joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10188ad4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp 0x101888c8
and ecx, 0x132e2
call 0x101888db
add byte [ebx], bh
cmp eax, dword [eax + 0x45]
xor al, 0x38
cmp al, 0x83
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
or edx, 0x12031
or edx, 0xf4dc
pop edx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0x5d8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xec4], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
push esi
push edx
add esp, 4
add esi, 0x16fba
pop esi
push esi
sub esi, 0x14c4d
pop esi
push ebx
add ebx, 0x14f0b
pop ebx
push edi
xor edi, 0x72e5
pop edi
push ecx
or ecx, 0x16ca6
or ecx, 0x102f0
pop ecx
mov edx, dword [ebp - 0xec4]
mov ax, word [edx]
mov word [ebp - 0x12ce], ax
mov ecx, dword [ebp - 0xec4]
add ecx, 2
mov dword [ebp - 0xec4], ecx
mov dx, word [ebp - 0x12ce]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xec8]
mov cx, word [eax]
mov word [ebp - 0x12d0], cx
mov edx, dword [ebp - 0xec8]
add edx, 2
mov dword [ebp - 0xec8], edx
mov ax, word [ebp - 0x12d0]
mov word [ebp - 0x140], ax
push esi
xor esi, 0x41d4
pop esi
push ecx
or ecx, 0xbfa0
pop ecx
push eax
push esi
add esp, 4
add eax, 0x15905
sub eax, 0xbcd5
jmp 0x101889d3
pop eax
push edx
and edx, 0x12d9d
pop edx
movzx ecx, word [ebp - 0x140]
test ecx, ecx
jne 0x101889ff
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
sub edx, eax
mov dword [ebp - 0x1938], edx
jmp 0x10188a62
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
je 0x1018891e
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x140]
sar dh, 0xff
invalid
cmp eax, ecx
je 0x1018891e
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
cmp edx, eax
jge 0x10188a4c
mov dword [ebp - 0x1934], 0xffffffff
jmp 0x10188a56
mov dword [ebp - 0x1934], 1
mov ecx, dword [ebp - 0x1934]
mov dword [ebp - 0x1938], ecx
cmp dword [ebp - 0x1938], 0
jne 0x10188aab
push ebx
push edx
add esp, 4
or ebx, 0x13a3
pop ebx
push edx
or edx, 0x4500
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xdc9d
add ecx, 0x1be0
add ecx, 0x10ed0
add ecx, 0x23a7
pop ecx
mov edx, dword [ebp - 0x5d8]
mov dword [ebp - 0x37c], edx
jmp fcn.10188b13
push eax
push ecx
add esp, 4
xor eax, 0x4c75
call 0x10188ac2
add byte [ebx + 0x4e], cl
aaa
aaa
push eax
dec eax
add esp, 4
pop eax
push ecx
push eax
add esp, 4
or ecx, 0xb7cb
jmp 0x10188ad6
xor al, 0x4b
or ecx, 0x12135
pop ecx
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [eax]
mov dword [ebp - 0x5d8], ecx
mov edx, dword [ebp - 0x5d8]
cmp edx, dword [ebp - 0xecc]
je 0x10188b09
mov eax, dword [ebp - 0x5d8]
cmp dword [eax + 0x30], 0
jne 0x101888bf
invalid
mov dword [ebp - 0x37c], 0

Function at 0x10188b28
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x10188b1c
call 0x10188b28
add byte [esi], dh
aaa
xor al, 0x4b
cmp ecx, dword [ebx + eax*4 - 0x3c]
add al, 0x81
ljmp 0x525a
Function at 0x42e001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x60486b4f
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1aa90930
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100026c4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100141e0]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x94]
cmp word [eax], 2
push ebx
je 0x100027b9
mov ebx, dword [eax + 0x24]
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x7c]
push eax
push 0x104
mov word [esi + 0xc4], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1000271b
xor ax, ax
jmp 0x100027c3
lea eax, [esi + 0xc6]
push eax
push 0
push 0x10010538
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10002713
push edi
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push ebx
call edi
push 0x5a
push ebx
mov dword [esi + 0x1d0], eax
call edi
push 0xc
push ebx
mov dword [esi + 0x1d4], eax
call edi
cmp eax, 1
mov dword [esi + 0x1d8], eax
jne 0x1000278f
push 0xe
push ebx
call edi
cmp eax, 1
jle 0x1000277f
mov ecx, dword [esi + 0x1d8]
imul ecx, eax
mov dword [esi + 0x1d8], ecx
jmp 0x1000278f
push 0x18
push ebx
call edi
cmp eax, 1
jle 0x1000278f
mov dword [esi + 0x1d8], eax
push 0
lea eax, [ebp - 0x80]
push eax
push 4
push 8
push ebx
mov dword [ebp - 0x80], 0x1013
call dword [sym.imp.GDI32.dll_Escape]
mov word [esi + 0x1dc], ax
mov dword [esi + 0x1e0], 1
pop edi
mov dword [esi], 0x1e4
mov ax, 1
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
pop ebx
call fcn.1000e3d8
add ebp, 0x8c
leave
ret

Function at 0x1000336e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], esi
mov dword [ebp - 8], 1
call fcn.100014f2
test ax, ax
je 0x10003398
mov ax, 1
jmp 0x10003414
push edi
mov dword [ebp - 0x24], str.SoftwareAdobeAcrobat_Reader9.0Originals
mov dword [ebp - 0x20], str.SoftwareAdobeAdobe_Acrobat9.0Originals
mov dword [ebp - 0x1c], str.SoftwareAdobeAcrobat_Reader8.0Originals
mov dword [ebp - 0x18], str.SoftwareAdobeAdobe_Acrobat8.0Originals
mov dword [ebp - 0x14], str.SoftwareAdobeAcrobat_Reader7.0Originals
mov dword [ebp - 0x10], str.SoftwareAdobeAdobe_Acrobat7.0Originals
xor edi, edi
lea eax, [ebp - 4]
push eax
push 1
push esi
push dword [ebp + edi*4 - 0x24]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 4], esi
je 0x10003409
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push str.bBrowserIntegration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x1000340f
inc edi
cmp edi, 6
jl 0x100033c5
mov ax, word [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x10006894
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x100068b3
push dword [esp + 4]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
ret
xor eax, eax
ret

Function at 0x100068b6
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x100068d5
push dword [esp + 4]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
ret
xor eax, eax
ret

Function at 0x1000aa9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x74
push ebx
push esi
xor esi, esi
cmp edx, esi
push edi
je 0x1000ac02
cmp dword [edx + 4], esi
je 0x1000ac02
mov eax, dword [ebp + 0x28]
cmp eax, esi
je 0x1000ac02
cmp dword [ebp + 0x10], esi
je 0x1000ac02
cmp dword [ebp + 0x14], esi
je 0x1000ac02
cmp dword [ebp + 0x18], esi
je 0x1000ac02
cmp dword [ebp + 0x1c], esi
je 0x1000ac02
cmp word [edx + 0x54], si
je 0x1000aafa
mov eax, 0x400f0002
jmp 0x1000ac05
mov ecx, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edx
call fcn.1000a2d7
mov edi, eax
cmp edi, esi
jne 0x1000ab24
push ecx
xor ebx, ebx
mov edi, edx
call fcn.1000a2f2
mov edi, eax
cmp edi, esi
pop ecx
jne 0x1000ab24
push 2
jmp 0x1000ac04
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x10], eax
lea eax, [edi + 0xc]
push 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
pop ebx
push eax
mov dword [ebp - 0x74], 0x534f504e
mov word [ebp - 0x70], si
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 0x4f574e52
mov word [ebp - 0x60], si
mov dword [ebp - 0x5c], eax
call sub.MSVCR80.dll_strlen
mov ecx, dword [ebp + 0x14]
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
push 7
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x4c]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x54], 0x55524551
mov word [ebp - 0x50], si
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], 0x55414354
mov word [ebp - 0x40], si
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0x4c454e20
mov word [ebp - 0x30], si
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0x4d4f4445
mov word [ebp - 0x20], si
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x4d494d45
mov word [ebp - 0x10], si
mov dword [ebp - 8], ebx
call fcn.1000bdba
mov ebx, eax
add esp, 0x14
cmp ebx, esi
jne 0x1000abfe
push 1
push dword [ebp - 4]
call fcn.1000bf80
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
jne 0x1000abf7
mov eax, dword [ebp + 0x28]
mov dword [eax], edi
jmp 0x1000abfe
mov ecx, edi
call fcn.1000a32e
mov eax, ebx
jmp 0x1000ac05
push 3
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ac17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
xor esi, esi
cmp ecx, esi
je 0x1000acdc
lea eax, [ecx + 0xc]
cmp dword [eax], esi
je 0x1000acdc
mov ecx, dword [ecx + 4]
cmp ecx, esi
je 0x1000acdc
cmp dword [ecx + 0x4c], esi
je 0x1000acdc
cmp edi, esi
je 0x1000acdc
cmp edx, esi
je 0x1000acdc
cmp word [ebp + 0x10], si
jne 0x1000ac6a
cmp word [ecx + 0x54], si
je 0x1000ac6a
mov eax, 0x400f0002
jmp 0x1000acdf
push 4
mov dword [ebp - 0x3c], eax
pop eax
mov dword [ebp - 0x28], edx
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
lea edx, [ebp + 0xc]
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp + 8]
mov dword [ebp - 0x44], 0x50555348
mov word [ebp - 0x40], si
mov dword [ebp - 0x34], 0x50444154
mov word [ebp - 0x30], si
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x504f4653
mov word [ebp - 0x20], si
mov dword [ebp - 0x14], 0x4c454e20
mov word [ebp - 0x10], si
mov dword [ebp - 0xc], edx
push dword [ecx + 0x4c]
lea eax, [ebp - 4]
push eax
call fcn.1000bdba
add esp, 0x10
cmp eax, esi
jne 0x1000acdf
push esi
push dword [ebp - 4]
call fcn.1000bf80
pop ecx
pop ecx
jmp 0x1000acdf
push 3
pop eax
pop esi
leave
ret

Function at 0x1000ace2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
xor esi, esi
cmp ecx, esi
je 0x1000ad9a
lea eax, [ecx + 0xc]
cmp dword [eax], esi
je 0x1000ad9a
mov ecx, dword [ecx + 4]
cmp ecx, esi
je 0x1000ad9a
cmp dword [ecx + 0x4c], esi
je 0x1000ad9a
cmp word [ebp + 0x14], si
jne 0x1000ad25
cmp word [ecx + 0x54], si
je 0x1000ad25
mov eax, 0x400f0002
jmp 0x1000ad9d
push 4
mov dword [ebp - 0x3c], eax
pop eax
lea edx, [ebp + 0xc]
mov dword [ebp - 0x2c], edx
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
lea edx, [ebp + 0x10]
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp + 8]
mov dword [ebp - 0x44], 0x50455354
mov word [ebp - 0x40], si
mov dword [ebp - 0x34], 0x50454552
mov word [ebp - 0x30], si
mov dword [ebp - 0x24], 0x504f4653
mov word [ebp - 0x20], si
mov dword [ebp - 0x14], 0x4c454e20
mov word [ebp - 0x10], si
mov dword [ebp - 0xc], edx
push dword [ecx + 0x4c]
lea eax, [ebp - 4]
push eax
call fcn.1000bdba
add esp, 0x10
cmp eax, esi
jne 0x1000ad9d
push esi
push dword [ebp - 4]
call fcn.1000bf80
pop ecx
pop ecx
jmp 0x1000ad9d
push 3
pop eax
pop esi
leave
ret
Function at 0x1000addb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov ecx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x1000ae6a
lea eax, [ecx + 0xc]
cmp dword [eax], edi
je 0x1000ae6a
mov esi, dword [ecx + 4]
cmp esi, edi
je 0x1000ae6a
cmp dword [esi + 0x4c], edi
je 0x1000ae6a
mov dword [ebp - 0x2c], eax
push 4
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
mov dword [ebp - 0x34], 0x50525350
mov word [ebp - 0x30], di
mov dword [ebp - 0x24], 0x52535043
mov word [ebp - 0x20], di
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x52535048
mov word [ebp - 0x10], di
mov dword [ebp - 0xc], eax
call sub.MSVCR80.dll_strlen
mov dword [ebp - 8], eax
push 3
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x4c]
lea eax, [ebp - 4]
push eax
call fcn.1000bdba
add esp, 0x14
cmp eax, edi
jne 0x1000ae6d
push edi
push dword [ebp - 4]
call fcn.1000bf80
pop ecx
pop ecx
jmp 0x1000ae6d
push 3
pop eax
pop edi
pop esi
leave
ret

Function at 0x1000b770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x1000b8a0
cmp dword [ebx + 0x4c], edi
je 0x1000b8a0
cmp word [ebx + 0x54], di
je 0x1000b7a1
mov eax, 0x400f0002
jmp 0x1000b8a3
push esi
mov esi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x80], 0x464f504e
mov word [ebp - 0x7c], di
mov dword [ebp - 0x78], esi
call sub.MSVCR80.dll_strlen
inc eax
push esi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], 0x4f574e52
mov word [ebp - 0x6c], di
mov dword [ebp - 0x68], esi
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
push eax
mov dword [ebp - 0x60], 0x55524551
mov word [ebp - 0x5c], di
mov dword [ebp - 0x50], 0x46535953
mov word [ebp - 0x4c], di
mov dword [ebp - 0x48], eax
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
push eax
mov dword [ebp - 0x40], 0x46535450
mov word [ebp - 0x3c], di
mov dword [ebp - 0x38], eax
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
push 4
mov dword [ebp - 0x24], eax
pop esi
lea eax, [ebp + 0x30]
push ebx
mov dword [ebp - 0x30], 0x55414354
mov word [ebp - 0x2c], di
mov dword [ebp - 0x20], 0x4d494d45
mov word [ebp - 0x1c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
call fcn.1000b27e
add esp, 0x14
cmp eax, esi
pop esi
jge 0x1000b862
push 7
jmp 0x1000b87b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], 0x55524544
mov word [ebp - 0xc], di
mov dword [ebp - 4], eax
push 8
lea eax, [ebp - 0x80]
push eax
push dword [ebx + 0x4c]
lea eax, [ebp + 8]
push eax
call fcn.1000bdba
add esp, 0x10
cmp eax, edi
jne 0x1000b8a3
push 1
push dword [ebp + 8]
call fcn.1000bf80
pop ecx
pop ecx
jmp 0x1000b8a3
push 3
pop eax
pop edi
pop ebx
leave
ret
Function at 0x1000b8a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x1000b9c7
cmp dword [edi + 4], ebx
je 0x1000b9c7
cmp dword [edi + 0x4c], ebx
je 0x1000b9c7
cmp word [edi + 0x54], bx
je 0x1000b8de
mov eax, 0x400f0002
jmp 0x1000b9ca
push esi
mov esi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x70], 0x464f704c
mov word [ebp - 0x6c], bx
mov dword [ebp - 0x68], esi
call sub.MSVCR80.dll_strlen
inc eax
push esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0x4f574e52
mov word [ebp - 0x5c], bx
mov dword [ebp - 0x58], esi
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2c]
push eax
mov dword [ebp - 0x50], 0x55524551
mov word [ebp - 0x4c], bx
mov dword [ebp - 0x40], 0x46535953
mov word [ebp - 0x3c], bx
mov dword [ebp - 0x38], eax
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
push eax
mov dword [ebp - 0x30], 0x46535450
mov word [ebp - 0x2c], bx
mov dword [ebp - 0x28], eax
call sub.MSVCR80.dll_strlen
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x20], 0x55414354
mov word [ebp - 0x1c], bx
mov dword [ebp - 0x14], eax
call fcn.1000b27e
add esp, 0x14
cmp eax, 4
pop esi
jge 0x1000b989
push 6
jmp 0x1000b9a2
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], 0x55524544
mov word [ebp - 0xc], bx
mov dword [ebp - 4], eax
push 7
lea eax, [ebp - 0x70]
push eax
push dword [edi + 0x4c]
lea eax, [ebp + 8]
push eax
call fcn.1000bdba
add esp, 0x10
cmp eax, ebx
jne 0x1000b9ca
push 1
push dword [ebp + 8]
call fcn.1000bf80
pop ecx
pop ecx
jmp 0x1000b9ca
push 3
pop eax
pop edi
pop ebx
leave
ret
Function at 0x1000c5e0
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x33c]
sub esp, 0x3bc
mov eax, dword [0x100141e0]
xor eax, ebp
mov dword [ebp + 0x338], eax
mov eax, dword [ebp + 0x348]
push edi
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push eax
xor edi, edi
push 0x20019
push edi
push str.SoftwareAdobeAcrobatExe
push 0x80000000
mov dword [ebp - 0x68], edi
mov word [ebp - 0x60], di
mov word [esi], di
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000c774
push ebx
push 0x398
lea eax, [ebp - 0x60]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push dword [ebp - 0x68]
mov dword [ebp - 0x78], 0x396
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x68]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000c773
mov ebx, dword [sym.imp.MSVCR80.dll_wcslen]
lea eax, [ebp - 0x60]
push eax
call ebx
test eax, eax
pop ecx
je 0x1000c773
lea eax, [ebp - 0x60]
push eax
call ebx
cmp eax, 0x1be
pop ecx
jae 0x1000c773
mov edi, dword [ebp + 0x344]
lea eax, [ebp - 0x60]
push eax
dec edi
push edi
push esi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
push esi
call ebx
and word [esi + eax*2 - 2], 0
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
lea ebx, [esi + 2]
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000c753
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x10010b04
push dword [ebp - 0x64]
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x74]
movzx eax, word [eax + 0xa]
cmp ax, 6
jbe 0x1000c753
cmp ax, 7
jne 0x1000c717
push str.___o__eo__l
jmp 0x1000c758
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
push str.___o__eo__l__b
push edi
push esi
call ebx
add esp, 0xc
cmp dword [ebp - 0x6c], 0
je 0x1000c763
push dword [ebp - 0x6c]
lea eax, [ebp - 0x60]
push str.__w__ld
push 0x1cc
push eax
call dword [sym.imp.MSVCR80.dll__snwprintf]
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call ebx
add esp, 0x1c
jmp 0x1000c763
push str.___o
push edi
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
cmp dword [ebp - 0x64], 0
je 0x1000c773
push dword [ebp - 0x64]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
pop ebx
mov ecx, dword [ebp + 0x338]
xor ecx, ebp
pop edi
call fcn.1000e3d8
add ebp, 0x33c
leave
ret
Function at 0x1000cae7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
call fcn.100070c7
mov esi, eax
test esi, esi
je 0x1000cb0b
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000cb35
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [eax + 0x48]
push 0x1000c86f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000cb35
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call fcn.100070a8
xor eax, eax
test esi, esi
pop ecx
setne al
pop esi
leave
ret

Function at 0x1000cb46
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call sub.MSVCR80.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call sub.MSVCR80.dll_memset
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop esi
jne 0x1000cb90
leave
ret
push 0x186a0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x1000ddc6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0xb0
mov eax, dword [0x100141e0]
xor eax, ebp
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x6c]
push ebx
mov ebx, dword [ebp + 0x78]
push esi
push edi
mov dword [ebp - 0x38], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x4c], esi
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [ebp + 0x7c]
push eax
push ebx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
call fcn.1000dda2
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x30], 6
jb 0x1000de42
push 0
lea eax, [ebp - 0x3c]
push eax
inc esi
push esi
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], 0xc
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], eax
push ebx
push dword [ebp + 0x70]
neg esi
push 0
sbb esi, esi
lea eax, [ebp - 0x4c]
push 4
and esi, eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x1000de92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000de8d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x7c]
push ebx
push dword [ebp - 0x38]
push dword [ebp + 0x70]
push dword [ebp - 0x40]
call fcn.1000ddc6
add esp, 0x14
jmp 0x1000de92
mov eax, dword [ebp - 0x38]
mov dword [eax], esi
mov ecx, dword [ebp + 0x60]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e3d8
add ebp, 0x64
leave
ret

Function at 0x1000deba
Capabilities:
Read file via mapping

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 6
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
ret

Function at 0x1000e3d8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100141e0]
jne 0x1000e3e2
repz ret
jmp fcn.1000eaa4