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x120]
push esi
push edi
push 0xff
mov edi, ecx
lea ecx, [esp + 0x19]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov esi, edx
mov byte [esp + 0x20], 0
call fcn.1012e060
add esp, 0xc
test ebx, ebx
je 0x1007ad9d
mov byte [ebx], 0
test edi, edi
jne 0x1007ada9
movzx edi, word [esp + 0x120]
test ebp, ebp
jne 0x1007adb5
movzx ebp, word [esp + 0x124]
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1007ae05
test ebx, ebx
je 0x1007adeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100
mov edi, eax
lea esi, [esp + 0x18]
call fcn.100652a0
add esp, 4
mov edx, esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10127db1
add esp, 0x10c
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1007ae52
test ebx, ebx
je 0x1007ae38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100
mov edi, eax
lea esi, [esp + 0x18]
call fcn.100652a0
add esp, 4
mov eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10127db1
add esp, 0x10c
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x1007aea0
test ebx, ebx
je 0x1007ae86
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100
mov edi, eax
lea esi, [esp + 0x18]
call fcn.100652a0
add esp, 4
mov ecx, esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10127db1
add esp, 0x10c
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1007aed0
push 0
lea edx, [esp + 0x10]
push edx
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1007ae11
cmp dword [esp + 0xc], esi
jne 0x1007ae5f
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10127db1
add esp, 0x10c
ret
Function at 0x1007bff0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xa8
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push eax
push str.AppDoNotSetForeground
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.WS2_32.dll_bind
mov dword [esp + 0x14], 0
call fcn.10059e30
test al, al
jne 0x1007c044
mov eax, dword [esp + 0xc]
mov esi, str.AppDoNotSetForeground
mov ebx, str.SoftwareMicroWorld
mov ecx, reloc.WS2_32.dll_bind
call fcn.10059bf0
cmp dword [esp + 0xc], 1
jne 0x1007c065
mov al, 1
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.10127db1
add esp, 0xa8
ret
mov esi, edi
call fcn.1007bf00
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
cmp eax, edi
je 0x1007c04b
push 0x90
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.1012e060
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x24]
cmp eax, 2
jne 0x1007c0d9
cmp dword [esp + 0x18], 4
ja 0x1007c0f0
mov esi, edi
call fcn.1007bf00
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esp + 0xb0]
pop esi
cmp eax, edi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0xa8
ret
cmp eax, 1
jne 0x1007c0af
mov eax, dword [esp + 0x18]
cmp eax, 4
ja 0x1007c0f0
jne 0x1007c0af
cmp dword [esp + 0x1c], 0
jbe 0x1007c0af
push 0
call esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call esi
push 0
push edi
mov ebx, eax
call esi
push 1
mov ebp, eax
push ebx
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x1007c134
mov esi, edi
call fcn.1007bf00
push 0
push ebx
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
sete al
test al, al
jne 0x1007c0b6
call fcn.1007bf90
mov esi, eax
cmp esi, 1
je 0x1007c0b6
call fcn.1006bad0
test eax, eax
je 0x1007c156
cmp esi, 1
jbe 0x1007c0b6
call fcn.1007bf60
xor ecx, ecx
call fcn.1007aaf0
test eax, eax
jne 0x1007c0b6
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x2000
call ebx
push 3
push 0
push 0
push 0x2001
call ebx
mov esi, edi
call fcn.1007bf00
mov ecx, dword [esp + 0x10]
push 3
push ecx
push 0
push 0x2001
call ebx
jmp 0x1007c0b6
Function at 0x1007c1f0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, 0x103
push edi
mov dword [esp + 8], ebx
test esi, esi
je 0x1007c236
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 8]
push eax
push esi
call edi
cmp dword [esp + 8], ebx
je 0x1007c236
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], ebx
call edi
xor eax, eax
cmp dword [esp + 8], ebx
pop edi
setne al
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x7d0
jae 0x1007c29a
jmp 0x1007c260
mov dword [esp + 0xc], 0x103
test esi, esi
je 0x1007c282
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0xc], 0x103
jne 0x1007c2a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebp
call edi
sub eax, ebx
cmp eax, 0x7d0
jb 0x1007c260
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
