joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41969e
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x42b0c8
push 1
xor ebx, ebx
push ebx
push 0x42b178
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41976f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x42b168
push eax
call dword [ecx]
test eax, eax
jl 0x419766
cmp byte [ebp + 8], bl
je 0x4196f1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x41970e
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x419720
push 0x42a55c
jmp 0x419723
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x419738
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x419749
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x41975d
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x419789
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41e2ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430298]
jne 0x41e2d8
repz ret
jmp fcn.00423b4a
Function at 0x4253d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e34f
and dword [ebp - 4], 0
cmp dword [0x4506b0], 0
mov ebx, eax
jne 0x425486
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425537
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425537
push eax
call fcn.0041e2dd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4506b0], eax
call esi
push eax
call fcn.0041e2dd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4506b4], eax
call esi
push eax
call fcn.0041e2dd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4506b8], eax
call esi
push eax
call fcn.0041e2dd
pop ecx
mov dword [0x4506c0], eax
test eax, eax
je 0x425486
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e2dd
pop ecx
mov dword [0x4506bc], eax
mov eax, dword [0x4506bc]
cmp eax, ebx
je 0x4254de
cmp dword [0x4506c0], ebx
je 0x4254de
push eax
call fcn.0041e358
push dword [0x4506c0]
mov esi, eax
call fcn.0041e358
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4254de
test edi, edi
je 0x4254de
call esi
test eax, eax
je 0x4254d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4254d5
test byte [ebp - 0xc], 1
jne 0x4254de
or dword [ebp + 0x10], 0x200000
jmp 0x425517
mov eax, dword [0x4506b4]
cmp eax, ebx
je 0x425517
push eax
call fcn.0041e358
pop ecx
test eax, eax
je 0x425517
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425517
mov eax, dword [0x4506b8]
cmp eax, ebx
je 0x425517
push eax
call fcn.0041e358
pop ecx
test eax, eax
je 0x425517
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4506b0]
call fcn.0041e358
pop ecx
test eax, eax
je 0x425537
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425539
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov dword [ebp - 0x234], 0
mov ecx, 0x24
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401030
movups xmm0, xmmword [0x403230]
mov ax, word [0x403268]
lea edi, [ebp - 0x20c]
mov dword [ebp - 0x230], 0x24
add edi, 0xfffffffe
movups xmmword [ebp - 0x20c], xmm0
mov dword [ebp - 0x21c], 4
movups xmm0, xmmword [0x403240]
mov word [ebp - 0x1d4], ax
movups xmmword [ebp - 0x1fc], xmm0
movups xmm0, xmmword [0x403250]
movups xmmword [ebp - 0x1ec], xmm0
movq xmm0, qword [0x403260]
movq qword [ebp - 0x1dc], xmm0
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4010a0
mov ecx, 0x13
lea eax, [ebp - 0x234]
mov esi, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
rep movsd dword es:[edi], dword [esi]
push eax
push 0x4033c8
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov ecx, dword [ebp - 0x234]
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402081
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Accept command line arguments

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x4014bd
push esi
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401453
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4014b7
push esi
push ebx
lea eax, [esi + 1]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
cmp word [edi], 0x22
jne 0x4014b7
cmp word [edi + esi*2 - 2], 0x22
jne 0x4014b7
xor eax, eax
mov word [edi + esi*2 - 2], ax
lea eax, [esi - 4]
push eax
lea eax, [edi + 2]
push eax
push edi
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x401700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.C:WindowsSystem32kernel32.dll]
mov ax, word [0x403398]
push esi
movups xmmword [ebp - 0x194], xmm0
push edi
movups xmm0, xmmword [0x403368]
push 0x14e
mov word [ebp - 0x154], ax
lea eax, [ebp - 0x152]
movups xmmword [ebp - 0x184], xmm0
push 0
movups xmm0, xmmword [0x403378]
push eax
movups xmmword [ebp - 0x174], xmm0
movups xmm0, xmmword [0x403388]
movups xmmword [ebp - 0x164], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
push esi
call fcn.004020cf
add esp, 4
mov edi, eax
lea eax, [ebp - 0x194]
push edi
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x401812
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
push 0x40339c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x401812
cmp dword [ebp - 0x198], 0
je 0x401812
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax + 0x10]
mov eax, ecx
shr eax, 0x10
cmp ax, 0xa
jne 0x4017fb
test cx, cx
jne 0x4017fb
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402081
mov esp, ebp
pop ebp
ret
cmp ax, 6
jne 0x401812
cmp cx, 2
je 0x4017e6
cmp ax, ax
jne 0x401812
cmp cx, 1
je 0x4017e6
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00402081
mov esp, ebp
pop ebp
ret

Function at 0x401e70
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor esi, esi
nop word [eax + eax]
push 0
push 0
push dword [esi + 0x404068]
push 0x401df0
push 0
push 0
call edi
add esi, 4
cmp esi, 0x14c
jb 0x401e80
pop edi
pop esi
ret
Function at 0x401ed0
Capabilities:
Create process on windows
Create thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x480
mov eax, dword [0x406004]
xor eax, esp
mov dword [esp + 0x47c], eax
push esi
push edi
lea eax, [esp + 0xc]
xor esi, esi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401fe2
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x14
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
cmovne esi, dword [esp + 0x24]
call edi
test esi, esi
je 0x401fe2
push 0
push 0
push 0
push 0x401eb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00401e70
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
push eax
push str.cmd.exe__C_timeout__T_2__NOBREAK__del__F___ls_
lea eax, [esp + 0x280]
push 0x104
push eax
call fcn.00401db0
push 0x40
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x298]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401700
test eax, eax
je 0x402006
call fcn.004015c0
pop edi
pop esi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.00402081
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x38
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], str.runas
lea eax, [esp + 0x70]
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x44], 0
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [esp + 0x484]
pop edi
pop esi
xor ecx, esp
call fcn.00402081
mov esp, ebp
pop ebp
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1000854a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
push 0
call fcn.1000def1
add esp, 4
cmp edi, ebx
je 0x100085d4
test al, al
je 0x100085a6
lea edi, [ebp - 0x9c]
mov ecx, edi
push 0
push 0x3a
push str..._.._third_party_ie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000df3a
push 0x1c
push str.RepeatingTaskScheduler_Start
push edi
call fcn.10005eef
add esp, 0xc
mov ecx, edi
call fcn.1000e1da
sub esp, 0x10
movaps xmm0, xmmword [0x100536e0]
movups xmmword [esp], xmm0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x14], eax
xor eax, eax
push eax
push eax
push esi
push 0x10008620
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x10], eax
jmp 0x10008605
test al, al
je 0x10008605
lea esi, [ebp - 0x9c]
mov ecx, esi
push 0
push 0x36
push str..._.._third_party_ie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000df3a
push 0x25
push str.No_tasks__skipping_scheduler_creation
push esi
call fcn.10005eef
add esp, 0xc
mov ecx, esi
call fcn.1000e1da
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000a2d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x280
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [esp + 0x278], eax
lea edi, [esp + 0x70]
push 0x208
push 0
push edi
call fcn.10027f80
add esp, 0xc
push 0x104
push edi
call fcn.1000c424
add esp, 8
test eax, eax
js 0x1000a3dc
mov ebx, dword [ebp + 8]
push edi
call fcn.10035a4c
add esp, 4
add eax, 0x28
xor ecx, ecx
dec ecx
lea esi, [esp + 0x64]
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov ecx, esi
push eax
call fcn.1000a460
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
sar ecx, 1
push ebx
push edi
push str.__s____create_cache_container_d
push ecx
push eax
call fcn.1000a4b9
add esp, 0x14
test eax, eax
js 0x1000a3e0
xorps xmm0, xmm0
lea eax, [esp + 0x20]
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
lea ecx, [esp + 0x10]
movaps xmmword [ecx], xmm0
mov edx, dword [esp + 0x64]
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x1000a3e4
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x1000a3fa
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000a421
mov esi, eax
jmp 0x1000a448
mov esi, eax
jmp 0x1000a433
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000a433
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x1000a3c6
mov eax, dword [esp + 0xc]
test eax, eax
mov esi, 0x80004005
cmove esi, eax
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 0x14]
call edi
push dword [esp + 0x10]
call edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x1000a448
mov dword [esp + 0x68], eax
push eax
call fcn.10024829
add esp, 4
mov ecx, dword [esp + 0x278]
xor ecx, ebp
call fcn.10025727
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c1ea
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [esp + 0x68], eax
push dword [ecx]
call fcn.1000a5d7
add esp, 4
test eax, eax
je 0x1000c278
mov dword [esp + 0xc], esi
mov esi, dword [eax + 8]
lea eax, [esp + 0x64]
mov dword [eax], 0
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movups xmmword [ebx + 0x3c], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
sub esp, 0x1c
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
movaps xmm0, xmmword [0x10054120]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call dword [sym.imp.WININET.dll_UrlCacheFindFirstEntry]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1000c27f
cmp edi, 0x80070103
je 0x1000c29f
jmp 0x1000c2aa
mov edi, 0x80070057
jmp 0x1000c2aa
push esi
call fcn.10035a4c
add esp, 4
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_StrCmpNICW]
test eax, eax
je 0x1000c2f0
push ebx
call dword [sym.imp.WININET.dll_UrlCacheFreeEntryInfo]
xor edi, edi
mov eax, dword [esp + 0xc]
cmp dword [eax], 0
je 0x1000c2bf
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.10025727
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
push 0x102
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c325
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1000c34e
mov esi, dword [sym.imp.WININET.dll_UrlCacheFindNextEntry]
push dword [esp + 0x10]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push ebx
call dword [sym.imp.WININET.dll_UrlCacheFreeEntryInfo]
push ebx
push dword [esp + 0x68]
call esi
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1000c2f6
jmp 0x1000c26e
mov esi, dword [esp + 0x10]
push str.CurrentVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test esi, esi
je 0x1000c34e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp edi, 0x80070002
cmovne esi, edi
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.10025727
mov eax, esi
jmp 0x1000c2b7
Function at 0x1000c8cf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1005e7d0]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000c91f
mov bl, byte [0x1005e7cc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
add esp, 0x11c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1005e7d0
call fcn.10035a4c
add esp, 4
cmp dword [0x1005e7d0], 0xffffffff
jne 0x1000c902
mov eax, dword [0x1005e800]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000ca52
mov bl, 1
cmp byte [0x1005e7fc], 0
jne 0x1000c98b
mov eax, dword [0x1005e808]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000ca8f
cmp byte [0x1005e804], 0
je 0x1000c9a3
mov byte [0x1005e7cc], bl
push 0x1005e7d0
call fcn.10035a4c
add esp, 4
jmp 0x1000c902
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.10027f80
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x1000c98b
lea eax, [ebp - 0x128]
mov dword [eax], ebx
push eax
push ebx
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.kernel32.dll_GetProductInfo]
test eax, eax
je 0x1000c98b
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
je 0x1000ca04
cmp eax, 6
jne 0x1000ca4b
mov bl, 1
mov eax, dword [ebp - 0x128]
cmp eax, 0x1b
ja 0x1000ca1f
mov ecx, 0xa07f7d0
bt ecx, eax
jb 0x1000c98b
lea ecx, [eax - 0x77]
cmp ecx, 0xb
ja 0x1000ca35
mov edx, 0xccd
bt edx, ecx
jb 0x1000c98b
add eax, 0xffffffba
cmp eax, 0xe
ja 0x1000ca4b
mov ecx, 0x4005
bt ecx, eax
jb 0x1000c98b
xor ebx, ebx
jmp 0x1000c98b
push 0x1005e800
call fcn.10035a4c
add esp, 4
cmp dword [0x1005e800], 0xffffffff
jne 0x1000c956
push 0x1c
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
setne byte [0x1005e7fc]
push 0x1005e800
call fcn.10035a4c
add esp, 4
jmp 0x1000c956
push 0x1005e808
call fcn.10035a4c
add esp, 4
cmp dword [0x1005e808], 0xffffffff
jne 0x1000c982
xor eax, eax
mov dword [ebp - 0x124], eax
push 0x1100
push eax
push str.MDMRegistration.dll
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
test eax, eax
je 0x1000caea
push str.IsDeviceRegisteredWithManagement
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1000caea
xor esi, esi
lea edi, [ebp - 0x124]
push esi
push esi
push edi
call eax
cmp dword [edi], esi
setne cl
jmp 0x1000cb01
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
xor ecx, ecx
test eax, eax
setns al
and al, cl
mov byte [0x1005e804], al
push 0x1005e808
call fcn.10035a4c
add esp, 4
jmp 0x1000c982
Function at 0x1000ccce
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push str.SCODEF
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x1000cd97
mov edi, eax
mov dword [ebp - 0x14], 0
push str.msiso.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x1000cd1c
mov ecx, 0x82
jmp 0x1000cd30
push str.iertutil.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x1000cd97
mov ecx, 0x1e0
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1000cd97
mov ecx, eax
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x1c]
mov dword [esi], 0
lea eax, [ebp - 0x14]
push esi
push eax
push edi
call ecx
xor ebx, ebx
test eax, eax
jne 0x1000cd99
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000cd99
push eax
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_OpenProcess]
test eax, eax
je 0x1000cd97
mov edi, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push esi
push esi
push esi
push dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_GetProcessTimes]
test eax, eax
setne bl
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1000cd99
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000cdad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [esp + 0x20], eax
xor edi, edi
dec edi
lea esi, [esp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
call fcn.1000ccce
mov bl, 1
test al, al
je 0x1000ce81
mov dword [esp], edi
mov dword [esp + 4], edi
xor eax, eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
push ebx
push 0x20119
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ce7f
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x18]
mov dword [edx], edi
lea eax, [esp + 0x1c]
mov dword [eax], 8
push eax
push ebx
mov ebx, ecx
push edx
xor edi, edi
push edi
push str.LatestUpsellAttemptedSessionTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
cmp dword [ecx], 0xb
mov ecx, 0xd
cmove ecx, edi
test eax, eax
cmovne ecx, eax
movzx edi, cx
or edi, 0x80070000
test ecx, ecx
cmovle edi, ecx
test edi, edi
jne 0x1000ce70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
test ebx, ebx
je 0x1000ce7b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1000ce96
xor ebx, ebx
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
push esi
push eax
call dword [sym.imp.kernel32.dll_CompareFileTime]
test eax, eax
setns bl
jmp 0x1000ce81