joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d330
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, str.s.360.cn
push esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d347
sub eax, edx
cmp eax, 0x100
ja 0x1002d392
push str.s.360.cn
lea ecx, [edi + 4]
mov edx, pe_nt_image_headers32
call fcn.1002d550
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d392
push str.s.360.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1002d3a4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10079a05
add esp, 0x18
ret
mov ecx, 2
mov word [esp + 4], cx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push 0x50
mov dword [esp + 0xc], ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 8]
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1002d38b
mov ecx, dword [esp + 0x14]
mov dword [edi], esi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10079a05
add esp, 0x18
ret

Function at 0x1002d660
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
push edi
xor ebx, ebx
mov dword [esp + 0x18], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
je 0x1002d6e4
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x10]
mov ebx, eax
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x1009f590
push ebx
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
mov ebp, eax
test ebp, ebp
je 0x1002d6d3
cmp dword [esp + 0x14], 0
je 0x1002d6d3
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1002d6d3
mov edi, dword [esp + 0x20]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x1002e7c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x824
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
mov ebx, dword [esp + 0x82c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call fcn.1007dcf0
add esp, 0xc
test ebx, ebx
je 0x1002e9c5
push esi
push 0x208
push 0
push ebx
call fcn.1007dcf0
add esp, 0xc
lea edx, [esp + 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x210]
push eax
call esi
test eax, eax
jne 0x1002e853
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.10079a05
add esp, 0x824
ret
push ebp
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1a]
push edx
mov word [esp + 0x1c], cx
call fcn.1007dcf0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call edi
lea ecx, [esp + 0x10]
push ecx
call esi
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1002e8ec
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x1002e8ec
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360ini.dll
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 1
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.10079a05
add esp, 0x824
ret
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x42a]
push edx
mov word [esp + 0x42c], cx
call fcn.1007dcf0
add esp, 0xc
lea eax, [esp + 0x420]
push 0x104
push eax
call fcn.10048200
push eax
call edi
lea ecx, [esp + 0x420]
push ecx
call esi
test eax, eax
je 0x1002e952
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x424]
push eax
call ebp
test eax, eax
jne 0x1002e952
lea ecx, [esp + 0x420]
push ecx
jmp 0x1002e8c7
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x632]
push eax
mov word [esp + 0x634], dx
call fcn.1007dcf0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x62c]
push ecx
push str.360ini.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
lea edx, [esp + 0x628]
push edx
call esi
test eax, eax
je 0x1002e9be
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x62c]
push ecx
call ebp
test eax, eax
jne 0x1002e9be
lea edx, [esp + 0x628]
push edx
jmp 0x1002e8c7
xor eax, eax
jmp 0x1002e8d3
mov ecx, dword [esp + 0x824]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x824
ret
Function at 0x1002e9e0
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x628
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
push ebp
push edi
mov edi, dword [0x100dee3c]
xor ebp, ebp
test edi, edi
je 0x1002eba6
test esi, esi
je 0x1002eba6
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
call ebx
test eax, eax
je 0x1002eba6
push edi
call fcn.1002e670
add esp, 4
test eax, eax
je 0x1002eba6
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.1007dcf0
lea edx, [esp + 0x1c]
add esp, 0xc
push edx
call fcn.1002e7c0
add esp, 4
test eax, eax
je 0x1002eba6
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002eb8f
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x222]
push edx
mov word [esp + 0x224], cx
call fcn.1007dcf0
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
call edi
push 0x1009f82c
lea edx, [esp + 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x218]
push eax
call ebx
test eax, eax
je 0x1002ead7
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1002eb8f
mov cx, word [esp + 0x10]
cmp cx, word [esi]
jne 0x1002eb11
push 5
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, eax
jmp 0x1002eba6
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x42a]
push ecx
mov word [esp + 0x42c], ax
call fcn.1007dcf0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x424]
push eax
call edi
lea ecx, [esp + 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Internet360Ini.dll
lea edx, [esp + 0x424]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [esp + 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1002eba6
push 5
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, eax
jmp 0x1002eba6
push 0
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1002eba6
mov ebp, 1
mov ecx, dword [esp + 0x62c]
pop edi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x628
ret
Function at 0x1002ef90
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
mov ebx, dword [esp + 0x23c]
push ebp
push esi
xor ebp, ebp
push ebp
push 2
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1002f063
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1002f040
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push edi
