joyce8/EMBER2024-capa huggingface dataset:
Function at 0xeded7d
Capabilities:
Encode data using xor

Disassembly:
cmp bl, ch
mov dword [ebp - 0x10], ecx
clc
add cx, 0x12b7
bsf cx, bx
rcl ch, cl
mov ecx, dword [ebp + 0xc]
mov byte [esp], 0xbe
bt sp, 7
test dl, dh
cmp ecx, 0xffff
call fcn.0192e5a0
mov dl, 0x89
xchg byte [esi + 0x17e84a71], dl
sahf
xor eax, 0x57c0d017
pushfd
movsd dword es:[edi], dword [esi]
pop esi
sti
and dword [edx - 0x3f], 0x80bd08c
aaa
nop
push ebx
fimul word [esi - 0x53]
cmpsb byte [esi], byte es:[edi]
mov edi, 0x8c2ccb50
cmc
and eax, 0xdb64b9e2
aad 0x62
sub al, 0xe7
sbb byte [edi - 0x5f], ch
cmc
sal dword [esi + 0x56], 0xed
rcl dword [esi - 0x7b]
xor bl, ah
jge fcn.00eded7d
adc eax, 0xb141653
dec edx
inc esi
add ebx, edx
idiv dword [edx + 0x7129db10]
out dx, al
shr eax, cl
pushfd
stosd dword es:[edi], eax
sbb esp, dword [0xe18468e1]
das
rcr byte [eax + edi + 9], 1
invalid

Function at 0x1980c52
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx - 0x59]
aas
and byte [edi - 5], ch
imul eax, ebp, 0x16
out dx, al
invalid
je 0x1980be9
push ds
push edi
scasb al, byte es:[edi]
dec dword [eax]
mov eax, dword [0xd4b76c72]
pop ebx
pushal
cmp al, 0xfd
std
invalid
inc eax
push edi
fidivr word [ecx - 0x121df1bd]
rcl esi, 0x6b
cmp ch, cl
mov cl, 0x84
outsd dx, dword [esi]
mov ebp, 0xda7bc899
movsb byte es:[edi], byte [esi]
push ebx
jge 0x1980bb7
lcall 0x651a, 0xe51b7259
pop eax
js 0x1980ca6
jne 0x1980c9f
jl 0x1980bda
push ebx
in al, dx
xor al, 0x97
cmpsd dword [esi], dword es:[edi]
push eax
stosb byte es:[edi], al
pop edx
popal
out 0x16, eax
push ss
arpl word [ecx + 0x59c740b0], sp
xchg esi, eax
outsb dx, byte [esi]
call fcn.00ef44ce
cmc
insb byte es:[edi], dx
mov dword [0xe93f9073], eax
jp 0x1980c18
xor dword [edx - 5], 0xa093fd58
add byte [ebx], cl
and edx, ebx
jns 0x1980c2d
jl 0x1980cd2
mov al, 0x99
ret
push edx
sub al, ch
mov al, byte [eax]
push ecx
jno 0x1980c49
cmp dword [ebp + esi*4 + 0x664b3d14], 0x40
adc al, 0x3d
dec ebx
inc ax
loop 0x1980ce3
scasb al, byte es:[edi]
adc edx, eax
scasb al, byte es:[edi]
pop ecx
or eax, dword [eax - 0x3f197b9]
movsb byte es:[edi], byte [esi]
jmp 0x1980c94
loopne 0x1980cba
ret 0x77ec
in al, dx
ja fcn.01980c52
mov edi, 0x11fb261d
in eax, dx
sbb eax, 0xed11fb26
pop eax
in al, dx
test dword [esi - 0x6966ca26], edx
mov byte [ebx + 0x469b8483], bh
fimul dword [ecx]
cmc
mov edx, 0x7754a31d
mov ch, dh
sbb eax, 0xf27754a3
mov ch, dh
cli
in eax, 0x73
test byte [ebx - 0x3e], bh
jo 0x1980cb3
xor al, 0xbc
movsb byte es:[edi], byte [esi]
pop ebx
add byte [ebx - 0x11f56104], al
arpl word [edx + ebp*2 + 0x7494b3d6], dx
xor al, 0x45
xchg esp, eax
push 0xffffffffffffffd6
mov bl, 0x94
je 0x1980d27
inc ebp
mov bl, 0xf2
aam 0xf2
xchg ecx, eax
jg 0x1980d51
jl 0x1980cb6
adc eax, edx
sbb ebp, edi
cmpsd dword [esi], dword es:[edi]
in eax, 0x74
xchg esi, eax
arpl word [edi + edx*2 - 0x1b93b6b], dx
cmp al, 9
ror dword [0x922edbd0], 1
jne 0x1980cec
popal
fisubr word [edi]
outsb dx, byte [esi]
mov edx, cs
invalid
xchg ecx, eax
aas
jmp 0xdddff167
call 0x3b8782eb
inc ebp
add byte [ecx - 0x1a], 0xc6
jle 0x1980d63
mov cl, 0x5a
imul byte [ecx]
cmpsd dword [esi], dword es:[edi]
push eax
int1
invalid
Function at 0x10004a30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x14]
call fcn.10004780
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.100049c0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10004a9b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x124], edx
lea ecx, [ebp - 0x14]
call fcn.100047b0
mov eax, dword [ebp - 0x124]
jmp 0x10004b2c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10004b01
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x14]
call fcn.10004a30
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10004af8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x128], edx
lea ecx, [ebp - 0x14]
call fcn.100047b0
mov eax, dword [ebp - 0x128]
jmp 0x10004b2c
mov dword [ebp - 4], 0x100
jmp 0x10004aa2
lea ecx, [ebp - 0x14]
call fcn.100048f0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x130]
call fcn.10004830
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x14]
call fcn.100047b0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret 4
Function at 0x10005230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x10005239
xor ecx, ecx
jne 0x10005239
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x1000525a
mov eax, 0xd
jmp 0x10005286
xor eax, eax
jne 0x10005241
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10005290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x10005299
xor ecx, ecx
jne 0x10005299
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x100052ba
mov eax, 0xd
jmp 0x1000530f
xor eax, eax
jne 0x100052a1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 1
jne 0x100052cb
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8

Function at 0x10006790
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100067bf
xor eax, eax
jmp 0x10006862
