joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004370
Capabilities:
Receive data
Receive data on socket
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov eax, 0x1004
call fcn.1001b7c0
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp dword [esi], 0xffffffff
mov eax, dword [esp + 0x1008]
je 0x1000440a
lea ecx, [esi + 4]
push ecx
push eax
push str.GET__s_HTTP_1.1_r_nAccept:_text_html__application_xhtmlxml____r_nAccept_Language:_zh_CN_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko_r_nHost:__s_r_n_r_n
lea edx, [esp + 0xc]
push 0x800
push edx
call fcn.10004630
lea eax, [esp + 0x14]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100043b7
mov ecx, dword [esi]
push 0
sub eax, edx
push eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1000440a
mov eax, dword [esi]
push 0
push 0x800
lea edx, [esp + 0x808]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.10019069
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
xor eax, eax
call fcn.10019069
add esp, 0x1004
ret 4

Function at 0x10004480
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, str.s.360.cn
push esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004497
sub eax, edx
cmp eax, 0x100
ja 0x100044e2
lea ecx, [edi + 4]
mov eax, str.s.360.cn
mov edx, pe_nt_image_headers32
call fcn.10004760
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x100044e2
push str.s.360.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x100044f4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10019069
add esp, 0x18
ret
mov ecx, 2
mov word [esp + 4], cx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push 0x50
mov dword [esp + 0xc], ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 8]
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100044db
mov ecx, dword [esp + 0x14]
mov dword [edi], esi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10019069
add esp, 0x18
ret
Function at 0x100047e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, byte [eax + esi]
xor cl, byte [0x100365c4]
inc eax
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365c5]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365c6]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365c7]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365c8]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365c9]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365ca]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365cb]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365cc]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
xor cl, byte [0x100365cd]
xor cl, dl
xor cl, 0xd8
mov byte [eax + esi - 1], cl
cmp eax, 0x14
jb 0x100047e2
ret
Function at 0x10004a10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xe3c
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0xe38], eax
push ebx
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.1001a970
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xa46]
push eax
mov word [esp + 0xa48], dx
call fcn.1001a970
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x642]
push edx
mov word [esp + 0x644], cx
call fcn.1001a970
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.1001a970
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xc72]
push eax
mov word [esp + 0xc74], dx
call fcn.1001a970
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x45e]
push edx
mov word [esp + 0x460], cx
call fcn.1001a970
add esp, 0x48
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x832]
push ecx
mov word [esp + 0x834], ax
call fcn.1001a970
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push edi
lea edx, [esp + 0x220]
push 0x1003018c
push edx
call ebx
push edi
lea eax, [esp + 0xa4c]
push str.cid__d_delayday
push eax
call ebx
push edi
lea ecx, [esp + 0x648]
push str.cid__d_skinid
push ecx
call ebx
push edi
lea edx, [esp + 0x3c]
push str.cid__d_per
push edx
call ebx
push edi
lea eax, [esp + 0xc78]
push str.cid__d_homepage
push eax
call ebx
add esp, 0x48
push edi
lea ecx, [esp + 0x41c]
push str.cid__d_timeout
push ecx
call ebx
push edi
lea edx, [esp + 0x838]
push str.cid__d_updatefile
push edx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x18
push esi
push 0
lea eax, [esp + 0x218]
push eax
push str.param_conf
call edi
push esi
push 0
lea ecx, [esp + 0xa38]
push ecx
push str.param_conf
mov dword [0x100396c8], eax
call edi
push esi
push 0
lea edx, [esp + 0x628]
push edx
push str.param_conf
mov dword [0x100396cc], eax
call edi
push esi
mov dword [0x100396d0], eax
push 1
lea eax, [esp + 0x10]
push eax
push str.param_conf
call edi
push esi
push 0
lea ecx, [esp + 0x420]
push ecx
push str.param_conf
mov dword [0x100396d4], eax
call edi
push esi
push 0
lea edx, [esp + 0x830]
push edx
push str.param_conf
mov dword [0x100396d8], eax
call edi
push esi
push 0x103
push 0x100396e0
mov dword [0x100396dc], eax
push 0x100304f4
lea eax, [esp + 0xc48]
push eax
push str.param_conf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x12c
pop edi
pop ebx
cmp dword [0x100396cc], eax
jbe 0x10004c2d
mov dword [0x100396cc], eax
mov eax, 0xe10
cmp dword [0x100396c8], eax
jbe 0x10004c3f
mov dword [0x100396c8], eax
mov eax, dword [0x100396d4]
cmp eax, 0x7fff
jbe 0x10004c57
mov dword [0x100396d4], 0x7fff
jmp 0x10004c65
test eax, eax
jne 0x10004c65
mov dword [0x100396d4], 1
mov eax, dword [0x100396d8]
test eax, eax
je 0x10004c73
cmp eax, 0x78
jbe 0x10004c7d
mov dword [0x100396d8], 0x78
mov ecx, dword [esp + 0xe38]
xor ecx, esp
mov eax, 1
call fcn.10019069
add esp, 0xe3c
ret
Function at 0x10004fc0
Capabilities:
Check if file exists
Read .ini file
Read file on windows

