joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100837f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x6f004c
mov dword [ebp - 0x34], 0x5c0067
mov dword [ebp - 0x30], 0x6f004c
mov dword [ebp - 0x2c], 0x6b0063
mov dword [ebp - 0x28], 0x630053
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x6e0065
mov dword [ebp - 0x1c], 0x6c002e
mov dword [ebp - 0x18], 0x67006f
mov word [ebp - 0x14], ax
call fcn.10031f30
mov ecx, eax
test ecx, ecx
je 0x1003f9aa
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x1003f968
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x1003f98b
lea ecx, [ebp - 0x38]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003f970
sub ecx, edx
lea eax, [ebp - 0x38]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3

Function at 0x1003f9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083828
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x6f004c
mov dword [ebp - 0x38], 0x5c0067
mov dword [ebp - 0x34], 0x6f004c
mov dword [ebp - 0x30], 0x6b0063
mov dword [ebp - 0x2c], 0x630053
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x6e0065
mov dword [ebp - 0x20], 0x6c002e
mov dword [ebp - 0x1c], 0x67006f
mov dword [ebp - 0x18], 0x6f002e
mov dword [ebp - 0x14], 0x6e
call fcn.10031f30
mov ecx, eax
test ecx, ecx
je 0x1003fab2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x1003fa71
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x1003fa92
lea ecx, [ebp - 0x3c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fa77
sub ecx, edx
lea eax, [ebp - 0x3c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3
Function at 0x10040200
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
lea esi, [ecx + 0x2c]
mov ecx, dword [eax]
mov eax, dword [esi]
push edi
lea edx, [ecx - 0x10]
lea edi, [eax - 0x10]
cmp edx, edi
je 0x10040264
cmp dword [edi + 0xc], 0
push ebx
lea ebx, [edi + 0xc]
jl 0x10040256
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10040256
push edx
call fcn.1000cfc0
add esp, 4
mov dword [ebp + 8], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1004024f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
jmp 0x10040263
push dword [ecx - 0xc]
push ecx
mov ecx, esi
call fcn.10007190
mov eax, dword [esi]
pop ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100402ca
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp dword [eax - 0xc], 0
je 0x100402ca
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100402b1
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jl 0x100402ca
jg 0x100402c2
cmp dword [ebp - 8], 0x40000000
jbe 0x100402ca
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10041b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081638
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x570030
mov dword [ebp - 0x24], 0x460050
mov dword [ebp - 0x20], 0x760061
mov dword [ebp - 0x1c], 0x6a002e
mov dword [ebp - 0x18], 0x6f0073
mov dword [ebp - 0x14], 0x6e
call fcn.10006f60
mov ecx, eax
test ecx, ecx
je 0x10041c09
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10041bc3
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x10041beb
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041bd0
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3
Function at 0x10041c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081508
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x33005c
mov dword [ebp - 0x30], 0x300036
mov dword [ebp - 0x2c], 0x700077
mov dword [ebp - 0x28], 0x55005c
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x200072
mov dword [ebp - 0x1c], 0x610044
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x5c
call fcn.10006f60
mov ecx, eax
test ecx, ecx
je 0x10041d00
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10041cc1
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x10041ce2
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041cc7
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3

Function at 0x10041d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081758
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x360033
mov dword [ebp - 0x38], 0x570030
mov dword [ebp - 0x34], 0x530050
mov dword [ebp - 0x30], 0x740065
mov dword [ebp - 0x2c], 0x690048
mov dword [ebp - 0x28], 0x740073
mov dword [ebp - 0x24], 0x72006f
mov dword [ebp - 0x20], 0x2e0079
mov dword [ebp - 0x1c], 0x73006a
mov dword [ebp - 0x18], 0x6e006f
mov word [ebp - 0x14], ax
call fcn.10006f60
mov ecx, eax
test ecx, ecx
je 0x10041dfd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10041dbe
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x10041ddf
lea ecx, [ebp - 0x3c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041dc4
sub ecx, edx
lea eax, [ebp - 0x3c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3
Function at 0x10041e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081508
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x360033
mov dword [ebp - 0x30], 0x570030
mov dword [ebp - 0x2c], 0x460050