lea ecx, [esp + 0x38]
push ecx
call ebp
test eax, eax
je 0x1002f038
cmp dword [esp + 0x248], 0
jne 0x1002f006
push ebx
lea edx, [esp + 0x38]
push edx
call ebp
test eax, eax
je 0x1002f038
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002efe4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10079a05
add esp, 0x234
ret
mov dword [esp + 0xc], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10079a05
add esp, 0x234
ret
mov ecx, dword [esp + 0x23c]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x234
ret
Function at 0x1002f0c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x128]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x120]
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
push edi
mov edx, esi
call fcn.1002f080
mov eax, dword [esp + 0x134]
push ebx
mov edx, esi
call fcn.1002f080
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x140]
push ecx
mov edx, esi
call fcn.1002f080
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x101
xor esi, esi
push esi
push edi
push ebp
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002f19e
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push esi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002f18f
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x1002f18f
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002f18f
mov esi, 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1002f207
lea ecx, [esp + 0xc]
push ecx
push 0x201
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002f207
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002f1fc
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x1002f1fc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002f1fc
mov esi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x114
ret
Function at 0x1002f670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x120
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
mov ebx, dword [esp + 0x130]
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x134]
push edi
mov edx, esi
call fcn.1002f080
mov eax, dword [esp + 0x140]
add esp, 4
push ebx
mov edx, esi
call fcn.1002f080
mov eax, dword [esp + 0x148]
add esp, 4
push ebp
mov edx, esi
call fcn.1002f080
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], 0x104
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1002f72f
push ebp
lea ecx, [esp + 0x20]
call fcn.1002f230
add esp, 4
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.10079a05
add esp, 0x120
ret
mov ecx, dword [esp + 0x128]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x120
ret
Function at 0x1002fd20
Capabilities:
Check if file exists
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x428]
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, ecx
mov edx, 4
push edi
push esi
lea eax, [edx + 0x1f]
call fcn.1002f080
mov edx, 4
push ebp
lea eax, [edx + 7]
call fcn.1002f080
mov edx, 4
push ebx
lea eax, [edx + 4]
call fcn.1002f080
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20019
xor edi, edi
push edi
push esi
push connect
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002fe77
mov eax, dword [esp + 0x10]
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push esi
push esi
lea edx, [esp + 0x38]
push edx
push esi
push esi
push esi
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1002fe77
cmp dword [esp + 0x14], esi
jbe 0x1002fe77
test edi, edi
jne 0x1002fe77
push 0x1ff
lea ecx, [esp + 0x2d]
push edi
push ecx
mov byte [esp + 0x34], 0
call fcn.1007dcf0
add esp, 0xc
mov eax, 0x200
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push edi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1002fe6c
push 0xa
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.1008df4c
add esp, 0xc
test eax, eax
jne 0x1002fe6c
push ebx
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x1002fe6c
lea ecx, [esp + 0x228]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002fe6c
mov edi, 1
inc esi
cmp esi, dword [esp + 0x14]
jb 0x1002fdd4
mov ecx, dword [esp + 0x428]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x41c
ret
Function at 0x1002fea0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push esi
push edi
mov edi, edx
mov esi, ecx
xor edx, edx
push esi
lea eax, [edx + 0x14]
call fcn.1002f080
xor edx, edx
push edi
lea eax, [edx + 5]
call fcn.1002f080
xor edx, edx
push ebx
lea eax, [edx + 0x12]
call fcn.1002f080
xor edx, edx
push ebp
lea eax, [edx + 0x11]
call fcn.1002f080
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push esi
push connect
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1002ff8a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x120]
push 0x104
push ecx
call fcn.1007b5fd
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push edx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002ff6d
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x1002ff6d
mov eax, 1
jmp 0x1002ff8c
push ebp
lea ecx, [esp + 0x120]
push ecx
call esi
test eax, eax
je 0x1002ff8a
lea edx, [esp + 0x11c]
push edx
call edi
test eax, eax
jne 0x1002ff66
xor eax, eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x214
ret

Function at 0x1002ffb0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x120]
push esi
mov edx, ebx
call fcn.1002f080
mov eax, dword [esp + 0x120]
push edi
mov edx, ebx
call fcn.1002f080
add esp, 8
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push edi
push esi
push connect
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop ebx
test eax, eax
jne 0x10030047
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10030047
mov eax, 1
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10079a05
add esp, 0x110
ret
mov ecx, dword [esp + 0x10c]
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x110
ret
Function at 0x100300f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x1a4], eax
push ebx
push ebp
push esi
push edi
