joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d9c10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d9dd8
cmp word [esi], 0
je 0x100d9dd8
cmp dword [ebp + 0xc], 0
je 0x100d9c41
push 0
push esi
call fcn.1010aeb0
mov ecx, eax
call fcn.1010aad0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x100d9c71
push esi
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x100d9c66
push esi
call fcn.100d96b0
test eax, eax
je 0x100d9ca4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100d9c5c
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x100d9c5c
push esi
call fcn.100dc6a0
add esp, 4
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
jmp 0x100d9c62
push ebx
push esi
lea ecx, [ebp - 4]
call fcn.10002490
push 0x10205260
push 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.10009ca0
push eax
call fcn.10033f60
mov edx, dword [ebp - 8]
or ebx, 0xffffffff
add esp, 8
mov byte [ebp + 0xb], al
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100d9ced
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp + 0xb]
test al, al
je 0x100d9db5
mov edi, dword [ebp - 4]
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x100d9d08
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x100d9d14
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, 1
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [edi - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], esi
lea edx, [eax + 4]
mov eax, dword [esi - 8]
sub eax, edx
or ecx, eax
jge 0x100d9d47
push edx
lea ecx, [ebp + 8]
call fcn.10003310
mov esi, dword [ebp + 8]
test esi, esi
jne 0x100d9d5d
call fcn.101f9fab
mov dword [eax], 0x16
call fcn.101e6c20
jmp 0x100d9d6c
mov eax, dword [0x10205260]
mov dword [esi], eax
mov eax, dword [0x10205264]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push edi
push eax
lea eax, [esi + 8]
push eax
call fcn.10004510
mov eax, dword [ebp - 8]
xor ecx, ecx
add eax, 4
add esp, 0x10
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.10002790
lea ecx, [ebp + 8]
call fcn.10007e10
mov esi, dword [ebp - 4]
push 1
push esi
call fcn.100d9c10
add esp, 8
mov edi, eax
jmp 0x100d9dba
mov esi, dword [ebp - 4]
xor edi, edi
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
pop ebx
jg 0x100d9dd0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100daa60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10259508]
sub esp, 0xc
test al, 1
jne 0x100daa8b
or eax, 1
push 0x4000
mov dword [0x10259508], eax
call fcn.101f9fe1
add esp, 4
mov dword [0x10259504], eax
jmp 0x100daa90
mov eax, dword [0x10259504]
test eax, eax
je 0x100daaf6
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100daaf6
cmp eax, 0x3ffe
ja 0x100daaf6
push dword [0x10259504]
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100daaf6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x10202944
push dword [0x10259504]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100daaf6
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0xa]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100dab60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10259500]
sub esp, 0xc
test al, 1
jne 0x100dab8b
or eax, 1
push 0x4000
mov dword [0x10259500], eax
call fcn.101f9fe1
add esp, 4
mov dword [0x102594fc], eax
jmp 0x100dab90
mov eax, dword [0x102594fc]
test eax, eax
je 0x100dabfd
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100dabfd
cmp eax, 0x3ffe
ja 0x100dabfd
push dword [0x102594fc]
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100dabfd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x10202944
push dword [0x102594fc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100dabfd
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + 0xc]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100dac10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x200c]
push edi
mov edi, dword [ebp + 0xc]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100daca4
cmp eax, 0x1fff
ja 0x100daca4
lea ecx, [ebp - 0x2004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100daca4
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x2008]
push eax
push 0x10202944
lea eax, [ebp - 0x2004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100daca4
mov ecx, dword [ebp - 0x2008]
mov eax, dword [ecx + 0xc]
mov dword [edi], eax
mov eax, dword [ecx + 8]
mov dword [edi + 4], eax
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100dba30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x114]
xor eax, eax
cmp ecx, 5
jne 0x100dbab4
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jne 0x100dba84
mov eax, 0x2710
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x100dba9c
mov eax, 0x2711
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x100dbaf8
mov eax, 0x2712
