joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005b56
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1000e340
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10005b8e
push 1
pop eax
jmp 0x10005c35
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x10005bf9
cmp byte [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10005bb4
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x10005bb0
cmp byte [edi + 0x2e], 0
je 0x10005c11
test al, al
je 0x10005c11
push ecx
call fcn.1000e340
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10005c11
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.1000e260
push 0x1008d8d8
push esi
call fcn.1000e260
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10005b56
add esp, 0x20
mov byte [ebx + esi - 1], 0x2a
and byte [ebx + esi], 0
mov dword [ebp + 8], eax
jmp 0x10005c11
push dword [ebp + 0x14]
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov byte [ebx + esi - 1], 0x2a
cmp dword [ebp + 8], 0
je 0x10005c29
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10005b95
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005cf8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1000e8fa
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10005d30
push 1
pop eax
jmp 0x10005de4
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x10005da5
cmp word [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10005d5c
mov ax, word [edi + 0x2e]
cmp ax, 0x2e
jne 0x10005d57
cmp word [edi + 0x30], 0
je 0x10005dc0
test ax, ax
je 0x10005dc0
push ecx
call fcn.1000e8fa
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10005dc0
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.1000e8ab
push 0x1008d8dc
push esi
call fcn.1000e8ab
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10005cf8
add esp, 0x20
mov word [esi + ebx*2 - 2], 0x2a
and word [esi + ebx*2], 0
mov dword [ebp + 8], eax
jmp 0x10005dc0
push dword [ebp + 0x14]
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov word [esi + ebx*2 - 2], 0x2a
cmp dword [ebp + 8], 0
je 0x10005dd8
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005d37
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100064f9
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10006666
push esi
call fcn.1000e340
test eax, eax
pop ecx
je 0x10006666
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006666
test bl, 1
je 0x10006540
and ebx, 0xfffffffe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x1000665d
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.1000e250
lea eax, [ebp - 0x104]
push 0x1008d8d8
push eax
call fcn.1000e260
and dword [ebp - 0x244], 0
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x240]
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006653
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x218]
push 0x1008d910
push eax
call edi
test eax, eax
je 0x10006636
lea eax, [ebp - 0x218]
push 0x1008d90c
push eax
call edi
test eax, eax
je 0x10006636
and byte [ebp - 0x348], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x347]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push eax
call fcn.1000e250
lea eax, [ebp - 0x104]
push 0x1008d84c
push eax
call fcn.1000e260
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1000e260
lea eax, [ebp - 0x348]
push eax
call fcn.100064f9
add esp, 0x1c
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100065b5
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
jmp 0x10006668
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10006668
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1000666c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10006802
push esi
call fcn.1000e8fa
test eax, eax
pop ecx
je 0x10006802
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10004528
add esp, 0x1c
test eax, eax
je 0x10006802
cmp dword [ebp - 4], 0xffffffff
je 0x10006802
test byte [ebp - 4], 1
je 0x100066ce
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 4], 0x10
je 0x100067f9
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
call fcn.1000e8d5
lea eax, [ebp - 0x210]
push 0x1008d8dc
push eax
call fcn.1000e8ab
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x45c]
mov dword [ebp - 0x460], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x100067ed
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x434]
push 0x1008d91c
push eax
call edi
test eax, eax
je 0x100067cc
lea eax, [ebp - 0x434]
push 0x1008d918
push eax
call edi
test eax, eax
je 0x100067cc
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x666]
mov word [ebp - 0x668], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x668]
push eax
call fcn.1000e8d5
lea eax, [ebp - 0x210]
push 0x1008d914
push eax
call fcn.1000e8ab
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000e8ab
lea eax, [ebp - 0x668]
push eax
call fcn.1000666c
add esp, 0x1c
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000674b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
jmp 0x10006804
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10006804
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1000684b
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push dword [ebp + 0xc]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006916
test bl, 1
je 0x1000687f
and ebx, 0xfffffffe
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x10006916
and byte [ebp - 0x204], 0
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
mov ebx, str._s.bak_08X
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.1000ea9f
and dword [ebp - 4], 0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
cmp eax, 0xffffffff
je 0x10006906
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
lea eax, [ebp - 0x204]
push dword [ebp + 0xc]
push ebx
push eax
call fcn.1000ea9f
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x100068cd
xor eax, eax
jmp 0x10006925
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10006af6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
call fcn.1003a080
test eax, eax
je 0x10006b13
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
je 0x10006b7c
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x10006b7c
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.1000eb00
push esi
call fcn.1006fb58
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10006b7c
push esi
push ebx
push edi
call fcn.1000eb00
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x10006b7c
push esi
xor ebx, ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
call fcn.10003bd7
add esp, 0x10
test eax, eax
je 0x10006b7c
push dword [ebp + 0xc]
call fcn.1000e8fa
pop ecx
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x100071b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push 2
push 0
push 0xffffffffffffffb8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and byte [ebp - 0x4c], 0
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x4c]
push 0x48
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x100071f9
xor eax, eax
leave
ret
cmp dword [ebp - 4], 0x48
jb 0x100071f5
push 0x10
lea eax, [ebp - 0x4c]
push str._TOSDEX_End__
push eax
call fcn.1000f840
add esp, 0xc
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x10008b20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
push str.TEC_OCULAR__AGENT_V3_MUTEX_OAGENTTRAY
call fcn.10004293
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
pop edi
jne 0x10008b83
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
inc eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
leave
ret

