joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf086df8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov edx, dword [eax + 0x508]
add edx, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
je 0xf086e76
test ecx, ecx
je 0xf086ee0
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx esi, byte [ecx]
mov ebx, dword [eax + 0x520]
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
and ecx, dword [eax + 0x514]
mov esi, dword [eax + 0x500]
or ecx, dword [eax + 0x510]
xor ebx, esi
mov edi, ecx
and edi, dword [eax + 0x518]
and ebx, ecx
xor edi, dword [eax + 0x51c]
and edi, esi
or edi, ebx
mov dword [edx], edi
sub edx, 4
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf086e22
jmp 0xf086ee0
mov esi, dword [eax + 0x504]
add esi, dword [ebp + 0x10]
test ecx, ecx
mov dword [ebp + 0x18], esi
je 0xf086ee0
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edi, byte [ecx]
mov esi, dword [esi]
mov ebx, dword [eax + 0x520]
mov ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
and ecx, dword [eax + 0x514]
xor ebx, esi
or ecx, dword [eax + 0x510]
mov edi, ecx
and edi, dword [eax + 0x518]
and ebx, ecx
xor edi, dword [eax + 0x51c]
and edi, esi
mov esi, dword [ebp + 0x18]
or edi, ebx
mov dword [edx], edi
sub edx, 4
dec dword [ebp + 0xc]
sub esi, 4
dec dword [ebp + 0x14]
mov dword [ebp + 0x18], esi
jne 0xf086e89
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf088613
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov edx, dword [eax + 0x508]
add edx, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
je 0xf088685
test ecx, ecx
je 0xf0886e3
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx esi, byte [ecx]
mov ebx, dword [eax + 0x520]
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
mov esi, dword [eax + 0x500]
mov edi, ecx
and edi, dword [eax + 0x518]
xor ebx, esi
xor edi, dword [eax + 0x51c]
and ebx, ecx
and edi, esi
or edi, ebx
mov dword [edx], edi
add edx, 4
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf08863d
jmp 0xf0886e3
mov esi, dword [eax + 0x504]
add esi, dword [ebp + 0x10]
test ecx, ecx
mov dword [ebp + 0x18], esi
je 0xf0886e3
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edi, byte [ecx]
mov esi, dword [esi]
mov ebx, dword [eax + 0x520]
mov ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
mov edi, ecx
and edi, dword [eax + 0x518]
xor ebx, esi
xor edi, dword [eax + 0x51c]
and ebx, ecx
and edi, esi
mov esi, dword [ebp + 0x18]
or edi, ebx
mov dword [edx], edi
add edx, 4
inc dword [ebp + 0xc]
add esi, 4
dec dword [ebp + 0x14]
mov dword [ebp + 0x18], esi
jne 0xf088698
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf0886ed
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov ecx, dword [eax + 0x508]
add ecx, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
push ebx
push esi
push edi
je 0xf088744
mov edi, dword [ebp + 0x14]
test edi, edi
je 0xf08878a
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi]
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, edx
and ebx, dword [eax + 0x514]
or ebx, dword [eax + 0x510]
xor ebx, dword [eax + 0x500]
mov dword [ecx], ebx
add ecx, 4
inc esi
dec edi
jne 0xf088713
jmp 0xf08878a
mov edx, dword [eax + 0x504]
mov esi, dword [ebp + 0x14]
add edx, dword [ebp + 0x10]
test esi, esi
je 0xf08878a
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
movzx esi, byte [edi]
mov ebx, esi
shl ebx, 8
or ebx, esi
shl ebx, 8
or ebx, esi
shl ebx, 8
or ebx, esi
and ebx, dword [eax + 0x514]
or ebx, dword [eax + 0x510]
xor ebx, dword [edx]
add edx, 4
mov dword [ecx], ebx
add ecx, 4
inc edi
dec dword [ebp + 0x14]