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
ja 0x1000682d
cmp dword [ebp - 8], 0x1000000
jae 0x1000682d
mov eax, dword [ebp - 8]
push eax
call fcn.1003ad09
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000682d
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000682d
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
je 0x1000684d
cmp dword [ebp - 0xc], 0
je 0x1000683f
mov eax, dword [ebp - 0xc]
push eax
call fcn.1003add3
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10006862
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10006b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 8]
call fcn.10006950
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x10007b30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006bdd
mov ecx, dword [ebp - 8]
call fcn.10006970
xor eax, eax
jmp 0x10006bec
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x10010750
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x14], 0
je 0x10010764
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
jmp 0x1001076d
mov ecx, dword [0x100629e0]
mov dword [ebp - 8], ecx
push 0x10067a90
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10010ad0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.1003ac40
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.wd.ini
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10010b6b
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0x10067b98
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [0x10067c9b], 0
mov dword [ebp - 4], 0x400
mov edx, dword [ebp - 4]
push edx
call fcn.100324f4
add esp, 4
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10010c42
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x1005369c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 4]
sub ecx, 2
cmp dword [ebp - 0x124], ecx
jb 0x10010c22
mov edx, dword [ebp - 8]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x12c]
push eax
call fcn.1003a08b
add esp, 4
cmp dword [ebp - 4], 0x7fff
jb 0x10010bed
xor eax, eax
jmp 0x10010c94
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x7fff
jbe 0x10010c05
mov dword [ebp - 4], 0x7fff
mov edx, dword [ebp - 4]
push edx
call fcn.100324f4
add esp, 4
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 8], eax
jmp 0x10010c3d
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x124]
mov byte [ecx], 0
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x124]
mov byte [edx + 1], 0
jmp 0x10010c42
jmp 0x10010b8d
mov eax, dword [ebp - 8]
push eax
call fcn.10010a20
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
push edx
call fcn.1003a08b
add esp, 4
push 0x100536a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10010c91
push str.IsTraystupidRealRunning
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10067c9c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret
Function at 0x100110d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1005378c]
mov dword [ebp - 0x154], eax
mov ecx, dword [0x10053790]
mov dword [ebp - 0x150], ecx
mov edx, dword [0x10053794]
mov dword [ebp - 0x14c], edx
lea eax, [ebp - 0x154]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x158]
mov al, byte [edx]
mov byte [ebp - 0x15d], al
add dword [ebp - 0x158], 1
cmp byte [ebp - 0x15d], 0
jne 0x10011121
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x164], ecx
push 0x849
mov edx, dword [ebp - 0x164]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.10010d00
add esp, 0xc
mov ecx, dword [0x10053798]
mov dword [ebp - 0x144], ecx
mov edx, dword [0x1005379c]
mov dword [ebp - 0x140], edx
mov eax, dword [0x100537a0]
mov dword [ebp - 0x13c], eax
mov cl, byte [0x100537a4]
mov byte [ebp - 0x138], cl
lea edx, [ebp - 0x144]
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0x168]
add eax, 1
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x168]
mov dl, byte [ecx]
mov byte [ebp - 0x16d], dl
add dword [ebp - 0x168], 1
cmp byte [ebp - 0x16d], 0
jne 0x100111b6
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
push 0x849
mov ecx, dword [ebp - 0x174]
push ecx
lea edx, [ebp - 0x144]
push edx
call fcn.10010d00
add esp, 0xc
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x100112aa
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001129d
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001127a
cmp dword [ebp + 8], 0
jne 0x10011286
lea ecx, [ebp - 0x144]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10011286
mov dword [ebp - 0x148], 1
jmp 0x1001129d
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10011244
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret
Function at 0x100113d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x104
mov ecx, 6
mov esi, 0x100537a8
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xd3a
push 0x1a
lea eax, [ebp - 0x20]
push eax
call fcn.10010d00
add esp, 0xc
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x170]
push edx
lea eax, [ebp - 0x28]
push eax
push str.ExeString
lea ecx, [ebp - 0x20]
push ecx
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10011456