mov dword [ebp - 0x28], 0x760061
mov dword [ebp - 0x24], 0x6d0054
mov dword [ebp - 0x20], 0x2e0070
mov dword [ebp - 0x1c], 0x73006a
mov dword [ebp - 0x18], 0x6e006f
mov word [ebp - 0x14], ax
call fcn.10006f60
mov ecx, eax
test ecx, ecx
je 0x10041eef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10041eb0
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x10041ed1
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041eb6
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3

Function at 0x10041f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081318
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x360033
mov dword [ebp - 0x2c], 0x570030
mov dword [ebp - 0x28], 0x4c0050
mov dword [ebp - 0x24], 0x63006f
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x6a002e
mov dword [ebp - 0x18], 0x6f0073
mov dword [ebp - 0x14], 0x6e
call fcn.10006f60
mov ecx, eax
test ecx, ecx
je 0x10041fd9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10041f9a
movzx eax, ax
mov ecx, esi
push eax
call fcn.100336b0
jmp 0x10041fbb
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041fa0
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006e50
int3
Function at 0x10043bc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083db8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100a6250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x10043c92
cmp byte [esi + 0x3c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jne 0x10043c07
push dword [esi + 0x34]
call edi
test eax, eax
je 0x10043c34
push dword [esi + 0x34]
call edi
test eax, eax
je 0x10043c22
push 1
mov ecx, esi
call fcn.100434a0
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x38]
lea eax, [esi + 0x28]
mov ecx, esi
push eax
call fcn.10043df0
mov byte [esi + 0x3c], 0
cmp byte [esi + 0x18], 0
je 0x10043c4c
push dword [esi + 0x14]
lea eax, [esi + 8]
mov ecx, esi
push eax
call fcn.10043df0
mov byte [esi + 0x18], 0
cmp byte [esi + 0x50], 0
je 0x10043c92
lea edi, [esi + 0x60]
mov dword [ebp - 0x14], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10043c68
mov eax, dword [edi]
push edi
call dword [eax]
push dword [esi + 0x4c]
lea eax, [esi + 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10043df0
mov byte [esi + 0x50], 0
mov dword [ebp - 4], 1
test edi, edi
je 0x10043c92
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10043d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov ecx, 0x100aa598
mov dword [ebp - 0x14], 0x6c6c6177
lea esi, [ebp - 0x14]
mov dword [ebp - 0x10], 0x65706170
mov dword [ebp - 0xc], 0x64695f72
mov edx, 0x64
mov byte [ebp - 8], 0
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x10043dc9
mov al, byte [esi + ecx]
test al, al
je 0x10043dc9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10043db0
lea eax, [ecx - 1]
test edx, edx
pop esi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [eax], 0
mov eax, 0x100aa598
call fcn.1001a767
mov esp, ebp
pop ebp
ret
Function at 0x10043df0
Capabilities:
Check if file exists
Create directory
Delete file
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10043e24
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1002c590
mov ebx, eax
mov dword [ebp - 0x218], ebx
test ebx, ebx
je 0x10043fae
xor ecx, ecx
mov eax, 0x2aaaaaab
mov dword [ebp - 0x210], ecx
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10043e97
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [esi]
push ebx
add ecx, edi
call fcn.10036410
mov ecx, dword [esi + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [esi]
add edi, 0x60
inc dword [ebp - 0x210]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x210], eax
jb 0x10043e60
mov edi, dword [ebp - 0x214]
push ebx
call fcn.1002c8a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10043fa0
mov edx, SysReAllocString
mov ecx, ebx
cmp byte [ecx], 0
je 0x10043ebc
inc ecx
sub edx, 1
jne 0x10043eb1
mov eax, SysReAllocString
mov esi, edx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
test edx, edx
je 0x10043f97
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100456c0
lea ecx, [ebp - 0x20c]
add esp, 0xc
mov eax, ecx
mov edx, 0x104
sub edi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10043f2e
movzx eax, word [edi + ecx]
test ax, ax
je 0x10043f2e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10043f10
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10043f97
push 0
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.100492e8
add esp, 4
push dword [ebp - 0x218]
call fcn.1002c6d0
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a767
mov esp, ebp
pop ebp
ret 8
Function at 0x100448d0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100a6250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
jne 0x10044a52
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100456c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push sym.deskutils.dll_Ordinal_11
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push str.360NetUL.dll
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100449ce
lea eax, [ebp - 0x20c]
push eax
call esi
push str.wallpaperhelperNetUL.dll
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100449ce
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
push str.utilsNetULEx.dll
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x100449ce
push str...360NetUL.dll
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.10030c10
add esp, 4
pop ebx
test eax, eax
je 0x10044a91
mov dword [edi + 0x1c], 1
cmp dword [edi], 0
jne 0x10044a52
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10044a52
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10044a52
call eax
mov dword [edi + 0xc], eax
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10044aa3
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x10044aa5
mov eax, dword [esi]
mov ecx, esi
push 0
push str.ungzip
call dword [eax + 0x30]
mov eax, dword [esi]
mov ecx, esi
push 0
push str.gzip
call dword [eax + 0x30]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a767
mov esp, ebp
pop ebp
ret
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1001a767
mov esp, ebp
pop ebp
ret

Function at 0x10069b3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x402b78
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x429290]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c0c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402bc9
cmp dword [ebp + 0x10], ebx
jne 0x402c00
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b78
test eax, eax
jne 0x402bdb
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00406252
cmp eax, ebx
je 0x402c13
push ebx
push dword [0x429290]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c0c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x429290], ebx
jne 0x402c09
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c09
jmp 0x402c0c
Function at 0x403060
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp eax, esi
jl 0x40308c
mov ecx, dword [0x429238]
push esi
add eax, ecx
push esi
push eax
mov dword [0x417e7c], eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040317b
cmp eax, esi
jl 0x403175
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40901c]
call fcn.00405bd7
test eax, eax
je 0x403161
push dword [ebp + 8]
add dword [0x417e7c], 4
call fcn.0040317b
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x403175
cmp dword [ebp + 0x10], esi
jne 0x40313d
cmp dword [ebp + 8], esi
jle 0x403172
mov esi, 0x413e78
cmp dword [ebp + 8], 0x4000
mov edi, dword [ebp + 8]
jl 0x4030f2
mov edi, 0x4000
push edi
push esi
push dword [0x40901c]
mov dword [ebp - 4], edi
call fcn.00405bd7
test eax, eax
je 0x403161
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403139
cmp dword [ebp + 0x14], edi
jne 0x403139
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417e7c], eax
cmp dword [ebp + 8], 0
jg 0x4030e1
jmp 0x403172
push 0xfffffffffffffffe
jmp 0x403163
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403148
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403166
push 0xfffffffffffffffd
pop eax
jmp 0x403175
mov eax, dword [ebp - 4]
add dword [0x417e7c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x40317b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417e7c]
sub esi, dword [0x40bde8]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x4291ec], eax
jle 0x4032e5
push dword [0x41fe8c]
call fcn.0040330d
push ebx
push ebx
push dword [0x40bde8]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41fe88], esi
mov dword [0x417e78], ebx
mov ebp, 0x40be78
mov eax, dword [0x417e80]
mov edi, 0x4000
sub eax, dword [0x41fe8c]
cmp eax, edi
jg 0x4031f0
mov edi, eax
mov esi, 0x413e78
push edi
push esi
call fcn.004032f7
test eax, eax
je 0x4032d7
add dword [0x41fe8c], edi
mov dword [0x40be08], esi
mov dword [0x40be0c], edi
cmp dword [0x4291f0], ebx
je 0x403247
cmp dword [0x429280], ebx
jne 0x403247
mov eax, dword [0x41fe88]
push ebx
sub eax, dword [0x417e7c]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40bde8]
mov dword [0x417e78], eax
call fcn.00402d18
pop ecx
mov ecx, 0x40bdf0
mov dword [0x40be10], ebp
mov dword [0x40be14], 0x8000
call fcn.0040638e
test eax, eax
jl 0x4032e0
mov esi, dword [0x40be10]
sub esi, ebp
je 0x4032a1
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4032dc
cmp esi, dword [esp + 0x10]
jne 0x4032dc
add dword [0x40bde8], esi
cmp dword [0x40be0c], ebx
jne 0x403216
jmp 0x4032ad
cmp dword [0x40be0c], ebx
jne 0x4032e0
cmp edi, ebx
je 0x4032e0
mov eax, dword [0x417e7c]
mov ecx, eax
sub ecx, dword [0x40bde8]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4031da
push ebx
push ebx
push eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4032e5
or eax, 0xffffffff
jmp 0x4032ef
push 0xfffffffffffffffe
jmp 0x4032e2
push 0xfffffffffffffffd
pop eax
jmp 0x4032ef
push 1
call fcn.00402d18
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4