jne 0xf08875a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf088ad9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov edx, dword [eax + 0x508]
add edx, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
je 0xf088b57
test ecx, ecx
je 0xf088bc1
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx esi, byte [ecx]
mov ebx, dword [eax + 0x520]
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
and ecx, dword [eax + 0x514]
mov esi, dword [eax + 0x500]
or ecx, dword [eax + 0x510]
xor ebx, esi
mov edi, ecx
and edi, dword [eax + 0x518]
and ebx, ecx
xor edi, dword [eax + 0x51c]
and edi, esi
or edi, ebx
mov dword [edx], edi
add edx, 4
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf088b03
jmp 0xf088bc1
mov esi, dword [eax + 0x504]
add esi, dword [ebp + 0x10]
test ecx, ecx
mov dword [ebp + 0x18], esi
je 0xf088bc1
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edi, byte [ecx]
mov esi, dword [esi]
mov ebx, dword [eax + 0x520]
mov ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
and ecx, dword [eax + 0x514]
xor ebx, esi
or ecx, dword [eax + 0x510]
mov edi, ecx
and edi, dword [eax + 0x518]
and ebx, ecx
xor edi, dword [eax + 0x51c]
and edi, esi
mov esi, dword [ebp + 0x18]
or edi, ebx
mov dword [edx], edi
add edx, 4
inc dword [ebp + 0xc]
add esi, 4
dec dword [ebp + 0x14]
mov dword [ebp + 0x18], esi
jne 0xf088b6a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf089323
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [0xf232b50]
push ebx
push esi
mov ecx, edx
mov esi, 0xdfff
push edi
and ecx, esi
lea edi, [eax + 0x540]
cmp ecx, dword [edi]
jge 0xf089348
mov dword [edi], ecx
mov ebx, dword [ebp + 0x10]
lea ecx, [edx + ebx]
and ecx, esi
lea esi, [eax + 0x544]
cmp ecx, dword [esi]
jle 0xf08935c
mov dword [esi], ecx
add dword [eax + 0x53c], ebx
cmp dword [ebp + 0x14], 0
lea ecx, [edx + edx]
je 0xf08939e
test dl, 1
je 0xf08937a
xor esi, esi
and ecx, 0xfffffffd
inc esi
or ecx, esi
jmp 0xf089380
push 3
and ecx, 0xfffffffc
pop esi
add ecx, dword [eax + 0x508]
test ebx, ebx
je 0xf0893e8
mov eax, dword [ebp + 0xc]
mov edi, ebx
mov dl, byte [eax]
mov byte [ecx], dl
sub ecx, esi
dec eax
xor esi, 2
dec edi
jne 0xf08938f
jmp 0xf0893e8
test dl, 1
je 0xf0893aa
xor edx, edx
inc edx
or ecx, edx
jmp 0xf0893b0
push 3
and ecx, 0xfffffffc
pop edx
mov edi, dword [ebp + 0xc]
add ecx, dword [eax + 0x508]
mov esi, edi
neg esi
shl esi, 1
and esi, 0xfffffffe
not esi
and esi, 3
test ebx, ebx
je 0xf0893e8
mov dword [ebp + 8], ebx
mov ebx, dword [eax + 0x504]
mov bl, byte [edi + ebx]
mov byte [ecx], bl
sub edi, esi
sub ecx, edx
xor esi, 2
xor edx, 2
dec dword [ebp + 8]
jne 0xf0893ce
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf08950c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0xf232b50]
push esi
mov edx, ecx
mov esi, 0xdfff
push edi
and edx, esi
lea edi, [eax + 0x540]
cmp edx, dword [edi]
jge 0xf089530
mov dword [edi], edx
mov edi, dword [ebp + 0x10]
lea edx, [ecx + edi]
and edx, esi
lea esi, [eax + 0x544]
cmp edx, dword [esi]
jle 0xf089544
mov dword [esi], edx
add dword [eax + 0x53c], edi
xor edx, edx
inc edx
cmp dword [ebp + 0x14], 0
je 0xf089586
test dl, cl
je 0xf089563
add ecx, ecx
and ecx, 0xfffffffd
push 3
or ecx, edx
pop esi
jmp 0xf08956a
add ecx, ecx
and ecx, 0xfffffffc
mov esi, edx
add ecx, dword [eax + 0x508]
test edi, edi
je 0xf0895d1
mov eax, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
add ecx, esi
inc eax
xor esi, 2
dec edi
jne 0xf089577
jmp 0xf0895d1
test dl, cl
push ebx
je 0xf089594
add ecx, ecx
push 3
or ecx, edx
pop ebx
jmp 0xf08959b
add ecx, ecx
and ecx, 0xfffffffc
mov ebx, edx
mov esi, dword [ebp + 0xc]
add ecx, dword [eax + 0x508]
mov edi, esi
and edi, edx
mov edx, dword [ebp + 0x10]
test edx, edx
lea edi, [edi + edi + 1]
je 0xf0895d0
mov dword [ebp + 0x10], edx
mov edx, dword [eax + 0x504]
mov dl, byte [esi + edx]
mov byte [ecx], dl
add esi, edi
add ecx, ebx
xor edi, 2
xor ebx, 2
dec dword [ebp + 0x10]
jne 0xf0895b6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xf08ba78
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0xf205e34], 0
je 0xf08bb68
push edi
push 0xf0062a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0xf08bb67
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xf006294
push edi
call esi
push 0xf006280
push edi
mov dword [0xf2333c4], eax
call esi
push 0xf00626c
push edi
mov dword [0xf2333b0], eax
call esi
push 0xf006258
push edi
mov dword [0xf2333cc], eax
call esi
push 0xf006244
push edi
mov dword [0xf2333c8], eax
call esi
push 0xf006238
push edi
mov dword [0xf2333d4], eax
call esi
push 0xf00622c
push edi
mov dword [0xf2333c0], eax
call esi
push 0xf00621c
push edi
mov dword [0xf2333d8], eax
call esi
push 0xf006208
push edi
mov dword [0xf2333b4], eax
call esi
push 0xf0061e8
push edi
mov dword [0xf2333b8], eax
call esi
push 0xf0061d0
push edi
mov dword [0xf2333bc], eax
call esi
push 0xf0061a8
push edi
mov dword [0xf2333f0], eax
call esi
mov dword [0xf2333d0], eax
mov eax, dword [0xf2333c4]
test eax, eax
pop esi
je 0xf08bb67
mov ecx, dword [sym.ntvdm.exe_Start_of_M_area]
push sym.ntvdm.exe_nt_cpu_info
push dword [sym.ntvdm.exe_InitialVdmDbgFlags]
add ecx, 0x714
push ecx
call eax
mov dword [0xf205e38], eax
pop edi
ret
Function at 0xf08c0d7
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xf0ad034]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x10000
push eax
mov dword [ebp - 0x214], eax
call fcn.0f00ae4a
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
cmp esi, 0xffffffff
je 0xf08c16a
push 0xd
push 1
lea eax, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
mov byte [ebp - 0x20d], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x21c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf18]
mov eax, dword [eax + 0x670]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
push esi
call dword [eax + 0x30]
cmp dword [ebp - 0x21c], ebx
jl 0xf08c166
push ebx
jmp 0xf08c168
push 5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
je 0xf08c236
cmp eax, 1
jbe 0xf08c224
cmp eax, 3
jbe 0xf08c236
cmp eax, 5
je 0xf08c19a
cmp eax, 0x20
jne 0xf08c224
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [ebp - 0x214]
call fcn.0f096e91
test eax, eax
je 0xf08c236
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0xf08c1c9
mov byte [eax], bl
lea eax, [ebp - 0x108]
push eax
push ebx
push 0xf006ba0
lea eax, [ebp - 0x20c]
push eax
call fcn.0f096343
test eax, eax
je 0xf08c236
push 1
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x214]
call fcn.0f096b3b
test eax, eax
je 0xf08c236
lea eax, [ebp - 0x108]
push eax
call fcn.0f0969ce
test eax, eax
jne 0xf08c233
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push eax
call fcn.0f096a62
push 5
jmp 0xf08c234
push dword [ebp - 0x214]
call fcn.0f0969ce
test eax, eax
je 0xf08c236
push ebx
call edi
call esi
cmp eax, ebx
je 0xf08c24f
cmp eax, 1
jbe 0xf08c24b
cmp eax, 3
jbe 0xf08c24f
cmp eax, 5
je 0xf08c24f
push 5
call edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01dda0
leave
ret 4

Function at 0xf08e2f2
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xf0ad034]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x40
push edi
mov word [ebp - 0xc], ax
mov eax, dword fs:[0x18]
mov word [ebp - 0xa], 0x3a
xor edi, edi
mov word [ebp - 8], di