Function at 0x10009511
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x10009589
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.10009ca6
test eax, eax
jne 0x10009566
push esi
mov esi, str.TRMenuShl_extension
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push str.B30370BA_F8EA_485F_9C31_B51603CBEF61
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x1000957b
cmp dword [ebp - 4], edi
je 0x10009574
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x10009595
cmp dword [ebp - 4], edi
je 0x10009589
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x100a4bc8
call fcn.1000b326
pop edi
leave
ret

Function at 0x10009598
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
jne 0x100095e2
and dword [ebp - 4], 0
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
call fcn.10009ca6
test eax, eax
jne 0x100095d3
push str.B30370BA_F8EA_485F_9C31_B51603CBEF61
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 4], 0
je 0x100095e2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x100a4bc8
call fcn.1000b4ac
leave
ret
Function at 0x1000984c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
mov eax, 0x1007c6e9
call fcn.1000e84c
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [esi + 0xc], 0
mov dword [esi + 4], 0x10080c24
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0x10080c0c
call fcn.100072d6
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10002d40
lea edi, [esi + 0x30]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.10007f19
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 2
call fcn.1002c7f0
push 0x104
lea eax, [esi + 0x34]
push 0
push eax
call fcn.1000eb00
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [edi], esi
mov dword [esi + 0x14], esi
mov dword [esi + 0x1c], esi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10009bda
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x1007c729
call fcn.1000e84c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x138]
mov dword [ebp - 4], 2
call fcn.1002c800
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.10007f1f
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10002d72
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x10]
call fcn.100072ff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1000a0a7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x1000a0c1
xor esi, esi
jmp 0x1000a0ef
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.1000ea70
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x1000a12a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1000a123
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000a1bf
xor esi, esi
jmp 0x1000a1bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000a14d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x1000a160
xor esi, esi
jmp 0x1000a1b6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x1000a172
jmp 0x1000a13d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000a1b6
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x1000a1a8
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.1000ea70
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.1000eb60
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.1000a226
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1000abf7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1007c7b8
call fcn.1000e84c
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.10009ca6
mov edi, eax
cmp edi, esi
je 0x1000ac41
cmp dword [ebp - 0x10], esi
je 0x1000ac3a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000acde
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x1000acb2
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.1000abf7
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x1000ac9f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x1000ac64
cmp dword [ebp - 0x10], esi
je 0x1000acad
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x1000acde
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1000acc5
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x1000acdc
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1000acef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.1000ea70
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.1000a37f
xor edi, edi
cmp eax, edi
jl 0x1000aea7
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.1000aeb4
pop ecx
test eax, eax
pop ecx
jne 0x1000ad3a
mov eax, 0x80020009
jmp 0x1000aea7
mov ecx, esi
call fcn.1000a357
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.1000a37f
cmp eax, edi
jl 0x1000aea7
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x1000ae6f
sub eax, 9
je 0x1000add4
dec eax
dec eax
jne 0x1000ae96
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x1000ad7f
xor ebx, ebx
jmp 0x1000adb4
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.1000ea70
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x1000ae87
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x1000ae10
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.1000ea70
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call fcn.1000eb00
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x1000ae1a
mov eax, 0x80004005
jmp 0x1000aea7
cmp dword [ebp - 8], 0
jle 0x1000ae54
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.1000af3b
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x1000ae20
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x1000ae96
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.1000a37f
cmp eax, edi
jl 0x1000aea7
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1000d325
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
xor edi, edi
cmp dword [0x100a4ebc], edi
jne 0x1000d480
push 1
pop ebx
push dword [esp + 0xc]
mov dword [0x100a4ebc], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x100a4ec4], eax
je 0x1000d480
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallDriver
push eax
call esi
push str.UninstallDriver
mov dword [0x100a4ec8], eax
push dword [0x100a4ec4]
call esi
push str.MtoVolume
mov dword [0x100a4ecc], eax
push dword [0x100a4ec4]
call esi
push str.MtoVolumeEx
mov dword [0x100a4ed0], eax
push dword [0x100a4ec4]
call esi
push str.UMtoVolume
mov dword [0x100a4ed4], eax
push dword [0x100a4ec4]
call esi
push str.UMtoVolumeEx
mov dword [0x100a4ed8], eax
push dword [0x100a4ec4]
call esi
push str.GetRealDeviceName
mov dword [0x100a4edc], eax
push dword [0x100a4ec4]
call esi
push str.TSDInstall
mov dword [0x100a4ee0], eax
push dword [0x100a4ec4]
call esi
push str.TSDUninstall
mov dword [0x100a4ee4], eax
push dword [0x100a4ec4]
call esi
push str.TSDMount
mov dword [0x100a4ee8], eax
push dword [0x100a4ec4]
call esi
push str.TSDUnmount
mov dword [0x100a4eec], eax
push dword [0x100a4ec4]
call esi
push str.TSDGetRealDeviceName
mov dword [0x100a4ef0], eax
push dword [0x100a4ec4]
call esi
push str.TSDChangePw
mov dword [0x100a4ef4], eax
push dword [0x100a4ec4]
call esi
cmp dword [0x100a4ec8], edi
mov dword [0x100a4ef8], eax
pop esi
je 0x1000d480
cmp dword [0x100a4ecc], edi
je 0x1000d480
cmp dword [0x100a4ed0], edi
je 0x1000d480
cmp dword [0x100a4ed4], edi
je 0x1000d480
cmp dword [0x100a4ed8], edi
je 0x1000d480
cmp dword [0x100a4edc], edi
je 0x1000d480
cmp dword [0x100a4ee0], edi
je 0x1000d480
mov dword [0x100a4ec0], ebx
mov eax, dword [0x100a4ec0]
pop edi
pop ebx
ret

Function at 0x10023fd0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x10024029
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10024029
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x10024030
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1002400d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1002402b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret