joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100af16d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8d5f
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
push 0x100dc7f4
lea ecx, [ebp - 0x440]
call fcn.1000173d
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x448]
add eax, 4
push eax
lea ecx, [ebp - 0x440]
call fcn.100017d6
push 0x100dc7f8
lea ecx, [ebp - 0x440]
call fcn.10009426
push 0x100dc7fc
lea ecx, [ebp - 0x440]
call fcn.10009426
push dword [ebp + 8]
lea ecx, [ebp - 0x440]
call fcn.10009426
lea ecx, [ebp - 0x440]
call fcn.100094ad
push eax
push 0x208
push section.DLLShare
call fcn.100773e4
add esp, 0xc
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [0x101157c4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x100dc800
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.1007d1ad
add esp, 0xc
and word [ebp - 0x424], 0
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.100bb018
add esp, 0x14
mov dword [ebp - 0x444], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.100017ab
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret 4
Function at 0x100af301
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8da8
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x228]
call fcn.100223dd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.100223dd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10014b4b
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x100af3a3
push 0x100dc368
lea ecx, [ebp - 0x228]
call fcn.10017843
push eax
push dword [0x1011116c]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
push 0x100dc390
lea ecx, [ebp - 0x230]
call fcn.10017843
push eax
push dword [0x10111168]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
lea ecx, [ebp - 0x228]
call fcn.10005b69
push eax
lea ecx, [ebp - 0x22c]
call fcn.10003c7e
push 0x100dc3a0
lea ecx, [ebp - 0x22c]
call fcn.1000e4d2
lea ecx, [ebp - 0x230]
call fcn.10005b69
push eax
lea ecx, [ebp - 0x22c]
call fcn.1000e4d2
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10005b69
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x20a
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x22c]
call fcn.10005b69
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x100dc3a4
lea eax, [ebp - 0x224]
push eax
push 0x277e
push dword [0x101157c4]
call fcn.100acba3
add esp, 0x14
lea eax, [ebp - 0x224]
push eax
call fcn.1003cb65
mov ecx, eax
call fcn.1003c059
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10014be9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1000ef49
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000ef49
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100af4ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x40]
call fcn.1003c3b6
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.1000e515
and dword [ebp - 0x20], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x54], eax
push 0
push str.EnableExePackUac
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
je 0x100af5f0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
push 0x100ab3ab
push 0
push 0
call fcn.1007b853
add esp, 0x18
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x100af5e7
push 0x64
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x100af5b1
jmp 0x100af5de
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x3c], 1
jne 0x100af5d9
cmp dword [0x101157b8], 0
jne 0x100af5d9
mov ecx, dword [ebp - 0x50]
call fcn.100a95ce
test eax, eax
je 0x100af5d9
mov dword [0x101157b8], 1
xor eax, eax
inc eax
jne 0x100af599
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1003c3ca
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret 4
Function at 0x100b0202
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c9373
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0x100dc5a8
lea ecx, [ebp - 0x48]
call fcn.1000173d
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.100017d6
push 0x100dc5ac
lea ecx, [ebp - 0x48]
call fcn.10009426
push 0x100dc5b0
lea ecx, [ebp - 0x48]
call fcn.10009426
push dword [ebp + 8]
lea ecx, [ebp - 0x48]
call fcn.10009426
lea ecx, [ebp - 0x48]
call fcn.100094ad
push eax
call fcn.100ac14c
pop ecx
test eax, eax
jne 0x100b029d
and dword [ebp - 0x4c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017ab
mov eax, dword [ebp - 0x4c]
jmp 0x100b03ab
mov ecx, dword [ebp - 0x5c]
call fcn.100afd12
test eax, eax
jne 0x100b02c1
and dword [ebp - 0x50], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017ab
mov eax, dword [ebp - 0x50]
jmp 0x100b03ab
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.100094ad
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b02ef
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.100094ad
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100dc5b4
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.100094ad
push eax
push 0x277f
push dword [0x101157c4]
call fcn.100acba3
add esp, 0x14
test eax, eax
jne 0x100b0331
and dword [ebp - 0x54], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017ab
mov eax, dword [ebp - 0x54]
jmp 0x100b03ab
push 0x100dc5c8
mov eax, dword [ebp - 0x5c]
add eax, 0xcc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000ee89
add esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0x100dc5d8
lea ecx, [ebp - 0x2c]
call fcn.100094ad
push eax
push 0x451
push dword [0x101157c4]
call fcn.100acba3
add esp, 0x14
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.100094ad
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.100ac2f1
mov dword [ebp - 0x58], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017ab
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret 4
Function at 0x100b43bf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0x78
call fcn.1000e515
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.10005b69
test eax, eax
je 0x100b4436
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x18], eax
push 0
push 0x100dc528
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call dword [eax + 0x18]
cmp eax, 0x64
jne 0x100b4436
mov eax, dword [0x1011f014]
dec eax
mov dword [0x1011f014], eax
cmp dword [0x1011f014], 0xffffffff
jne 0x100b4436
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1011f018], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.10005b69
test eax, eax
je 0x100b4473
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x1c], eax
push 0
push 0x100dc534
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100b4473
call fcn.1003bdfe
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x20], eax
push 0
push str.EnableLsp
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call dword [eax + 0x20]
cmp dword [0x101157bc], 0
je 0x100b44c6
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc], esp
push 0x100dc54c
call fcn.10001465
push 0
push 0x3e8
push 0
push 0x2541
mov ecx, 0x101158b0
call fcn.100bbf7d
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp - 0x14]
push 0x100b41bd
push 0
push 0
call fcn.1007b853
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
call fcn.10042e7c
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
add ecx, 0x74
call fcn.1003acef
lea ecx, [ebp - 0x10]
call fcn.100254b5
mov ecx, dword [ebp - 0x14]
add ecx, 0x74
call fcn.10005b69
test eax, eax
je 0x100b4537
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x94
call fcn.10005b69
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x98]
jmp 0x100b4539
xor eax, eax
leave
ret 4
Function at 0x100b47cb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, 0x101158b0
call fcn.100bb429
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x6c], eax
mov ecx, dword [ebp - 0x14]
call fcn.100ac65f
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], eax
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x100b480d
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0x4c
call fcn.1000e515
push dword [ebp - 0x14]
call fcn.1001602c
mov ecx, eax
call fcn.100ae9a4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x40], 0
jbe 0x100b484b
push 0
push 0
push dword [ebp - 0x14]
push 0x100b47aa
push 0
push 0
call fcn.1007b853
add esp, 0x18
mov dword [ebp - 8], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b4886
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x6c], 0
je 0x100b485e
mov ecx, 0x101158b0
call fcn.100bb344
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100b4882
push 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x100b4886
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x100b488d
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0xc], eax
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100b495b
and dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x118], 0x100
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.KAVINSTALLNEEDREBOOT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100b494b
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.KAV7NEEDREBOOT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b4952
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100b496a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x228], 0
and dword [ebp - 0x224], 0
and dword [ebp - 0x230], 0
and dword [ebp - 0x220], 0
and dword [ebp - 0x218], 0
and dword [ebp - 0x22c], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 4], 0
or dword [ebp - 0x21c], 0xffffffff
and dword [ebp - 0x214], 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x100b49fc
xor eax, eax
jmp 0x100b4a8d
push dword [ebp - 0x230]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x100b4a1e
xor eax, eax
jmp 0x100b4a8d
push dword [ebp - 0x230]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x100b4a40
xor eax, eax
jmp 0x100b4a8d
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x100b4a5f
xor eax, eax
jmp 0x100b4a8d
push dword [ebp + 8]
push dword [ebp - 0x218]
call fcn.1003ad41
pop ecx
pop ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x228], eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100b5164
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x14], ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
push dword [ebp - 0x10]
push 0x100b5057
push 0
push 0
call fcn.1007b853
add esp, 0x18
push eax
lea ecx, [ebp - 0xc]
call fcn.10042e7c
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1003acef
lea ecx, [ebp - 0xc]
call fcn.100254b5
mov ecx, dword [ebp - 0x10]
call fcn.10005b69
neg eax
sbb eax, eax
neg eax
leave
ret 8
Function at 0x100b5d08
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push 0x100e3da4
push 1
push 0
push 0x100e3d94
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x100b5d45
jmp 0x100b5d72
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [ebp - 8]
call dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x100b5d61
jmp 0x100b5d72
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 4]
call dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x100b5d83
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 4]
call dword [eax + 8]
cmp dword [ebp - 8], 0
je 0x100b5d94
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [ebp - 8]
call dword [eax + 8]
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x100b6d22
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
call fcn.10003bb7
cmp eax, 2
jge 0x100b6d3d
xor eax, eax
jmp 0x100b6da0
push 2
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003cf4
and dword [ebp - 8], 0
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.10005b69
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 4], 0
ja 0x100b6d8e
jb 0x100b6d7d
cmp dword [ebp - 8], 0x6400000
jae 0x100b6d8e
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0xc]
call fcn.10014be9
mov eax, dword [ebp - 0x10]
jmp 0x100b6da0
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0xc]
call fcn.10014be9
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 4
Function at 0x100b929c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100b934d
push dword [ebp - 4]
call fcn.10076ac2
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100b933a
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100df3c8
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100b933a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.1007a47b
pop ecx
and dword [ebp - 8], 0
xor eax, eax
inc eax
jmp 0x100b934f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call fcn.1007a47b
pop ecx
and dword [ebp - 8], 0
xor eax, eax
leave
ret
Function at 0x100baf53
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
and word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.100771d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x100df248
push 0x100df260
call fcn.100bec1f
add esp, 0xc
test eax, eax
je 0x100bafed
lea eax, [ebp - 0x218]
push eax
call fcn.10077b0b
pop ecx
test eax, eax
jbe 0x100bafed
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100bafed
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000173d
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
jmp 0x100bb00c
push 0x100df294
mov ecx, dword [ebp + 8]
call fcn.1000173d
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100771ba
leave
ret

Function at 0x100bb018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c881e
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x70], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x100bb050
cmp dword [ebp + 0xc], 0
jne 0x100bb057
xor eax, eax
jmp 0x100bb156
and dword [ebp - 0x6c], 0
push 0x40
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 0x1c], 0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x81
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 5
mov word [ebp - 0x3c], ax
push 0x100df1b8
lea ecx, [ebp - 0x8c]
call fcn.1000173d
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x8c]
call fcn.10009426
push 0x100df1bc
lea ecx, [ebp - 0x8c]
call fcn.10009426
push 0x100df1c0
lea ecx, [ebp - 0x8c]
call fcn.10009426
push dword [ebp + 0xc]
lea ecx, [ebp - 0x8c]
call fcn.10009426
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x10]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x8c]
call fcn.100094ad
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100bb138
cmp dword [ebp + 0x18], 0
je 0x100bb126
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x90], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.100017ab
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x70]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bc6d7
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
cmp dword [0x1011572c], 0
je 0x100bc71c
push dword [ebp - 4]
push dword [0x1011572c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100bc709
push 0xffffffffffffffff
push dword [0x1011572c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x1011572c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x1011572c], 0
cmp dword [0x10115734], 0
je 0x100bc738
push dword [0x10115734]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x10115734], 0
leave
ret