Disassembly:
sub esp, 0x22c
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005000
pop edi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.10019069
add esp, 0x22c
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push ebx
push 0x100302e0
push 0x100302e8
mov dword [esp + 0x20], ebx
call esi
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x100051ee
push edi
push ebx
push 0x10030280
push str.ver_conf
call esi
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x100051ee
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10005044
push ebp
push ebx
push ebx
push ebx
push ebx
sub eax, edx
sar eax, 1
push eax
push edi
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call ebx
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.100171e4
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x100051ed
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005081
push 0
push 0
push esi
push ebp
sub eax, edx
sar eax, 1
push eax
push edi
push 0
push 0
call ebx
push 0x1ff
lea ecx, [esp + 0x3d]
push 0
mov byte [esi + ebp], 0
push ecx
mov byte [esp + 0x44], 0
call fcn.1001a970
add esp, 0xc
push ebp
push 0x1ff
lea edx, [esp + 0x40]
push edx
push 0x100303b3
push str.verify
push str.verify_conf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100050e2
sub eax, edx
je 0x100051d3
push 0x10030314
push edi
call fcn.1001a1ce
mov edi, eax
add esp, 8
test edi, edi
je 0x100051d3
mov ebx, dword [esp + 0x10]
lea esi, [ebx + 1]
push esi
call fcn.100171e4
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x100051ca
push esi
push 0
push eax
call fcn.1001a970
push 0
push 0
push edi
call fcn.1001a26f
mov esi, dword [esp + 0x2c]
push edi
push ebx
push 1
push esi
call fcn.1001a594
xor eax, eax
push ebx
lea edx, [esp + 0x50]
mov ecx, esi
mov byte [esp + 0x50], 0
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov dword [esp + 0x59], eax
mov dword [esp + 0x5d], eax
mov word [esp + 0x61], ax
mov byte [esp + 0x63], al
call fcn.100080f0
mov dl, bl
xor dl, byte [esp + 0x48]
lea esi, [esp + 0x50]
call fcn.100047e0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x68]
mov dword [esp + 0x40], 0
call section..text
add esp, 0x30
test eax, eax
je 0x100051ca
mov edx, 0x14
cmp dword [esp + 0x10], edx
jne 0x100051ca
mov ecx, esi
sub eax, esi
lea ecx, [ecx]
mov esi, dword [eax + ecx]
cmp esi, dword [ecx]
jne 0x100051ca
sub edx, 4
add ecx, 4
cmp edx, 4
jae 0x100051b0
mov dword [esp + 0x18], 1
push edi
call fcn.1001a628
add esp, 4
push ebp
call fcn.100192ae
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x100051ed
push eax
call fcn.100192ae
add esp, 4
pop ebp
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.10019069
add esp, 0x22c
ret
Function at 0x10005210
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.1001a970
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.KitTipConf.ini
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp]
push ecx
push str.http:__dl.360safe.com_gf_KitTip_KitTipConf.cab
call fcn.10009c60
add esp, 8
test eax, eax
je 0x100052d5
lea ecx, [esp]
call fcn.10004fc0
push esi
test eax, eax
je 0x100052cc
lea edx, [esp + 4]
push edx
call fcn.10004ca0
add esp, 8
xor ecx, ecx
push esi
push ecx
test eax, eax
je 0x100052c5
push 0xcd
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
add esp, 0x14
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10019069
add esp, 0x20c
ret
push 0xd0
jmp 0x100052df
push 0
push 0xcf
jmp 0x100052dd
push esi
push 0
push 0xce
xor ecx, ecx
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
mov ecx, dword [esp + 0x21c]
add esp, 0x14
xor ecx, esp
xor eax, eax
call fcn.10019069
add esp, 0x20c
ret
Function at 0x10005af0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 8]
push eax
push str.SOFTWAREKitTipCLSID
push closesocket
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10005b5a
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dx, word [esp + 0x12]
mov ax, word [esp + 0xe]
push 4
lea ecx, [esp + 8]
push ecx
push 4
push esi
mov word [esp + 0x14], dx
mov edx, dword [esp + 0x18]
push str.tipflag
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10005b4f
lea esi, [eax + 1]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x10005b70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREKitTipCLSID
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [esp]
jne 0x10005c12
test eax, eax
je 0x10005c12
mov ecx, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x18]
push ecx
push 0
push str.tipflag
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov cx, word [esp + 0x1a]
mov dx, word [esp + 0x16]
mov eax, dword [esp + 4]
mov word [esp + 8], cx
mov word [esp + 0xa], dx
cmp eax, dword [esp + 8]
je 0x10005c0c
call fcn.10005af0
mov eax, 1
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10005af0
neg eax
sbb eax, eax
neg eax
add esp, 0x24
ret

Function at 0x10005c30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x32]
push ecx
xor esi, esi
mov word [esp + 0x34], ax
call fcn.1001a970
mov edx, dword [esp + 0x80]
push edx
lea eax, [esp + 0x38]
push str.cid__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push str.SOFTWAREKitTipCLSID
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10005ce0
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 8
lea ecx, [esp + 0xc]
push ecx
push 0xb
mov dword [esp + 0x18], edx
push esi
lea edx, [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10005cd5
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10019069
add esp, 0x6c
ret
Function at 0x10005d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x74], eax
cmp dword [0x10038a94], 0
push esi
push edi
jne 0x10005d34
cmp dword [0x100396cc], 0
jne 0x10005d4a
mov eax, dword [ebp + 8]
push eax
call fcn.10005c30
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10019069
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push str.SOFTWAREKitTipCLSID
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x10005e6f
test eax, eax
je 0x10005e6f
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x42]
push eax
mov word [esp + 0x44], dx
call fcn.1001a970
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
lea ecx, [esp + 0x3c]
push str.cid__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [esp + 0x48]
push edx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xb
mov dword [esp + 0x34], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
or edx, dword [esp + 0x14]
jne 0x10005e01
push esi
jmp 0x10005e7a
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [0x100396cc]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
push 0xc9
push 0x2a69c000
push 0
push eax
call fcn.10029d70
sub esi, dword [esp + 0x10]
sbb edi, dword [esp + 0x14]
cmp edi, edx
jb 0x10005e82
ja 0x10005e4d
cmp esi, eax
jbe 0x10005e82
mov ecx, dword [ebp + 8]
push ecx
call fcn.10005c30
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10019069
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call fcn.10005c30
add esp, 4
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10019069
mov esp, ebp
pop ebp
ret
Function at 0x10005ea0
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x10038a98
call esi
test eax, eax
je 0x10005f7a
push 0x10039920
call esi
test eax, eax
je 0x10005f7a
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.1001a970
push 0x10038a98
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.1001a6a4
push str..old
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.1001a6a4
add esp, 0x24
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea edx, [esp + 8]
push edx
push 0x10038a98
call edi
test eax, eax
je 0x10005f63
push 1
push 0x10038a98
push 0x10039920
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
jne 0x10005f63
push 0x10038a98
lea eax, [esp + 0xc]
push eax
call edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10019069
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10019069
add esp, 0x20c
ret

Function at 0x10006020
Capabilities:
Create thread

Disassembly:
cmp dword [0x1003898c], 0x2dcf5a
jbe 0x1000607c
cmp dword [0x100396dc], 0
je 0x10006051
push 0
push 0
push 0
push 0x10005fa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1000a050
test eax, eax
je 0x10006070
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push ecx
call eax
cmp eax, 0xffffffff
jne 0x10006076
mov eax, 2
ret
mov eax, 3
ret
mov eax, 1
ret
Function at 0x10006280
Capabilities:
Create thread

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push esi
xor ebp, ebp
push ebp
push 0xc9
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
call fcn.100068a0
test eax, eax
je 0x100062ce
push esi
push ebp
push 0xf0
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret 0xc
call fcn.10005210
test eax, eax
jne 0x100062f9
push esi
push ebp
push 0xf3
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
push edi
push ebx
push esi
call fcn.10006020
add esp, 0xc
push esi
cmp eax, 2
jne 0x10006337
push ebp
push 0xf1
xor ecx, ecx
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
add esp, 0x14
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0xc
cmp eax, 3
jne 0x10006344
push ebp
push 0xf2
jmp 0x1000631a
call fcn.10005d00
add esp, 4
push esi
xor ecx, ecx
push ebp
test eax, eax
jne 0x1000635b
push 0xf5
jmp 0x1000631c
push 0xca
push 0x2dcf5a
push str.v_ds_dr_dd_d
mov dword [0x100398e8], ebx
mov dword [0x100398ec], edi
call fcn.10004540
add esp, 0x14
push ebp
push ebp
push esi
push 0x10006090
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push esi
xor ecx, ecx
push ebp
cmp edi, ebp
je 0x100063f2
push 0xcb
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
add esp, 0x14
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push ebp
push 0xcc
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov dword [0x100398e8], ebp
mov dword [0x100398ec], ebp
mov eax, 1
pop ebp
ret 0xc
push 0xf6
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
add esp, 0x14
pop edi
pop ebx
pop esi
mov dword [0x100398e8], ebp
mov dword [0x100398ec], ebp
xor eax, eax
pop ebp
ret 0xc
Function at 0x10006420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp dword [0x10039c7c], 0
jne 0x100064e7
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x1002f540
push closesocket
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100064e1
mov eax, dword [esp]
test eax, eax
je 0x100064e1
lea ecx, [esp + 4]
push ecx
push 0x10039c80
lea edx, [esp + 0x10]
push edx
push 0
push str.path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100064c4
mov eax, 0x10039c80
mov edx, esi
mov dword [0x10039c7c], 1
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100064a2
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10039c7c]
add esp, 0xc
ret
mov eax, dword [esp]
push eax
mov dword [0x10039c7c], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10039c7c]
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
mov eax, 0x10039c80
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100064f0
mov eax, dword [0x10039c7c]
add esp, 0xc
ret

Function at 0x10006510
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.1001a970
add esp, 0xc
lea esi, [esp + 8]
call fcn.10006420
test eax, eax
je 0x100065ab
push str.hipsver.dll
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100065ab
push ebx
lea esi, [esp + 8]
lea ebx, [esp + 0xc]
mov dword [esp + 8], 0xffffffff
call fcn.10006910
pop ebx
test eax, eax
je 0x100065ab
xor eax, eax
cmp dword [esp + 4], 4
sete al
test eax, eax
je 0x100065ab
mov eax, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10019069
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10019069
add esp, 0x210
ret