joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498e14
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 4]
call fcn.00405514
lea eax, [ebp - 0x168]
mov edx, dword [0x4085ac]
call fcn.00405af8
xor eax, eax
push ebp
push 0x4990a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x170]
mov ecx, 0x4990bc
mov edx, dword [ebp - 4]
call fcn.004053ac
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040a070
test eax, eax
jne 0x499042
mov eax, dword [ebp - 0x154]
mov edx, 0x4990cc
call fcn.004054bc
je 0x499024
mov eax, dword [ebp - 0x154]
mov edx, 0x4990d8
call fcn.004054bc
je 0x499024
mov eax, dword [ebp - 0x158]
and eax, 0x10
cmp eax, 0x10
jne 0x498f0f
push dword [ebp - 4]
push 0x4990e4
push dword [ebp - 0x154]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00405428
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x16c]
call fcn.00498e14
jmp 0x499024
xor eax, eax
push ebp
push 0x498f59
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x4990e4
push dword [ebp - 0x154]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00405428
mov eax, dword [ebp - 0x178]
call fcn.00405524
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499024
mov eax, dword [ebp - 0x154]
mov edx, 0x4990cc
call fcn.004054bc
je 0x499024
mov eax, dword [ebp - 0x154]
mov edx, 0x4990d8
call fcn.004054bc
je 0x499024
mov eax, dword [ebp - 0x158]
and eax, 0x10
cmp eax, 0x10
jne 0x498fd3
push dword [ebp - 4]
push 0x4990e4
push dword [ebp - 0x154]
lea eax, [ebp - 0x17c]
mov edx, 3
call fcn.00405428
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
call fcn.00498e14
jmp 0x499024
xor eax, eax
push ebp
push 0x49901a
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x4990e4
push dword [ebp - 0x154]
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.00405428
mov eax, dword [ebp - 0x180]
call fcn.00405524
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499024
lea eax, [ebp - 0x168]
call fcn.0040a0c0
test eax, eax
je 0x498f68
lea eax, [ebp - 0x168]
call fcn.0040a0e4
xor eax, eax
push ebp
push 0x499062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49906c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4990aa
lea eax, [ebp - 0x180]
mov edx, 5
call fcn.004050b8
lea eax, [ebp - 0x168]
mov edx, dword [0x4085ac]
call fcn.00405bc8
lea eax, [ebp - 4]
call fcn.00405094
ret
Function at 0x49a6f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
xor eax, eax
push ebp
push 0x49a860
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49a831
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 0x15], 0
mov ecx, dword [0x4a160c]
mov ecx, dword [ecx]
mov edx, dword [0x4a1480]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004053ac
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x49a817
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [0x4a1480]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.004053ac
mov edx, dword [ebp - 8]
mov eax, 0x49a878
call fcn.00405670
test eax, eax
jle 0x49a7a2
mov edx, dword [ebp - 8]
mov eax, 0x49a878
call fcn.00405670
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 4
call fcn.004055cc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004053ac
mov eax, dword [ebp - 0xc]
call fcn.00467e6c
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.00467e6c
cmp eax, edi
je 0x49a80f
mov byte [ebp - 0x15], 0
push 0
mov eax, dword [0x4a1480]
push dword [eax]
push dword [ebp - 8]
mov eax, dword [0x4a13dc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405428
mov eax, dword [ebp - 0x1c]
call fcn.00405524
push eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004053ac
mov eax, dword [ebp - 0x20]
call fcn.00405524
push eax
call sub.KERNEL32.DLL_CopyFileA
inc esi
dec ebx
jne 0x49a755
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a838
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx ebx, byte [ebp - 0x15]
ret
Function at 0x49b0d4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x49b0dc
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49b2eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4a1480]
mov edx, dword [edx]
call fcn.0040512c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49b2c3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x49b2c3
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x414]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 4], 0
je 0x49b2b6
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x49b162
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4a0f0c]
mov ecx, ebx
sub ecx, dword [eax]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040558c
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x18]
call fcn.00409e88
test al, al
je 0x49b2b6
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x1c]
call fcn.00409e88
test al, al
je 0x49b259
xor eax, eax
push ebp
push 0x49b24d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x20]
call fcn.00405524
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x49b243
xor eax, eax
push ebp
push 0x49b239
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
push ebx
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x28]
call fcn.00405524
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b243
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b2b6
xor eax, eax
push ebp
push 0x49b2ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x2c]
call fcn.00405524
push eax
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0x30]
call fcn.00405524
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b2b6
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
jne 0x49b138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b2f2
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.004050b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050b8
ret
Function at 0x49b2fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49b3bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
call fcn.00405094
mov ecx, dword [0x4a1374]
mov ecx, dword [ecx]
mov edx, dword [0x4a1480]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
call fcn.004053ac
mov eax, dword [ebp - 0xc]
call fcn.00409e88
test al, al
je 0x49b3a1
xor eax, eax
push ebp
push 0x49b397
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x4a1480]
mov eax, dword [eax]
call fcn.00405524
push eax
mov eax, dword [0x4a1008]
mov eax, dword [eax]
call fcn.00405524
push eax
mov eax, dword [0x4a1374]
mov eax, dword [eax]
call fcn.00405524
push eax
push 0x49b3d4
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b3a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b3c6
lea eax, [ebp - 0xc]
call fcn.00405094
lea eax, [ebp - 4]
call fcn.00405094
ret

Function at 0x49bfb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49c075
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x3e8
call sub.KERNEL32.DLL_Sleep_2
mov eax, dword [0x4a1008]
mov edx, 0x49c08c
call fcn.004050e8
mov ecx, dword [0x4a0f84]
mov ecx, dword [ecx]
mov edx, dword [0x4a1480]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004053ac
mov eax, dword [ebp - 4]
call fcn.00409e88
test al, al
je 0x49c05f
xor eax, eax
push ebp
push 0x49c055
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [0x4a1480]
mov eax, dword [eax]
call fcn.00405524
push eax
push 0x49c094
mov eax, dword [0x4a0f84]
mov eax, dword [eax]
call fcn.00405524
push eax
push 0
mov eax, ebx
call fcn.0044708c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c05f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c07c
lea eax, [ebp - 4]
call fcn.00405094
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x383b400b
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x58724363
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10025704
Capabilities:
Check if file exists
Create directory

Disassembly:
push 4
mov eax, 0x1008e4f7
call fcn.100871aa
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.100791e7
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10058d2e
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x1002575b
mov esi, 0x800700a1
lea eax, [edi - 0x10]
call fcn.1007924a
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, esi
call fcn.10087296
ret 4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002573e
push esi
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, esi
je 0x1002573e
jle 0x1002577f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1002573e

Function at 0x10027173
Capabilities:
Get common file path

Disassembly:
push 0x18
mov eax, 0x1008e46f
call fcn.100871aa
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
mov eax, dword [0x100aee70]
mov edi, 0x100aee70
mov ecx, edi
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 1
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.10079180
mov eax, dword [ebx - 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
sub ecx, dword [ebx - 4]
mov edx, 0x104
sub eax, edx
or eax, ecx
jge 0x100271d1
mov eax, edx
lea ecx, [ebp - 0x10]
call fcn.10079066
mov ebx, dword [ebp - 0x10]
push ebx
xor eax, eax
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1002726a
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078e28
mov eax, dword [0x100aee70]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x100050ec
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10058c46
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x20], eax
call fcn.100791e7
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
push dword [ebp - 0x18]
mov esi, dword [ebp + 8]
call fcn.100790bd
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.msi.dll_MsiMessageBoxW]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 2
call fcn.1007924a
or eax, 0xffffffff
call fcn.10078e28
mov eax, dword [ebp - 0x20]
call fcn.1007924a
lea eax, [ebx - 0x10]
call fcn.1007924a
mov eax, dword [ebp + 8]
call fcn.10087296
ret 4
Function at 0x10027535
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009497f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x30], ebx
call fcn.100260a4
test al, al
je 0x100275c2
mov dword [esp + 0x14], ebx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.100253aa
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
lea eax, [esp + 0x10]
jne 0x100275b6
push esi
push 0x10005158
jmp 0x1002760a
push dword [esp + 0x14]
push esi
push 0x100051f8
jmp 0x1002761f
cmp esi, 0x80004004
jne 0x100275df
push 0x100052a8
push 0x22
pop ebx
lea eax, [esp + 0x14]
call fcn.10078f08
xor ebx, ebx
jmp 0x10027636
mov dword [esp + 0x14], ebx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 2
call fcn.100253aa
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
lea eax, [esp + 0x10]
jne 0x10027615
push esi
push 0x100052f0
push eax
call fcn.10078ea6
add esp, 0xc
jmp 0x10027628
push dword [esp + 0x14]
push esi
push 0x10005370
push eax
call fcn.10078ea6
add esp, 0x10
mov byte [esp + 0x30], bl
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x10004a58
lea eax, [esp + 0x1c]
push eax
call fcn.100580f9
mov byte [esp + 0x30], 3
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x10027695
push ebx
call fcn.1007bb0c
pop ecx
mov ecx, dword [edi]
mov edi, dword [edi + 4]
sub eax, ecx
sbb edx, edi
lea ecx, [esp + 0x14]
lea ebx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call fcn.10027282
lea edi, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.10058274
mov byte [esp + 0x30], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x18]
call fcn.100589df
mov ecx, dword [ebp + 8]
mov byte [esp + 0x30], 5
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100276f4
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x100902fd
call fcn.100871aa
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x10005434
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
call fcn.100580f9
mov dword [ebp - 4], ebx
mov eax, dword [0x100aee70]
xor esi, esi
inc esi
mov ecx, 0x100aee70
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], esi
mov ecx, dword [edi - 8]
mov edx, esi
sub edx, dword [edi - 4]
mov eax, 0x105
sub ecx, eax
or ecx, edx
jge 0x10027752
lea ecx, [ebp - 0x10]
call fcn.10079066
mov edi, dword [ebp - 0x10]
push 0x104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078e28
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
cmp esi, ebx
je 0x100277df
push esi
call fcn.1007bc2d
pop ecx
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x14]
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100277d8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1001a9f4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x100277d8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movzx edx, ax
push edx
shr eax, 0x10
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push 0x10005444
push dword [ebp + 8]
call fcn.10078ea6
add esp, 0x18
push ebx
call fcn.1007bc3d
pop ecx
lea eax, [edi - 0x10]
call fcn.1007924a
mov eax, dword [ebp + 8]
call fcn.10087296
ret 4

Function at 0x100277f7
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x10005460
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100278a3
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100278a3
lea edi, [ebp - 0x20c]
call fcn.100278c3
push 0x208
mov eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push 2
push esi
push 0x100054e0
push dword [ebp - 0x210]
call edi
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push esi
push 0x10005504
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 7
call edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b431
leave
ret
Function at 0x100278c3
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1009492f
call fcn.100871aa
xor ebx, ebx
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
cmp edi, ebx
je 0x100279e8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x10005528
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
jne 0x10027950
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push ebx
push 0x10005598
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
jne 0x10027950
xor eax, eax
push edi
mov word [edi + 0x206], ax
call esi
cmp eax, 0xffffffff
je 0x10027950
mov dword [ebp - 0x10], ebx
jmp 0x100279e8
push edi
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, 0x104
test eax, eax
js 0x10027986
push 0x100055a8
push ebx
push edi
call fcn.1007bc4d
add esp, 0xc
test eax, eax
jne 0x10027986
push edi
call esi
cmp eax, 0xffffffff
je 0x10027986
and dword [ebp - 0x10], 0
jmp 0x100279e8
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
call fcn.10025d87
push 0x100055e4
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x18]
call fcn.10058c46
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.1007924a
push dword [ebp - 0x18]
push ebx
push edi
call fcn.1007bcc7
add esp, 0xc
push edi
call esi
cmp eax, 0xffffffff
je 0x100279dd
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp - 0x10]
call fcn.10087296
ret

Function at 0x1002821d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x414]
push eax
mov esi, 0x100
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10028257
call fcn.10078cf4
jmp 0x100282e6
cmp eax, esi
jbe 0x10028265
mov eax, 0x80020013
jmp 0x100282e6
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1000571c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1002824d
xor eax, eax
mov word [ebp - 6], ax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
lea esi, [edi + 8]
push 0x101
push esi
call fcn.1007bd2f
add esp, 0x10
call fcn.10078c9a
and dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x420]
push ecx
push 0x2100
push 2
mov eax, 0x40000000
push 0
push eax
push esi
mov dword [ebp - 0x420], 0xc
mov dword [ebp - 0x418], 1
mov dword [edi + 0x20c], eax
call fcn.100280e5
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007b431
leave
ret
Function at 0x100454d7
Capabilities:
Get graphical window text

Disassembly:
push 0x20
mov eax, 0x10095e35
call fcn.100871aa
mov edi, ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x14]
je 0x1004561e
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
mov eax, dword [ebx - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [ebx - 4]
mov esi, 0x200
sub eax, esi
or eax, ecx
jge 0x1004553d
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.10079066
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 8], esi
jge 0x1004554c
push 0x80070057
call fcn.100791b8
mov dword [ebx - 0xc], esi
xor eax, eax
mov word [ebx + 0x400], ax
cmp dword [ebx - 4], 1
mov esi, dword [ebx - 8]
jle 0x10045570
push dword [ebx - 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.10078fca
mov ebx, dword [ebp - 0x10]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078e28
push dword [edi + 0xc]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call fcn.10045134
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [ebp + 8], al
push dword [ebp + 8]
mov eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.1004516a
mov byte [ebp - 4], 2
mov eax, dword [edi + 4]
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp eax, ecx
jle 0x100455f8
mov edx, dword [ebp - 0x2c]
cmp dword [ebp + 8], 0
jl 0x10045667
cmp dword [ebp + 8], eax
jge 0x10045667
mov esi, dword [edi]
cmp edx, dword [ecx + esi]
je 0x10045629
inc dword [ebp + 8]
add ecx, 0x14
cmp dword [ebp + 8], eax
jl 0x100455d3
lea eax, [ebp - 0x2c]
push eax
mov esi, edi
call fcn.1005b439
lea esi, [ebp - 0x2c]
call fcn.10045672
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [ebx - 0x10]
call fcn.1007924a
xor eax, eax
inc eax
call fcn.10087296
ret 4
mov esi, dword [ebp + 8]
cmp esi, eax
jge 0x10045667
imul esi, esi, 0x14
add esi, dword [edi]
mov eax, dword [esi]
sub eax, edx
jne 0x10045659
cmp byte [esi + 0xc], al
setne al
xor ecx, ecx
cmp byte [ebp - 0x20], cl
setne cl
sub eax, ecx
jne 0x10045659
push dword [ebp - 0x24]
add esi, 8
push esi
call fcn.100583c3
test eax, eax
jns 0x10045603
push dword [ebp + 8]
call fcn.1005b4ca
jmp 0x100455f8
call fcn.10077bf4
int3