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10011456
mov eax, 1
jmp 0x100114c8
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x104
mov ecx, 0xf
mov esi, 0x100537d0
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xd3c
push 0x3d
lea eax, [ebp - 0x68]
push eax
call fcn.10010d00
add esp, 0xc
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x170]
push edx
lea eax, [ebp - 0x28]
push eax
push 0x100537c2
lea ecx, [ebp - 0x68]
push ecx
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100114c6
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100114c6
mov eax, 1
jmp 0x100114c8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret
Function at 0x100114e0
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 0
push 0
push 0x26
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x1001151b
xor eax, eax
jmp 0x100116a9
mov ecx, dword [0x10053810]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x10053814]
mov dword [ebp - 0x14], edx
mov eax, dword [0x10053818]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1005381c]
mov dword [ebp - 0xc], ecx
mov dl, byte [0x10053820]
mov byte [ebp - 8], dl
mov eax, dword [0x10053824]
mov dword [ebp - 0x130], eax
mov ecx, dword [0x10053828]
mov dword [ebp - 0x12c], ecx
mov edx, dword [0x1005382c]
mov dword [ebp - 0x128], edx
mov ax, word [0x10053830]
mov word [ebp - 0x124], ax
push 0xd3e
push 0x11
lea ecx, [ebp - 0x18]
push ecx
call fcn.10010d00
add esp, 0xc
push 0xd3e
push 0xe
lea edx, [ebp - 0x130]
push edx
call fcn.10010d00
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x10053834
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x380]
push ecx
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
je 0x100116a3
mov eax, dword [ebp - 0x380]
and eax, 0x10
jne 0x100115fe
jmp 0x1001167a
movsx ecx, byte [ebp - 0x354]
cmp ecx, 0x2e
jne 0x1001162e
movsx edx, byte [ebp - 0x353]
test edx, edx
je 0x1001162c
movsx eax, byte [ebp - 0x353]
cmp eax, 0x2e
jne 0x1001162e
movsx ecx, byte [ebp - 0x352]
test ecx, ecx
jne 0x1001162e
jmp 0x1001167a
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x488]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x488]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1001167a
mov dword [ebp - 0x23c], 1
jmp 0x10011696
lea edx, [ebp - 0x380]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100115f1
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret
Function at 0x100116c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10053838]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x1005383c]
mov dword [ebp - 0x140], ecx
mov edx, dword [0x10053840]
mov dword [ebp - 0x13c], edx
mov ax, word [0x10053844]
mov word [ebp - 0x138], ax
push 0xd3e
push 0xe
lea ecx, [ebp - 0x144]
push ecx
call fcn.10010d00
add esp, 0xc
mov edx, dword [0x10053848]
mov dword [ebp - 0x154], edx
mov eax, dword [0x1005384c]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10053850]
mov dword [ebp - 0x14c], ecx
mov dl, byte [0x10053854]
mov byte [ebp - 0x148], dl
push 0xd3e
push 0xd
lea eax, [ebp - 0x154]
push eax
call fcn.10010d00
add esp, 0xc
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x10011807
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100117fa
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100117d7
cmp dword [ebp + 8], 0
jne 0x100117e3
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100117e3
mov dword [ebp - 0x158], 1
jmp 0x100117fa
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100117a1
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret

Function at 0x10012920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10012960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012957
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10014f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x100629ec]
test eax, eax
jne 0x10014f55
xor eax, eax
jmp 0x10015061
push 0x10053b0c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x10014f6f
xor eax, eax
jmp 0x10015061
push 0x104
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.1003ac40
add esp, 0xc
push str.wdres.dll
push 0x10068170
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x110]
push ecx
call fcn.10016770
add esp, 4
test eax, eax
jne 0x10014fb6
xor eax, eax
jmp 0x10015061
push 0x12c
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.1003ac40
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push str.res:___s_blank.htm
push 0x12c
lea ecx, [ebp - 0x248]
push ecx
call fcn.10016600
add esp, 0x10
push 0x12c
push 0
lea edx, [ebp - 0x378]
push edx
call fcn.1003ac40
add esp, 0xc
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x118], 0x12c
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x378]
push ecx
lea edx, [ebp - 0x114]
push edx
push str.safe
push str.SOFTWAREMicrosoftInternet_ExplorerAboutURLs
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001505c
xor eax, eax
jmp 0x10015061
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret