joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d90e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004e8030
mov eax, dword [0x5a0800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005386b3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x53d950
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x53daac
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004e6d20
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5a5040]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0052dfa4
mov ecx, dword [esi*4 + 0x5a5040]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x53daa5
cmp eax, dword [ecx + edi + 0x24]
jne 0x53daa5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53daa5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0052dfa4
add esp, 0x14
test edx, edx
jl 0x53daa5
jg 0x53da1b
test eax, eax
jb 0x53daa5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x53daa5
jl 0x53da35
cmp dword [ebp - 0x1008], eax
ja 0x53daa5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x53da53
test ebx, ebx
je 0x53da8c
cmp ecx, edi
jae 0x53da8c
mov al, byte [ecx]
cmp al, 0xd
jne 0x53da6d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x53da79
cmp byte [ecx + 1], 0xa
jne 0x53da79
inc ecx
jmp 0x53da79
movzx eax, al
movsx eax, byte [eax + 0x5a09d0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x53da53
cmp edx, ebx
jne 0x53da53
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x53daaa
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e6d11
leave
ret
Function at 0x53f6ea
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0053f50e
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x53f859
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x53f859
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x53f80e
jg 0x53f746
test eax, eax
je 0x53f804
push 1
push 0x1000
call fcn.0053ad14
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x53f769
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x53f7fb
push 0x8000
push ebx
call fcn.00534042
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x53f792
jg 0x53f78d
cmp ecx, 0x1000
jb 0x53f792
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00537bb2
add esp, 0x10
cmp eax, 0xffffffff
je 0x53f7d7
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x53f78d
jl 0x53f7be
test ecx, ecx
jne 0x53f77f
push dword [ebp - 0xc]
push ebx
call fcn.00534042
push esi
call fcn.005395e1
add esp, 0xc
xor ebx, ebx
jmp 0x53f867
cmp byte [edi + 0x24], 0
je 0x53f7ee
cmp dword [edi + 0x20], 5
jne 0x53f7ee
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x53f7f9
mov ebx, dword [edi + 0x18]
jmp 0x53f7fb
xor ebx, ebx
push esi
call fcn.005395e1
pop ecx
jmp 0x53f867
test ecx, ecx
jg 0x53f7d0
jl 0x53f80e
test eax, eax
jae 0x53f7d0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0052dfc2
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x53f82e
cmp byte [edi + 0x1c], 0
je 0x53f7d0
jmp 0x53f85f
push ebx
call fcn.0053f278
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x53f7d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x53f867
cmp byte [edi + 0x1c], 0
je 0x53f864
mov ebx, dword [edi + 0x18]
jmp 0x53f867
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0052dfc2
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x542dd3
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00542ca7
Function at 0x543610
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5a0800]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x54365b
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.005439e2
test al, al
jne 0x543655
sub edx, 2
cmp edx, edi
jne 0x54363b
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x54367d
lea eax, [edi + 2]
cmp edx, eax
je 0x54367d
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005432d7
add esp, 0x10
jmp 0x543777
push esi
lea ecx, [ebp - 0x255]
call fcn.005439e2
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5436c0
push dword [ebp - 0x25c]
jmp 0x54366d
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x5436fd
cmp word [ebp - 0x226], 0
je 0x54371e
cmp word [ebp - 0x226], ax
jne 0x5436fd
cmp word [ebp - 0x224], 0
je 0x54371e
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005432d7
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x54376a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5436d7
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x543752
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x543777
push 0x542df6
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00521460
add esp, 0x10
jmp 0x543747
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e6d11
leave
ret
Function at 0x544b52
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x544bef
push ebx
push esi
call fcn.00544b0e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0053e18e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x544b9c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x544bee
push edi
push eax
call fcn.0053961b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x544bbc
call fcn.005395e1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x544bed
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0053e18e
add esp, 0x20
test eax, eax
jne 0x544bdb
push edi
call fcn.005395e1
jmp 0x544be3
push ebx
call fcn.005395e1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x544bf2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x544c03
pop esi
ret
push ebx
push edi
push esi
call fcn.00544b0e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0053961b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x544c2b
push ebx
push esi
push edi
call fcn.004e9540
add esp, 0xc
push 0
call fcn.005395e1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x54551a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00544ea0

Function at 0x547726
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.005392bf
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x547795
cmp esi, dword [ebp - 4]
je 0x547790
cmp dword [ebp + 0xc], 0
je 0x547790
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x54776d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00547278
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x547797
xor eax, eax
inc eax
jmp 0x547797
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5477fc
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5a0800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.005392bf
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005392bf
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x547873
cmp word [ecx], dx
je 0x547873
mov eax, dword [0x58bb64]
push edi
dec eax
push eax
push 0x58ba50
call fcn.0054779b
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5478e6
cmp word [eax], dx
je 0x5478e6
mov eax, dword [edi]
test eax, eax
je 0x547897
cmp word [eax], dx
je 0x547897
lea eax, [ebp - 0x10]
push eax
call fcn.0054717e
jmp 0x5478a0
lea eax, [ebp - 0x10]
push eax
call fcn.00547219
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x547910
mov eax, dword [0x58ba4c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x58b740
call fcn.0054779b
add esp, 0xc
test al, al
je 0x547910
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5478db
cmp word [eax], di
je 0x5478db
lea eax, [ebp - 0x10]
push eax
call fcn.0054717e
pop ecx
jmp 0x547912
lea eax, [ebp - 0x10]
push eax
call fcn.00547219
jmp 0x5478d8
mov eax, dword [edi]
test eax, eax
je 0x5478fd
cmp word [eax], dx
je 0x5478fd
lea eax, [ebp - 0x10]
push eax
call fcn.00547115
pop ecx
jmp 0x547910
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5479db
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00547620
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5479db
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5479db
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5479db
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x547968
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0053ba6e
test ebx, ebx
je 0x5479d6
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0053ba6e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5479db
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5479db
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00516a05
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5479dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e6d11
leave
ret
Function at 0x54e913
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5a0800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x54e956
call fcn.00520a72
mov dword [eax], 0xf
call fcn.00520a85
mov dword [eax], 0xd
call fcn.004f7228
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e6d11
leave
ret
test eax, eax
jne 0x54e95d
inc eax
jmp 0x54e94a
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x54e948
xor eax, eax
cmp ecx, 1
setne al
jmp 0x54e94a

Function at 0x550ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x55101d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x55101d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ca30
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x80], ebx
mov ecx, 7
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov edi, dword [edx + 4]
mov esi, dword [edx]
cmp esi, edi
je 0x100025c5
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x1000258b
mov edx, dword [esi]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002590
sub eax, ebx
lea ecx, [ebp - 0x40]
sar eax, 1
push eax
push edx
call fcn.10001e70
push 1
push 0x101aed9c
lea ecx, [ebp - 0x40]
call fcn.10001e70
add esi, 0x18
cmp esi, edi
jne 0x10002581
mov ecx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x80]
cmp dword [ebx + 0x14], 8
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
mov eax, ebx
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x7c], 0x3c
jb 0x100025ef
mov eax, dword [ebx]
mov dword [ebp - 0x6c], eax
cmp ecx, 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], 0x101aeda0
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0x78], 0x140
mov dword [ebp - 0x68], eax
call fcn.10002700
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100fd870
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x60], 1
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x44], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp edx, 8
jb 0x10002683
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002679
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100026eb
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x100026cd
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100026c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100026eb
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
int3
Function at 0x10003430
Capabilities:
Delete registry key

Disassembly:
push esi
call fcn.1004cb70
push str.Inside_utilRemoveARPEntry
push 0x101aee58
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
push 0
push 0xf023f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdobe_Creative_Cloud
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
pop esi
sete al
ret
Function at 0x10003750
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0x20206
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10003792
push 0x101af38c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
Function at 0x100049f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018cc88
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 0x10
jb 0x10004a39
mov ecx, dword [ecx]
push 0
lea edx, [ebp - 0x30]
call fcn.10101490
add esp, 4
test al, al
jne 0x10004a73
call fcn.1004cb70
push str.Path_Conversion_to_UTF_8_failed.
push 0x101aedac
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor bl, bl
jmp 0x10004afe
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x40]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x30]
movlpd qword [ebp - 0x40], xmm0
cmovae eax, dword [ebp - 0x30]
push ecx
push eax
movlpd qword [ebp - 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x10004ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_disk_Space_error_:_d
push 0x101aedac
push ecx
call fcn.1004cb70
add esp, 4
push eax
call fcn.1004d580
add esp, 0x10
xor bl, bl
jmp 0x10004afe
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
ja 0x10004afc
jb 0x10004ae0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jae 0x10004afc
push str.Not_Enough_disk_space_on_System.
push 0x101aedac
call fcn.1004cb70
push eax
call fcn.1004d700
add esp, 0xc
xor bl, bl
jmp 0x10004afe
mov bl, 1
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x10004b34
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004b2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004b51
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
int3
Function at 0x100094d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x26
lea eax, [ebp - 0x210]
mov edi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10009533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_retreive_drivePath__from_Win_library_error:_d
push 0x101aee58
push ecx
call fcn.1004cb70
add esp, 4
push eax
call fcn.1004dbb0
add esp, 0x10
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x210]
push 0x101ace08
push eax
call fcn.101687aa
add esp, 0xc
test eax, eax
je 0x100095be
call fcn.1004cb70
push str.drivePath_retreived
push 0x101aee58
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
lea edx, [ebp - 0x210]
add esp, 0xc
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10009580
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.10001d60
push 1
push 0x101ace08
mov ecx, edi
call fcn.10001e70
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_drivePath
push 0x101aee58
call fcn.1004cb70
push eax
call fcn.1004dbb0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor al, al
pop edi
pop esi
call fcn.1015c875
mov esp, ebp
pop ebp
ret
Function at 0x1000cdb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d580
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
xor bl, bl
call fcn.100fc930
test al, al
jne 0x1000ce1b
push str.Failed_to_contruct_temp_path_to_construct_the_marker_file_path
push 0x101aee58
call fcn.1004cb70
push eax
call fcn.1004dbb0
add esp, 0xc
jmp 0x1000cea1
push 9
xor eax, eax
mov dword [ebp - 0x30], 0
push str.asuap.txt
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10001d60
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100fd940
mov edx, dword [ebp - 0x2c]
add esp, 0xc
cmp edx, 8
jb 0x1000ce8a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000ce80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000cef3
push edx
push ecx
call fcn.1015cbd5
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1000ced7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000cecd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000cef8
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
call fcn.101686f5
int3