mov eax, dword [eax + 0xf18]
mov eax, dword [eax + 0x670]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
push 0x104
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0xc]
push ecx
call dword [eax + 0x144]
test eax, eax
jne 0xf08e386
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, eax
cmp edi, 2
jne 0xf08e386
push esi
call fcn.0f08e29f
test eax, eax
jl 0xf08e38d
push dword [esi + 4]
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
je 0xf08e382
xor eax, eax
jmp 0xf08e38d
call ebx
mov edi, eax
mov eax, edi
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01dda0
leave
ret 8
Function at 0xf0903a8
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0xf0ad034]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0xf006c44
mov dword [ebp - 0x114], 0xf006c40
call sym.ntvdm.exe_cmdCheckTempInit
xor ebx, ebx
mov edi, 0x104
mov eax, dword [ebp + ebx*4 - 0x118]
lea edx, [ebp - 0x110]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf0903ed
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf090400
sub eax, edx
mov esi, eax
push edi
lea eax, [ebp + esi - 0x10f]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0xf090450
cmp eax, edi
jae 0xf090450
lea eax, [ebp - 0x110]
push eax
mov byte [ebp + esi - 0x110], 0x3d
call sym.ntvdm.exe_cmdCheckTemp
test eax, eax
je 0xf090450
lea ecx, [eax + esi]
mov byte [ecx], 0
inc ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
inc ebx
cmp ebx, 2
jb 0xf0903de
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01dda0
leave
ret
Function at 0xf093695
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov esi, 0xf006e10
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0xf093723
cmp dword [ebp + 0x10], 1
je 0xf09372a
cmp dword [ebp + 0x10], 2
jne 0xf0937fa
lea eax, [ebp + 0x10]
push eax
push 1
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersionTerminal_Server
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf09373d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push edi
push str.RootDrive
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0xf0937fa
cmp dword [ebp + 8], 1
jne 0xf0937fa
dec dword [ebp - 4]
jmp 0xf09373d
mov eax, 0xf006e04
jmp 0xf09372f
mov eax, 0xf006df8
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
test edi, edi
je 0xf0937fa
cmp edi, dword [ebp + 0xc]
jae 0xf0937fa
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf093756
sub eax, edx
add eax, edi
cmp eax, dword [ebp + 0xc]
jae 0xf0937fa
cmp byte [edi + ebx - 1], 0x5c
jne 0xf093778
mov dword [ebp - 0xc], 0xf006e11
mov eax, dword [ebp - 0xc]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf09377d
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf093789
push dword [ebp + 0xc]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
jbe 0xf0937c4
cmp eax, dword [ebp + 0xc]
jae 0xf0937c4
push ebx
call esi
cmp eax, 0xffffffff
jne 0xf0937ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0xf0937d4
cmp eax, 2
jne 0xf0937f5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov dword [ebp - 8], eax
je 0xf0937f5
push ebx
call esi
cmp eax, 0xffffffff
je 0xf0937f5
shr eax, 4
and eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0xf0937fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xf093808
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0xf0ad034]
and dword [ebp - 0x218], 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0xf006e50
push 0x80000002
mov byte [ebp - 0x108], 0
mov byte [ebp - 0x20c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, 0x104
jne 0xf0938ff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0xf006c44
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf0938b6
push dword [ebp - 0x210]
jmp 0xf0938ee
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0xf006c40
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 0x210]
jne 0xf0938f9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0xf093991
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf006e3c
lea eax, [ebp - 0x20c]
push eax
call ebx
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0xf093941
test byte [ebp - 0x248], 0x10
jne 0xf093991
push 0xf006e28
lea eax, [ebp - 0x20c]
push eax
call ebx
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0xf093983
test byte [ebp - 0x248], 0x10
jne 0xf093991
push 0xf006e18
lea eax, [ebp - 0x108]
push eax
call ebx
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp dword [ebp - 0x220], 0
je 0xf0939f5
mov eax, dword [ebp - 0x21c]
cmp dword [eax], esi
jb 0xf0939f5
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x220]
call ebx
mov dword [ebp - 0x218], 1
jmp 0xf0939fd
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 0x218]
pop esi
pop ebx
call fcn.0f01dda0
leave
ret 8
Function at 0xf094448
Capabilities:
Delete file
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0xf094578
mov ecx, dword [edi + 0x20]
test ecx, ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
je 0xf09450e
mov eax, dword [0xf205fdc]
cmp ecx, eax
jne 0xf094480
mov esi, ecx
mov eax, dword [esi]
mov dword [0xf205fdc], eax
jmp 0xf09449e
test eax, eax
mov esi, eax
je 0xf09450e
cmp esi, ecx
je 0xf094496
mov eax, esi
mov esi, dword [esi]
test esi, esi
jne 0xf09448a
test esi, esi
je 0xf09450e
mov ecx, dword [esi]
mov dword [eax], ecx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xf0944cd
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 8]
call ebx
push dword [esi + 0xc]
call ebx
push dword [esi + 0x10]
call ebx
push dword [esi + 0x14]
call ebx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x18]
call fcn.0f008a60
push esi
call fcn.0f008a60
pop ecx
pop ecx
mov eax, dword [edi + 0x24]
test eax, eax
mov esi, dword [ebp + 0xc]
je 0xf094540
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffc17
add eax, 0x3e8
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x18]
call ebx
mov eax, dword [edi + 0x28]
test eax, eax
je 0xf09456f
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
neg esi
sbb esi, esi
and esi, 0xfffffc17
add esi, 0x3e8
push esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x1c]
call ebx
push edi
call fcn.0f008a60
pop ecx
pop esi
pop ebx
xor eax, eax
inc eax
pop edi
pop ebp
ret 8
Function at 0xf09480d
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0xf205fdc]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 4], ebx
je 0xf0948b4
mov ecx, dword [ebp + 8]
cmp dword [esi + 4], ecx
je 0xf094838
mov esi, dword [esi]
cmp esi, ebx
jne 0xf09482a
cmp esi, ebx
je 0xf0948b4
mov eax, dword [esi + 0x20]
cmp eax, ebx
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
jne 0xf0948c7
push 1
lea eax, [ebp - 4]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 0xc], eax
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x20]
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 0xc], eax
jne 0xf09488b
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0xf09488b
mov dword [esi + 0x24], 1
jmp 0xf09488e
xor ebx, ebx
inc ebx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0xf0948c7
push 0x37
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
and dword [esi + 0x24], 0
jmp 0xf0948bd
mov edi, dword [ebp + 0xc]
mov dword [edi], 1
xor eax, eax
cmp ebx, eax
jne 0xf0948c7
cmp dword [edi], eax
je 0xf0948ca
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8