pop edi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x1007c2c0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
push esi
push edi
push 0x100401
call fcn.1007c830
mov esi, eax
add esp, 8
mov dword [esp + 4], esi
test esi, esi
jne 0x1007c2df
pop esi
pop ecx
ret 4
push edi
push 0x1007c1b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1007c31f
call fcn.1007c510
call fcn.1007c1f0
mov esi, eax
neg esi
lea ecx, [esp + 4]
sbb esi, esi
push ecx
and esi, 2
call fcn.10082e10
mov eax, esi
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
mov esi, 1
call fcn.10082e10
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x1007c830
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 4
jbe 0x1007c958
cmp eax, 0xffffffff
je 0x1007c958
push eax
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1007c9f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 5
jne 0x1007c9c6
push 0x90
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.1012e060
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 2
cmp dword [esp + 0x48], esi
je 0x1007c8c7
push ebx
jmp 0x1007c952
lea eax, [esp + 0xc]
push eax
push 0
push 0x28
mov dword [esp + 0x20], 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1007c901
lea ecx, [esp + 0xc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1007c958
lea edx, [esp + 0x1c]
push edx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push eax
call ebx
test eax, eax
jne 0x1007c96f
call edi
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
call fcn.10082e10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
call edi
cmp eax, 0x514
jne 0x1007c983
call edi
lea edx, [esp + 0xc]
mov esi, eax
push edx
jmp 0x1007c94c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call edi
push 0
push 0
push 0x10
lea edx, [esp + 0x34]
push edx
mov edi, eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
call fcn.10082e10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1007c9f0
mov ebx, dword [esp + 0x10]
call fcn.1006bbf0
test eax, eax
je 0x1007c9f0
cmp ebx, 5
jne 0x1007c9f0
test dword [ebp + 8], 0xfffdfbef
jne 0x1007c9f0
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov ecx, dword [esp + 0xd4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
Function at 0x1007f9e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1007faee
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.1012e060
add esp, 0xc
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.1012e060
add esp, 0xc
lea edi, [esp + 8]
mov byte [esi], 0
call fcn.1005d0a0
cmp eax, 1
je 0x1007fa56
mov ecx, edi
call fcn.1005d240
cmp byte [esp + 8], 0
je 0x1007fadb
lea ecx, [esp + 8]
call fcn.10065200
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push str._sEUPDATE.INI
push eax
call fcn.10127dc0
add esp, 0xc
push 1
push 0
xor edx, edx
lea ecx, [esp + 0x118]
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x1007fadb
lea ecx, [esp + 0x110]
push ecx
push 0x104
push esi
push 0x1014d5e3
push str.LogFilePath
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
je 0x1007fae0
call fcn.10065240
push 0
push esi
call fcn.100612a0
add esp, 8
cmp eax, 1
je 0x1007fadb
mov byte [esi], 0
jmp 0x1007fae0
cmp byte [esi], 0
jne 0x1007faee
push 0x104
push esi
call fcn.1005f830
add esp, 8
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret

Function at 0x1007fb10
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
push esi
xor esi, esi
test ebx, ebx
je 0x1007fbad
test edi, edi
je 0x1007fbad
mov eax, dword [esp + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x1007fbb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1007fbb5
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 1
jne 0x1007fb60
mov ecx, dword [esp + 0xc]
push ecx
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x1007fbb5
push esi
push esi
xor edx, edx
mov ecx, ebx
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x1007fba0
push eax
push eax
xor edx, edx
mov ecx, edi
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x1007fba0
mov eax, edi
call fcn.1005ad10
cmp eax, 1
jne 0x1007fba0
mov edx, dword [esp + 0xc]
push edx
push edi
push ebx
call ebp
pop esi
pop ebp
ret
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1007fbc0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
test edi, edi
jne 0x1007fbd1
xor eax, eax
pop ebx
pop ecx
ret
push esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetControlSession_Manager
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
pop esi
jne 0x1007fbcc
mov eax, dword [esp + 4]
test eax, eax
je 0x1007fc30
mov ecx, dword [esp + 0xc]
push ecx
push edi
push 7
push 0
push str.PendingFileRenameOperations
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1007fc21
lea ebx, [eax + 1]
mov eax, dword [esp + 4]
test eax, eax
je 0x1007fc30
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x1007fc40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
lea eax, [esp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push str.SystemCurrentControlSetControlSession_Manager
push reloc.WS2_32.dll_bind
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x1007fc84
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0x105
call fcn.1006a7b0
mov esi, eax
add esp, 4
test esi, esi
je 0x1007fcf9
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0
push 0
push str.PendingFileRenameOperations
push edx
call edi
cmp eax, 0xea
jne 0x1007fcea
push esi
call fcn.10128243
mov eax, dword [esp + 0x10]
push eax
call fcn.1006a7b0
mov esi, eax
add esp, 8
test esi, esi
je 0x1007fcf8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0
push 0
push str.PendingFileRenameOperations
push edx
call edi
test eax, eax
jne 0x1007fcf8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0xc]
mov dword [eax], esi
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1007fd08
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x100801f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.1012e060
add esp, 0xc
push 0
push 0
call fcn.10083610
mov esi, eax
test esi, esi
jne 0x10080243
push edi
lea ecx, [esp + 0xc]
push 0x1014d8cc
push ecx
call fcn.10127dc0
add esp, 0xc
jmp 0x10080257
push esi
push edi
lea edx, [esp + 0x10]
push str._s_d
push edx
call fcn.10127dc0
add esp, 0x10
lea ecx, [esp + 8]
call fcn.1007ea80
mov ebx, eax
test ebx, ebx
je 0x1008026b
cmp ebx, 0xffffffff
jne 0x100802ad
test esi, esi
jbe 0x100802ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100802ad
push edi
lea eax, [esp + 0xc]
push 0x1014d8cc
push eax
call fcn.10127dc0
add esp, 0xc
lea ecx, [esp + 8]
call fcn.1007ea80
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10127db1
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x108
ret

Function at 0x100802d0
Capabilities:
Check os version

Disassembly:
sub esp, 8
push esi
push edi
mov edi, str.commstrt_mutex
xor esi, esi
call fcn.100801f0
mov dword [esp + 0xc], eax
test eax, eax
je 0x10080300
lea eax, [esp + 0xc]
push eax
mov esi, 1
call fcn.10082e10
pop edi
mov eax, esi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10080353
lea edi, [eax - 4]
cmp dword [0x101c8674], esi
jne 0x10080332
mov dword [0x101c8674], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10080332
cmp al, 6
jb 0x10080332
mov dword [0x101c8678], edi
jmp 0x1008033a
cmp dword [0x101c8678], esi
je 0x10080353
push ebx
lea ebx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.10066e50
cmp byte [esp + 0xf], 3
pop ebx
mov eax, edi
jne 0x10080355
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x10080360
Capabilities:
Check os version

Disassembly:
sub esp, 8
push esi
push edi
mov edi, str.IntAvailMutex
xor esi, esi
call fcn.100801f0
mov dword [esp + 0xc], eax
test eax, eax
je 0x10080390
lea eax, [esp + 0xc]
push eax
mov esi, 1
call fcn.10082e10
pop edi
mov eax, esi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100803e3
lea edi, [eax - 4]
cmp dword [0x101c8674], esi
jne 0x100803c2
mov dword [0x101c8674], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100803c2
cmp al, 6
jb 0x100803c2
mov dword [0x101c8678], edi
jmp 0x100803ca
cmp dword [0x101c8678], esi
je 0x100803e3
push ebx
lea ebx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.10066e50
cmp byte [esp + 0xf], 3
pop ebx
mov eax, edi
jne 0x100803e5
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x10080ca0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x10
push esi
mov esi, eax
push esi
call fcn.10080a40
add esp, 4
test eax, eax
je 0x10080d11
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
test esi, esi
je 0x10080d11
mov ecx, dword [esp + 0x1c]
add ecx, 0x20000000
cmp edi, 3
jne 0x10080ce6
lea eax, [edi - 2]
jmp 0x10080cf2
xor eax, eax
cmp edi, 2
setne al
lea eax, [eax + eax + 2]
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x10
ret