joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005ea30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x1005ea41
xor eax, eax
pop ebp
ret 8
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.msvcrt.dll__read
add esp, 0xc
pop ebp
ret 8

Function at 0x100606e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100606fb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push dword [ebp + 8]
test eax, eax
je 0x10060710
call eax
jmp 0x10060716
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test esi, esi
je 0x10060723
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x10060790
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1006081e
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100607c1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
mov edi, dword [ebp + 8]
add esp, 4
push edi
push dword [ebp - 8]
test eax, eax
je 0x100607da
call eax
jmp 0x100607e0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
test esi, esi
je 0x100607ee
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
xor eax, eax
mov esi, dword [ebp - 4]
test ecx, ecx
sete al
mov dword [ebp - 8], eax
test ecx, ecx
jne 0x10060819
push dword [esi + 0xc]
push edi
push 0x10202940
push dword [esi]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
mov edi, dword [ebp - 8]
jmp 0x10060820
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
test eax, eax
je 0x10060898
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10060840
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
mov ecx, dword [ebp + 8]
add esp, 4
push ecx
push dword [ebp - 8]
test eax, eax
je 0x10060859
call eax
jmp 0x1006085f
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
test esi, esi
je 0x1006086d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 8]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x10060898
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push dword [ebp + 8]
push 0x10202940
push dword [eax + 4]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
test edi, edi
jne 0x100608ac
test ebx, ebx
jne 0x100608ac
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10064060
Capabilities:
Create process on windows
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x1c], 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x80], eax
lea esi, [ecx + 8]
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov eax, esi
jb 0x10064095
mov eax, dword [esi]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0
push eax
push str.taskbarunpin
push 0
call ebx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100640b5
mov eax, dword [esi]
push eax
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x100640d5
cmp dword [esi + 0x14], 8
jb 0x100640ca
mov esi, dword [esi]
push 0
push esi
call fcn.100d9c10
add esp, 8
cmp byte [ebp + 8], 0
je 0x10064203
cmp word [edi], 0
je 0x10064203
mov esi, dword [ebp - 0x80]
cmp word [esi], 0
je 0x10064203
push 0
push 0
push 0
push edi
push str.taskbarunpin
push 0
call ebx
push edi
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x1006411e
push 0
push edi
call fcn.100d9c10
add esp, 8
push edi
lea ecx, [ebp - 0x4c]
call fcn.10020470
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10064990
add esp, 8
lea ecx, [ebp - 0x4c]
call fcn.10005250
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10005170
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x34]
call fcn.10005170
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x10064163
mov eax, dword [ebp - 0x1c]
push 0
push eax
push dword [ebp + 0x18]
xor bl, bl
push esi
push dword [ebp - 0x84]
call fcn.100d9780
add esp, 0x14
test eax, eax
je 0x100641bd
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x1006418a
mov eax, dword [ebp - 0x1c]
push 0
push 0
push 0
push eax
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x24], 0
je 0x100641bb
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x100641b0
mov eax, dword [ebp - 0x1c]
push 0
push eax
call fcn.100d9c10
add esp, 8
mov bl, 1
cmp dword [ebp - 0x24], 0
je 0x100641d6
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
jb 0x100641cf
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x34]
call fcn.10005250
lea ecx, [ebp - 0x1c]
call fcn.10005250
lea ecx, [ebp - 0x7c]
call fcn.1005ff90
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10065f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x22d]
call fcn.10129b80
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0
push eax
push 0x102096d4
push 0x17
push 0
push 0x102096c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x234]
mov esi, eax
mov dword [ebp - 0x238], 0
test ecx, ecx
je 0x10066111
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0x14]
mov esi, eax
test esi, esi
jne 0x10066101
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x238]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, eax
test esi, esi
jne 0x10066101
push edi
push 0x190
push eax
mov dword [ebp - 0x23c], eax
lea edi, [ebp - 0x20c]
lea eax, [ebp - 0x194]
mov ecx, 0x1e
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
rep movsd dword es:[edi], dword [esi]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x23c]
add esp, 0xc
push 4
push eax
push 4
push str.NoInternetIcon
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call esi
push 4
lea eax, [ebp - 0x23c]
push eax
push 4
push str.NoInternetIcon
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x238]
call esi
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x102096b4]
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x22c], eax
mov eax, dword [0x102096b8]
mov dword [ebp - 0x228], eax
mov eax, dword [0x102096bc]
mov dword [ebp - 0x224], eax
mov eax, dword [0x102096c0]
push edx
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x234]
push edx
push 1
mov dword [ebp - 0x21c], 0x35378eac
mov dword [ebp - 0x218], 0x11d2683f
mov dword [ebp - 0x214], 0xc0009aa8
mov dword [ebp - 0x210], 0xa2cfbb4f
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x1c]
mov esi, eax
pop edi
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x10066111
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x22d]
call fcn.10129ba0
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x10066130
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10257b6c]
test eax, eax
jne 0x10066199
cmp dword [0x10257b70], eax
jne 0x100661ba
push 0x118
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
mov dword [0x10257b6c], eax
mov dword [0x10257b70], ecx
jmp 0x1006619f
mov ecx, dword [0x10257b70]
cmp eax, 6
jb 0x100661ba
jne 0x100661aa
test ecx, ecx
je 0x100661ba
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10066710
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1006676d
lea ecx, [ebp - 0x20c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
lea edx, [ecx + 2]
mov word [edi], ax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10066760
jmp 0x100667bb
push str.Internet_Explorer
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.iexplore.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100667b0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.100070c0
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x100667f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
push edi
push str.360SE_3.exe
push eax
call fcn.100092f0
mov esi, dword [ebp - 0x210]
add esp, 8
or edi, 0xffffffff
cmp dword [esi - 0xc], 0
jne 0x100668d5
lea eax, [ebp - 0x21c]
push str.360SE.exe
push eax
call fcn.100092f0
lea ecx, [esi - 0x10]
add esp, 8
mov dword [ebp - 0x218], ecx
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x214], eax
cmp eax, ecx
je 0x100668b8
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x100668a3
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x100668a3
push dword [ebp - 0x214]
call fcn.10002a60
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, edi
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x1006689e
mov esi, dword [ebp - 0x218]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x214]
lea esi, [eax + 0x10]
jmp 0x100668b8
push dword [edx - 0xc]
lea ecx, [ebp - 0x210]
push edx
call fcn.10003740
mov esi, dword [ebp - 0x210]
mov edx, dword [ebp - 0x21c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100668d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov word [ebp - 0x20c], ax
cmp dword [esi - 0xc], eax
je 0x1006698f
push str.360se.exe
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1006698f
call fcn.10003180
mov edi, dword [eax + 0x154]
test edi, edi
je 0x10066911
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push esi
test eax, eax
je 0x10066924
call eax
jmp 0x1006692a
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x210], eax
test edi, edi
je 0x1006693b
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x210]
cmp eax, 0xffffffff
je 0x1006698c
test al, 0x10
jne 0x1006698c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x20c]
mov dword [ebx], 1
push eax
lea ecx, [ebx + 4]
call fcn.10002490
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100669b7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x100669b7
or edi, 0xffffffff
push 0x10202940
lea ecx, [ebx + 4]
mov dword [ebx], 0
call fcn.10002490
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x100669b7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x100669d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
setae al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10066f10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], esi
lea edx, [ecx + 2]
mov dword [ebp - 0x214], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10066f50
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0x10202940
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
lea edx, [ebp - 0x20c]
add esp, 0xc
mov ecx, ebx
sub edx, ebx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x10066f93
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10066fb0
mov ecx, 7
mov esi, str.opencommand
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x214]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10066fd3
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call edi
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push ebx
push str._s_scommand
push 0x104
push eax
call fcn.101fa29f
mov ecx, esi
add esp, 0x14
lea edx, [ecx + 2]
jmp 0x10067030
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067030
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10067070
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1006709c
mov esi, str.360SE.EXE
lea eax, [ecx + 0x1c]
mov ebx, str.360SE_Browser
jmp 0x100670a9
mov esi, str.IEXPLORE.EXE
lea eax, [ecx + 4]
mov ebx, str.Internet_Explorer
cmp dword [eax + 0x14], 8
jb 0x100670b1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.101ef650
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test edi, edi
je 0x100671e2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100670e6
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0x10202940
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push esi
push str.SOFTWAREClientsStartMenuInternet
push 0x102040c0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.101fa29f
mov ecx, ebx
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067137
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.shellopencommand
push esi
push str.SOFTWAREClientsStartMenuInternet
push 0x102049ac
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.101fa29f
lea ecx, [ebp - 0x414]
add esp, 0x18
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067190
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClientsStartMenuInternet
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x18
push str.IEXPLORE.EXE
push 1
push 0x10202940
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x18
push str.IEXPLORE.EXE
push 1
push 0x10202940
push str.SOFTWAREClientsStartMenuInternet
push SysReAllocString
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x10067660
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 8]
add esp, 0xc
or edi, 0xffffffff
test ebx, ebx
je 0x10067819
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100676b0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push ebx
test eax, eax
je 0x100676c3
call eax
jmp 0x100676c9
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x100676d6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x10067819
test bl, 0x10
jne 0x10067819
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.10174d60
add esp, 0xc
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x210]
push eax
call fcn.10002490
mov esi, dword [ebp - 0x210]
cmp dword [esi - 0xc], 0
jl 0x10067802
push 0x10209640
push esi
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x10067802
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x10067802
xor ecx, ecx
test eax, eax
sets cl
dec ecx
and ecx, eax
mov eax, dword [esi - 0xc]
cmp ecx, eax
jle 0x10067757
mov ecx, eax
xor ebx, ebx
test eax, eax
sets bl
dec ebx
and ebx, ecx
cmp ebx, eax
jne 0x1006777f
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.1001b810
mov edi, dword [ebp - 0x214]
jmp 0x100677c4
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x1006778f
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x1006779b
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
push 2
push ebx
call dword [edx]
test eax, eax
je 0x10067848
push ebx
lea edi, [eax + 0x10]
xor eax, eax
mov dword [edi - 0xc], ebx
push esi
push ebx
push edi
mov word [edi + ebx*2], ax
call fcn.10008010
add esp, 0x10
push esi
call sub.msvcrt.dll__wtol
lea edx, [edi - 0x10]
mov ebx, eax
or edi, 0xffffffff
add esp, 4
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100677e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1006781b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1006781b
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10067819
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x10067833
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
call fcn.10003970
int3
Function at 0x1006c1c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1006c1db
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xa
call fcn.10003680
add esp, 4
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x1006c1fc
call eax
jmp 0x1006c202
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test esi, esi
je 0x1006c20f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x10071570
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push str.Local_State
push 0x10202944
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.10007f40
add esp, 0xc
push eax
lea eax, [ebp - 4]
push eax
call fcn.10007f40
mov edx, dword [ebp - 8]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100715c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100715d6
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1f
call fcn.10003680
mov edi, dword [ebp - 4]
add esp, 4
push edi
test eax, eax
je 0x100715ec
call eax
jmp 0x100715f2
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], eax
test esi, esi
je 0x10071600
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], 0
je 0x10071628
push ecx
add edi, 0xfffffff0
mov esi, esp
push edi
call fcn.10002a60
mov ecx, dword [ebp - 0xc]
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp + 8]
push esi
call fcn.10072a80
jmp 0x1007164b
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x10202a60
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.100753a0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1007165f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10071677
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8