mov ecx, 6
mov esi, 0x100a0aac
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x104
lea esi, [esp + 0x18]
mov ecx, 0xd3a
mov edi, 0xd
jmp 0x10030140
mov dl, byte [esi]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
and eax, 0x7fff
movzx ebx, dl
sub dl, al
add ecx, 0x269ec3
mov byte [esi], dl
mov dl, byte [esi + 1]
mov eax, ecx
shr eax, 0x10
and eax, 0x7fff
movzx ebx, dl
sub dl, al
mov byte [esi + 1], dl
add esi, 2
sub edi, 1
jne 0x10030140
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.ExeString
lea eax, [esp + 0x28]
push eax
push connect
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100301d3
lea ecx, [esp + 0xb0]
push ecx
call ebp
test eax, eax
je 0x100301d3
mov eax, 1
jmp 0x10030317
push 0x104
lea edx, [esp + 0xb4]
push 0
push edx
call fcn.1007dcf0
mov ecx, 0xf
mov esi, 0x100a0ad4
lea edi, [esp + 0x40]
lea eax, [esp + 0x40]
add esp, 0xc
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x104
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10030211
lea ecx, [esp + 0x34]
sub eax, edx
push ecx
mov edx, 0xd3c
call fcn.1002f080
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x100a0d42
lea edx, [esp + 0x44]
push edx
push connect
call ebx
test eax, eax
jne 0x10030265
lea eax, [esp + 0xb0]
push eax
call ebp
test eax, eax
jne 0x100301c9
push 0x104
lea ecx, [esp + 0xb4]
push 0
push ecx
call fcn.1007dcf0
mov ecx, 0xf
mov esi, 0x100a0b10
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
add esp, 0xc
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x104
lea edx, [esp + 0x70]
mov esi, 0xd3c
mov edi, 0x3d
jmp 0x100302b0
mov cl, byte [edx]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov eax, esi
shr eax, 0x10
and eax, 0x7fff
movzx ebp, cl
sub cl, al
mov byte [edx], cl
inc edx
sub edi, 1
jne 0x100302b0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x100a0d42
lea edx, [esp + 0x80]
push edx
push connect
call ebx
test eax, eax
jne 0x10030315
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100301c9
xor eax, eax
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x1a8
ret
Function at 0x10030770
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x138
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x134], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x3d]
push 0
push eax
mov byte [esp + 0x44], 0
call fcn.1007dcf0
mov eax, dword [0x100a0bac]
mov edx, dword [0x100a0ba8]
add esp, 0xc
mov ecx, 7
mov esi, 0x100a0b88
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x100a0ba4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
pop edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], ecx
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100307e5
lea ecx, [esp + 0x14]
sub eax, edx
push ecx
mov edx, 0x837
call fcn.1002f080
lea eax, [esp + 0xc]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10030807
sub eax, edx
lea edx, [esp + 8]
push edx
mov edx, 0x844
call fcn.1002f080
add esp, 4
lea eax, [esp]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0xc]
push edx
push str.ProgramPath
lea eax, [esp + 0x24]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10030889
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x34]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
test eax, eax
je 0x10030889
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10030889
mov eax, 1
mov ecx, dword [esp + 0x134]
xor ecx, esp
call fcn.10079a05
add esp, 0x138
ret
mov ecx, dword [esp + 0x134]
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x138
ret
Function at 0x100308a0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
sub esp, 0x35c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x358], eax
push 0x103
lea eax, [esp + 0x259]
push 0
push eax
mov byte [esp + 0x260], 0
call fcn.1007dcf0
push 0x103
lea ecx, [esp + 0x5d]
push 0
push ecx
mov byte [esp + 0x64], 0
call fcn.1007dcf0
push 0x103
lea edx, [esp + 0x16d]
push 0
push edx
mov byte [esp + 0x174], 0
call fcn.1007dcf0
add esp, 0x24
push 0
push 0x26
lea eax, [esp + 0x25c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x10030932
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.10079a05
add esp, 0x35c
ret
mov eax, dword [0x100a0bac]
mov edx, dword [0x100a0ba8]
push esi
push edi
mov ecx, 7
mov esi, 0x100a0bbc
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, 9
mov esi, 0x100a0bd8
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x100a0ba4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10030978
lea ecx, [esp + 0x14]
sub eax, edx
push ecx
mov edx, 0x844
call fcn.1002f080
lea eax, [esp + 0x34]
add esp, 4
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100309a0
sub eax, edx
lea edx, [esp + 0x30]
push edx
mov edx, 0x844
call fcn.1002f080
lea eax, [esp + 0xc]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100309c2
lea ecx, [esp + 8]
push ebp
sub eax, edx
push ecx
mov edx, 0x844
call fcn.1002f080
add esp, 4
lea edx, [esp + 0x260]
push edx
mov edx, 0x104
lea ecx, [esp + 0x5c]
call fcn.1002d550
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x5c]
push ecx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x164]
push ecx
call edi
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x15c]
push edx
call ebp
test eax, eax
je 0x10030a51
pop ebp
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.10079a05
add esp, 0x35c
ret
push 0x104
lea eax, [esp + 0x160]
push 0
push eax
call fcn.1007dcf0
push 0x104
lea ecx, [esp + 0x68]
push 0
push ecx
call fcn.1007dcf0
add esp, 0x18
lea edx, [esp + 0x260]
push edx
mov edx, 0x104
lea ecx, [esp + 0x5c]
call fcn.1002d550
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x5c]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x164]
push ecx
call edi
lea edx, [esp + 0x15c]
push edx
call ebp
mov ecx, dword [esp + 0x364]
pop ebp
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.10079a05
add esp, 0x35c
ret