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp ecx, 6
jne 0x100dbaf8
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jne 0x100dbad6
mov eax, 0x2713
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x100dbaee
mov eax, 0x2714
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jb 0x100dbaf8
mov eax, 0x2715
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100dc8d0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100dc931
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100dc928
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100dd880
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10259510], 0
jne 0x100dd949
push 0x10258e8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10259510], 0
jne 0x100dd93e
call fcn.100de1d0
test eax, eax
je 0x100dd934
push 0xf023f
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], 1
push eax
lea eax, [ebp - 0x40c]
push eax
push str.NoIE4StubProcessing
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100585c0
test eax, eax
jne 0x100dd934
push 0x1025950c
call fcn.100db490
add esp, 4
test eax, eax
je 0x100dd934
cmp dword [0x1025acd4], 0
je 0x100dd934
cmp dword [0x1025ad00], 1
jne 0x100dd934
mov dword [0x1025950c], 9
mov dword [0x10259510], 1
push 0x10258e8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [0x1025950c]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100ddff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de02a
cmp dword [ebp - 0x110], 0
jbe 0x100de03f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de09c
cmp dword [ebp - 0x110], 2
jae 0x100de09e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
jbe 0x100de08c
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100de0c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de15f
cmp dword [ebp - 0x110], 1
jne 0x100de15f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de170
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
je 0x100de1b5
ja 0x100de1b5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x114], 5
sete al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100de220
Capabilities:
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
push 1
push edi
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x100de2d5
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
xor ebx, ebx
cmp dword [ebp - 8], ebx
jbe 0x100de2cc
push esi
xor esi, esi
lea ebx, [ebx]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + esi]
cmp eax, dword [ebp - 0xc]
jne 0x100de2c2
push dword [ebp + 8]
push dword [ecx + esi + 8]
call fcn.101f9fb7
add esp, 8
test eax, eax
jne 0x100de2c2
mov eax, dword [ebp - 4]
push dword [esi + eax + 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100de2bf
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov dword [ebp - 0x10], edi
jmp 0x100de2c2
mov edi, dword [ebp - 0x10]
inc ebx
add esi, 0x10
cmp ebx, dword [ebp - 8]
jb 0x100de270
pop esi
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100de2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10258e64], 0
jne 0x100de403
mov eax, dword [0x1025b450]
push esi
cmp eax, 0xffffffff
je 0x100de351
cmp dword [0x1025b454], 0xffffffff
je 0x100de351
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100de353
cmp dword [0x1025b45c], 0
je 0x100de353
push dword [0x1025b454]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [0x1025b45c]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x1025b450]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100de353
xor esi, esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...deepscanqutmload.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.101b13a0
add esp, 8
test eax, eax
jne 0x100de3a5
lea eax, [ebp - 0x20c]
push eax
call fcn.100a1350
add esp, 4
test eax, eax
je 0x100de3b2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov ecx, 0x1025b450
mov dword [0x10258e64], eax
call fcn.10008cd0
mov eax, dword [0x10258e64]
test eax, eax
je 0x100de402
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddProtectedFile2
push eax
call esi
push str.RemoveProtectedFile2
push dword [0x10258e64]
mov dword [0x10258e68], eax
call esi
push str.RemoveAllProtectedFile2
push dword [0x10258e64]
mov dword [0x10258e6c], eax
call esi
mov dword [0x10258e70], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100e4e80
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x410
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
mov dword [ebp - 0x624], 1
lea eax, [ebp - 0x628]
mov dword [ebp - 0x628], 0x410
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
push str.360DeepscanRunOnce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
push 0x208
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...deepscandsmain.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push str.__s___dbootini
push eax
call fcn.10002cb0
add esp, 0xc
test esi, esi
mov esi, dword [ebp - 0x620]
jne 0x100e4f85
cmp dword [ebp - 0x624], 1
jne 0x100e4f85
push esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x100e4f85
lea edi, [eax + 1]
jmp 0x100e4faa
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.360DeepscanRunOnce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, eax
neg edi
sbb edi, edi
inc edi
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100e4fc2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x101033f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jb 0x1010343e
jne 0x1010342e
cmp dword [ebp - 0x110], 0
je 0x1010343e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x101078a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x10202940
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.1001ce20
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
mov dword [ebp - 0x214], 0x105
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1010791c
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.1001ce20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1010efe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1010f055
push dword [0x10245458]
push str.print_
push dword [esi]
call fcn.101fa01d
add esp, 0xc
test eax, eax
jne 0x1010f055
cmp word [0x1025a3c8], ax
jne 0x1010f032
push 0x104
push 0x1025a3c8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.spooldrivers
push 0x1025a3c8
push 0x1025a3c8
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x104
push 0x1025a3c8
push dword [esi + 0x18]
call fcn.101fa01d
add esp, 0xc
test eax, eax
jne 0x1010f055
mov eax, 1
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1011dab0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x438]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push 0xf013f
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x440], ecx
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x438], 0x400
push eax
push ebx
push dword [0x102462b8]
mov dword [ebp - 0x43c], 3
push SysReAllocString
call fcn.100585c0
test eax, eax
jne 0x1011dcb3
push eax
push 0x10202940
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x408], 7
mov word [ebp - 0x41c], ax
call fcn.100070c0
cmp dword [ebp - 0x43c], 3
jne 0x1011dca8
cmp dword [ebp - 0x438], esi
je 0x1011dca8
cmp byte [ebp - 0x404], 0
je 0x1011dca8
mov al, byte [ebp - 0x3fc]
test al, 0xc
je 0x1011dca8
and al, 3
mov byte [ebp - 0x3fc], al
cmp dword [ebp + 8], esi
jne 0x1011dbc8
test edi, edi
je 0x1011dba0
mov eax, dword [edi]
push esi
push ebx
push 0x200
push dword [0x102462b8]
push SysReAllocString
push edi
call dword [eax + 0x14]
push dword [ebp - 0x438]
lea eax, [ebp - 0x404]
push eax
push 3
push ebx
push dword [0x102462b8]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x1011dbc8
lea esi, [eax + 1]
push dword [ebp - 0x438]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.10006100
add esp, 0xc
lea ecx, [ebp - 0x41c]
push eax
call fcn.1002bd90
lea ecx, [ebp - 0x434]
call fcn.10005250
cmp dword [ebp - 0x408], 8
lea edi, [ebp - 0x41c]
jb 0x1011dc10
mov edi, dword [ebp - 0x41c]
push dword [0x102462b8]
lea ecx, [ebp - 0x450]
call fcn.10002490
push eax
push 0x10202944
lea eax, [ebp - 0x44c]
push SysReAllocString
push eax
call fcn.100dbb30
add esp, 8
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.10007f40
add esp, 0xc
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.10007e90
add esp, 0xc
push 0x102104d0
push edi
push ebx
push dword [eax]
mov eax, dword [ebp - 0x440]
push dword [eax + 0x80]
call fcn.10026170
mov ecx, eax
call fcn.1002b410
lea ecx, [ebp - 0x444]
call fcn.10007e10
lea ecx, [ebp - 0x448]
call fcn.10007e10
lea ecx, [ebp - 0x44c]
call fcn.10007e10
lea ecx, [ebp - 0x450]
call fcn.10007e10
lea ecx, [ebp - 0x41c]
call fcn.10005250
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10121820
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10121854
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
test edi, edi
jne 0x10121871
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10121884
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
call ebx
cmp edi, eax
jb 0x10121886
lea eax, [ebp - 4]
push eax
push esi
call ebx
mov edi, eax
cmp dword [ebp - 4], 0
je 0x1012189c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101218af
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [edi + 1]
push 0x1025c02a
push eax
call fcn.101c85a0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10121906
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101218fd
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov byte [eax + ebx], 0
push dword [ebp - 8]
push ebx
call fcn.10005680
add esp, 0xc
mov dword [ebp - 0xc], 1
push ebx
call fcn.101f9fe7
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret