joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005bf90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016e1f8
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
cmp edi, esi
je 0x1005c0f5
cmp byte [edi], 0
je 0x1005c0f5
mov dword [ebp - 4], esi
push 0x80
push 3
push 1
push closesocket
call fcn.10033690
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x1005c0d9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x1005c064
lea edi, [esi + 0x401]
push edi
call fcn.1010dced
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x1005c059
push edi
push 0
push eax
call fcn.10116880
add esp, 0xc
lea ecx, [ebp - 0x20]
mov edx, esi
mov esi, dword [ebx]
mov edi, dword [ebp - 0x1c]
call fcn.10032840
test eax, eax
jne 0x1005c064
mov eax, dword [ebx]
push eax
call fcn.1010dc10
add esp, 4
mov dword [ebx], 0
jmp 0x1005c064
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1005c095
lea ecx, [ebp - 0x1c]
push ecx
call fcn.100673f0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c]
push edx
call fcn.100673f0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005c340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016eef8
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x224], eax
je 0x1005c3b6
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
sub ecx, dword [edi + 0x224]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, 0x384
jbe 0x1005c48e
call esi
mov dword [edi + 0x224], eax
mov dword [ebp - 0x1c], 1
lea esi, [edi + 0x218]
lea ebx, [edi + 0x21c]
push ebx
mov ecx, edi
call fcn.1004edb0
add esp, 4
test eax, eax
jne 0x1005c48e
mov eax, dword [esi]
test eax, eax
je 0x1005c48e
cmp dword [edi + 0x20c], eax
jne 0x1005c41d
mov edx, dword [edi + 0x220]
cmp edx, dword [edi + 0x214]
jne 0x1005c41d
mov ecx, dword [ebx]
cmp ecx, dword [edi + 0x210]
jne 0x1005c41d
cmp dword [edi + 0x224], 0
jne 0x1005c48e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x224], eax
jmp 0x1005c48e
mov dword [edi + 0x20c], eax
mov edx, dword [ebx]
mov dword [edi + 0x210], edx
mov eax, dword [ebx + 4]
mov dword [edi + 0x214], eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x224], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [edi + 0x208]
push edx
mov ecx, esi
mov edx, edi
call fcn.1005c530
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d900
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
push esi
push edi
push 0x207
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.10116880
push str.avdisk
lea ecx, [esp + 0x28]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.1010d6a8
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x18
lea edx, [esp + 0xc]
push edx
push 1
push 0
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebp
test esi, esi
je 0x1005d988
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1010d699
add esp, 0x218
ret
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Description
push ecx
mov byte [esp + 0x30], 0
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005d9f4
mov eax, str.eScan_Device_Control_Filter_Driver
lea ecx, [esp + 0x18]
call fcn.10031890
test eax, eax
jne 0x1005d9f4
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1010d699
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
push str.avdisk
lea ecx, [esp + 0x20]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x28]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, eax
push esi
call ebp
test esi, esi
jne 0x1005da76
push str.eScan_Device_Control_Filter_Driver
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
inc eax
push eax
push str.eScan_Device_Control_Filter_Driver
push 1
push esi
push str.Description
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1005da6f
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esi + 1]
jmp 0x1005da78
mov eax, dword [esp + 0x10]
push eax
call ebx
xor eax, eax
mov ecx, dword [esp + 0x224]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1010d699
add esp, 0x218
ret
Function at 0x1005ed50
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xa0
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, ecx
push str.AppDoNotSetForeground
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call fcn.10031670
test al, al
jne 0x1005eda1
mov eax, dword [esp + 0xc]
mov edi, str.AppDoNotSetForeground
mov ebx, str.SoftwareMicroWorld
call fcn.10031430
cmp dword [esp + 0xc], 1
jne 0x1005edc2
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.1010d699
add esp, 0xa0
ret
call fcn.1005ec70
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, esi
je 0x1005eda8
push ebp
push 0x90
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.10116880
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x28]
cmp eax, 2
jne 0x1005ee34
cmp dword [esp + 0x1c], 4
ja 0x1005ee4b
call fcn.1005ec70
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esp + 0xac]
pop ebp
cmp eax, esi
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0xa0
ret
cmp eax, 1
jne 0x1005ee0b
mov eax, dword [esp + 0x1c]
cmp eax, 4
ja 0x1005ee4b
jne 0x1005ee0b
cmp dword [esp + 0x20], 0
jbe 0x1005ee0b
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebx
push 0
push esi
mov edi, eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebx, eax
push edi
push ebx
call ebp
test eax, eax
je 0x1005ee8b
call fcn.1005ec70
push 0
push edi
push ebx
call ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
sete al
test al, al
jne 0x1005ee10
call fcn.1005ed00
mov edi, eax
cmp edi, 1
je 0x1005ee10
call fcn.1004fd70
test eax, eax
je 0x1005eead
cmp edi, 1
jbe 0x1005ee10
call fcn.1005ecd0
push 0
call sym.EncDec.dll_IsSystemUser
test eax, eax
jne 0x1005ee10
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x2000
call edi
push 3
push 0
push 0
push 0x2001
call edi
call fcn.1005ec70
mov ecx, dword [esp + 0x14]
push 3
push ecx
push 0
push 0x2001
call edi
jmp 0x1005ee10
Function at 0x1005f000
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, 0x103
push edi
mov dword [esp + 8], ebx
test esi, esi
je 0x1005f046
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 8]
push eax
push esi
call edi
cmp dword [esp + 8], ebx
je 0x1005f046
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], ebx
call edi
xor eax, eax
cmp dword [esp + 8], ebx
pop edi
setne al
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x7d0
jae 0x1005f0aa
jmp 0x1005f070
mov dword [esp + 0xc], 0x103
test esi, esi
je 0x1005f092
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0xc], 0x103
jne 0x1005f0b1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebp
call edi
sub eax, ebx
cmp eax, 0x7d0
jb 0x1005f070
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
pop edi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x1005f0d0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
push 0x100401
call fcn.1005f650
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
jne 0x1005f0f5
pop edi
pop esi
pop ecx
ret 8
push edi
push 0x1005efc0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1005f136
call fcn.1005f320
call fcn.1005f000
mov esi, eax
neg esi
lea ecx, [esp + 0x10]
sbb esi, esi
push ecx
and esi, 2
call fcn.100673f0
mov eax, esi
pop edi
pop esi
pop ecx
ret 8
lea ecx, [esp + 0x10]
push ecx
mov esi, 1
call fcn.100673f0
pop edi
mov eax, esi
pop esi
pop ecx
ret 8
Function at 0x1005f650
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 4
jbe 0x1005f778
cmp eax, 0xffffffff
je 0x1005f778
push eax
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1005f810
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 5
jne 0x1005f7e6
push 0x90
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.10116880
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 2
cmp dword [esp + 0x48], esi
je 0x1005f6e7
push ebx
jmp 0x1005f772
lea eax, [esp + 0xc]
push eax
push 0
push 0x28
mov dword [esp + 0x20], 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1005f721
lea ecx, [esp + 0xc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1005f778
lea edx, [esp + 0x1c]
push edx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push eax
call ebx
test eax, eax
jne 0x1005f78f
call edi
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
call fcn.100673f0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
call edi
cmp eax, 0x514
jne 0x1005f7a3
call edi
lea edx, [esp + 0xc]
mov esi, eax
push edx
jmp 0x1005f76c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call edi
push 0
push 0
push 0x10
lea edx, [esp + 0x34]
push edx
mov edi, eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
call fcn.100673f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1005f810
mov ebx, dword [esp + 0x10]
call fcn.1004fe90
test eax, eax
je 0x1005f810
cmp ebx, 5
jne 0x1005f810
test dword [ebp + 8], 0xfffdfbef
jne 0x1005f810
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov ecx, dword [esp + 0xd4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
Function at 0x10062330
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
test esi, esi
je 0x10062358
mov byte [esi], 0
mov eax, dword [esp + 0x18]
mov dword [ebp], 0
test eax, eax
je 0x1006236d
mov dword [eax], 0xffffffff
lea eax, [esp + 0x14]
push eax
push 0x101588d0
push 1
push 0
push 0x101588c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x100623ab
test esi, esi
je 0x1006246c
push edi
push str.Unable_To_Create_An_Instance_Of_INetFwMgr._Reason__x
push esi
call fcn.1010d6a8
add esp, 0xc
mov eax, edi
pop edi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
jge 0x100623ed
test esi, esi
je 0x1006246c
push edi
push str.Unable_To_Get_The_Local_Firewall_Policy._Reason__x
push esi
call fcn.1010d6a8
add esp, 0xc
mov eax, edi
pop edi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebp
push eax
call edx
mov edi, eax
test edi, edi
jge 0x1006240c
test esi, esi
je 0x10062460
push edi
push str.Failed_To_Get_The_Current_Firewall_Profile._Reason__x
jmp 0x10062457
mov eax, dword [ebp]
test eax, eax
je 0x10062460
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10062460
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jne 0x1006244d
mov eax, dword [esp + 8]
xor ecx, ecx
cmp word [esp + 0xc], cx
push eax
setne cl
mov dword [ebp], ecx
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov eax, edi
pop edi
pop ebp
add esp, 8
ret
test esi, esi
je 0x10062460
push eax
push str.Unable_to_get_FW_Enabled_Status__Reason__x
push esi
call fcn.1010d6a8
add esp, 0xc
mov eax, dword [esp + 8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, edi
pop edi
pop ebp
add esp, 8
ret
Function at 0x100626e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x110
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x10c], eax
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10116880
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0x100627b0
push 0
push 0
mov dword [0x1017ee14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp], eax
test eax, eax
je 0x10062782
push 0
push 0xaf0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test esi, esi
je 0x1006275f
lea eax, [esp + 8]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10062755
lea edx, [esp]
push edx
call fcn.100673f0
mov eax, dword [0x1017ee14]
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1010d699
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GWF__Error:_CreateThread_FWA__fails_with_error__d
push 0
call fcn.10053700
mov ecx, dword [esp + 0x118]
add esp, 0xc
xor ecx, esp
or eax, 0xffffffff
call fcn.1010d699
add esp, 0x110
ret

Function at 0x10063a70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10063b7e
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.10116880
add esp, 0xc
lea edi, [esp + 8]
mov byte [esi], 0
call fcn.10039e30
cmp eax, 1
je 0x10063ae6
mov ecx, edi
call fcn.10039fe0
cmp byte [esp + 8], 0
je 0x10063b6b
lea ecx, [esp + 8]
call fcn.10049c40
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push str._sEUPDATE.INI
push eax
call fcn.1010d6a8
add esp, 0xc
push 1
push 0
xor edx, edx
lea ecx, [esp + 0x118]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x10063b6b
lea ecx, [esp + 0x110]
push ecx
push 0x104
push esi
push 0x1013f817
push str.LogFilePath
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
je 0x10063b70
call fcn.10049c80
push 0
push esi
call fcn.10044cc0
add esp, 8
cmp eax, 1
je 0x10063b6b
mov byte [esi], 0
jmp 0x10063b70
cmp byte [esi], 0
jne 0x10063b7e
push 0x104
push esi
call fcn.10042f40
add esp, 8
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
Function at 0x10063ba0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
push esi
xor esi, esi
test ebx, ebx
je 0x10063c3d
test edi, edi
je 0x10063c3d
mov eax, dword [esp + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x10063c47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10063c45
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 1
jne 0x10063bf0
mov ecx, dword [esp + 0xc]
push ecx
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x10063c45
push esi
push esi
xor edx, edx
mov ecx, ebx
call fcn.10044660
add esp, 8
test eax, eax
jne 0x10063c30
push eax
push eax
xor edx, edx
mov ecx, edi
call fcn.10044660
add esp, 8
test eax, eax
jne 0x10063c30
mov eax, edi
call fcn.10033960
cmp eax, 1
jne 0x10063c30
mov edx, dword [esp + 0xc]
push edx
push edi
push ebx
call ebp
pop esi
pop ebp
ret
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10063c50
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
test edi, edi
jne 0x10063c61
xor eax, eax
pop ebx
pop ecx
ret
push esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
pop esi
jne 0x10063c5c
mov eax, dword [esp + 4]
test eax, eax
je 0x10063cc0
mov ecx, dword [esp + 0xc]
push ecx
push edi
push 7
push 0
push str.PendingFileRenameOperations
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10063cb1
lea ebx, [eax + 1]
mov eax, dword [esp + 4]
test eax, eax
je 0x10063cc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10063cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
lea eax, [esp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push str.SystemCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10063d14
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0x105
call fcn.1004e860
mov esi, eax
add esp, 4
test esi, esi
je 0x10063d89
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0
push 0
push str.PendingFileRenameOperations
push edx
call edi
cmp eax, 0xea
jne 0x10063d7a
push esi
call fcn.1010dc10
mov eax, dword [esp + 0x10]
push eax
call fcn.1004e860
mov esi, eax
add esp, 8
test esi, esi
je 0x10063d88
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0
push 0
push str.PendingFileRenameOperations
push edx
call edi
test eax, eax
jne 0x10063d88
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0xc]
mov dword [eax], esi
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10063d98
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x100641b0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x314
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x320]
push esi
push edi
push 0x103
lea eax, [esp + 0x221]
push 0
push eax
mov byte [esp + 0x228], 0
call fcn.10116880
push 0x207
lea ecx, [esp + 0x25]
push 0
push ecx
mov byte [esp + 0x2c], 0
call fcn.10116880
add esp, 0x18
test ebx, ebx
je 0x10064212
mov byte [ebx], 0
test ebp, ebp
je 0x10064347
cmp byte [ebp], 0
je 0x10064347
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
lea edx, [esp + 0x18]
push edx
call edi
cmp byte [ebp], 0x22
jne 0x1006425b
lea esi, [ebp + 1]
push 0x22
push esi
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10064271
push esi
lea eax, [esp + 0x18]
push eax
call edi
push 0x22
lea ecx, [esp + 0x18]
push ecx
jmp 0x10064262
push 0x20
lea edx, [esp + 0x18]
push edx
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10064271
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.100454f0
add esp, 4
cmp byte [ebp], 0
je 0x10064347
push 1
push 0
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x10064347
cmp dword [esp + 0x32c], eax
je 0x100642d6
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.10061890
test eax, eax
je 0x100642d6
mov ecx, dword [esp + 0x10]
push ecx
push 0x1005ef00
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, 1
jmp 0x10064374
push 0
call sym.EncDec.dll_IsSystemUser
test eax, eax
jne 0x10064323
push eax
push 0xffffffffffffffff
push eax
push eax
push ebp
push eax
xor edx, edx
xor ecx, ecx
call fcn.10047950
test eax, eax
je 0x100642cc
push 0x104
mov edi, eax
lea esi, [esp + 0x220]
call fcn.10049ce0
add esp, 4
test ebx, ebx
je 0x10064372
mov edx, esi
push edx
push ebp
push str.Unable_to_execute__s__Reason:__s
push ebx
call fcn.1010d6a8
add esp, 0x10
jmp 0x10064372
push ebp
mov esi, ebx
call fcn.10064f80
test eax, eax
jne 0x100642cc
test ebx, ebx
je 0x10064335
mov byte [ebx], al
push 0
mov edx, ebx
mov ecx, ebp
call fcn.10047760
neg eax
sbb eax, eax
inc eax
jmp 0x10064374
test ebx, ebx
je 0x10064372
test ebp, ebp
je 0x10064364
lea eax, [esp + 0x14]
push eax
push str._8_Unable_to_find_file___s___Cannot_Start...
push ebx
call fcn.1010d6a8
add esp, 0xc
jmp 0x10064372
push str._9_Unable_to_find_file__NULL___Cannot_Start...
push ebx
call fcn.1010d6a8
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x314
ret 0xc