joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100145d2
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.EC7BE5B8_72F1_48d6_A57C_D1AA2E5CF5BD
push 0
mov ecx, 0x101f8c68
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x1001460a
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001460a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x10015027
Capabilities:
Read file on windows

Disassembly:
push 0x34
mov eax, 0x1017a2ba
call fcn.10145de9
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], edi
call fcn.100145d2
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x10015160
lea eax, [ebp - 0x34]
push eax
call fcn.1011de11
mov dword [esp], str.dnlist.dat
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], edi
call fcn.10007b6e
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10003b75
push ecx
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x40], esp
push eax
call fcn.10007ade
call fcn.1011d27b
mov esi, eax
cmp esi, 0x100000
pop ecx
mov dword [ebp - 0x28], edi
jae 0x1001514f
push esi
call fcn.10144fc2
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x10015141
push esi
push edi
push ebx
call fcn.10146c80
push 0x101a04a8
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
call fcn.10147b95
add esp, 0x18
test eax, eax
jne 0x10015138
cmp dword [ebp - 0x28], edi
je 0x10015138
push dword [ebp - 0x28]
push 1
push esi
push ebx
call fcn.10147aa1
add esp, 0x10
cmp eax, 1
jne 0x10015138
xor eax, eax
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push 0x101a047c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
call fcn.10073784
add esp, 0x24
test esi, esi
jbe 0x10015138
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
push esi
push ebx
push 0
call fcn.10121060
add esp, 0x14
push ebx
call fcn.10145563
pop ecx
xor edi, edi
cmp dword [ebp - 0x28], edi
je 0x1001514f
push dword [ebp - 0x28]
call fcn.101475da
pop ecx
push dword [ebp - 0x3c]
call fcn.1001460e
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.10003b75
mov eax, dword [ebp - 0x30]
call fcn.10145e6c
ret 4

Function at 0x1001630e
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 4
push ecx
push 0x10016226
push 0
push 0
call fcn.10147cdf
mov esi, eax
add esp, 0x18
test esi, esi
je 0x10016349
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x100167f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 4
push dword [esi]
mov dword [ebp - 8], esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x100168bf
push ebx
push edi
mov edi, dword [0x101f9aac]
push str.BASIC_RC
push 0x11e
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x100168bd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100168bd
cmp eax, 0xffffffff
je 0x100168bd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100168bd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 3
jbe 0x100168bd
cmp byte [esi], 0xef
mov ecx, esi
jne 0x10016886
cmp byte [esi + 1], 0xbb
jne 0x10016886
cmp byte [esi + 2], 0xbf
jne 0x10016886
lea ecx, [esi + 3]
sub eax, 3
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 4]
push edx
push eax
push ecx
push 0xfde9
call fcn.10121060
add esp, 0x14
test eax, eax
jle 0x100168bd
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.1000be85
push dword [ebp - 4]
call fcn.10145563
pop ecx
pop edi
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
pop esi
leave
ret

Function at 0x10016f0e
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x10016f64
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x10016f7a
push 0x80004005
call fcn.1000104f
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10016f7d
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10018519
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.10016ed9
mov edi, eax
cmp edi, esi
je 0x10018581
lea ecx, [ebp - 0x70]
call fcn.10016e74
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10145d71
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10018599
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10018519
cmp eax, esi
jne 0x100185cc
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x10018589
lea ecx, [ebp - 0x70]
call fcn.10016e74
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.10016e74
mov eax, esi
jmp 0x10018567
Function at 0x1001d25e
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x1017ad4a
call fcn.10145d80
mov esi, str.istsign
push esi
mov ebx, str.SoftwareBaiduBaiduToolbar
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call fcn.1011fd92
add esp, 0xc
test eax, eax
je 0x1001d465
push esi
push ebx
push edi
call fcn.1011f94c
mov eax, dword [0x101f3028]
add esp, 0xc
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, 0x101f84e8
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.1005158c
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10003b75
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.10050d1a
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10003b75
push str.qdmcmc
push ebx
push edi
call fcn.1011fd92
add esp, 0xc
test eax, eax
je 0x1001d338
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.10050ce5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10003b75
lea eax, [ebp - 0x14]
push eax
call fcn.1011dcfe
pop ecx
mov esi, str.BaiduBarX.dll
push esi
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 6
call fcn.10007b6e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.10003b75
lea eax, [ebp - 0x34]
push eax
call fcn.1011e282
pop ecx
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 9
call fcn.10007b6e
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.10003b75
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call fcn.1011ccdb
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2c]
call fcn.1011ccdb
call fcn.1011c4cf
fmul qword [0x101a1c98]
call fcn.10148236
mov ecx, dword [0x101f3028]
mov dword [ebp - 0x14], ecx
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xc
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.http:__bar.baidu.com_sobar_istinfo.html_id_stn_sver_dctn_scver_diver_d
push eax
call fcn.10004662
lea eax, [ebp - 0x10]
push str.bd_notice
push eax
call fcn.1011f647
add esp, 0x38
push 1
push 0x4e20
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x34], esp
push eax
mov byte [ebp - 4], 0xd
call fcn.10007ade
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
mov byte [ebp - 4], 0xe
call fcn.10007ade
mov byte [ebp - 4], 0xd
call fcn.1011af35
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
lea ecx, [ebp - 0x2c]
call fcn.10003b75
lea ecx, [ebp - 0x30]
call fcn.10003b75
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp - 0x20]
call fcn.10003b75
call fcn.10145e58
ret
Function at 0x1001d647
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 1
push esi
jne 0x1001d721
push 0x101a0ce4
push dword [ebp + 8]
mov ecx, 0x101f7cf4
push 0x101f3130
call fcn.10017512
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor esi, esi
cmp eax, esi
je 0x1001d699
push str.iexplore.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001d699
call fcn.1000f816
lea eax, [ebp + 0xc]
push eax
call fcn.1011ddb9
pop ecx
lea ecx, [ebp + 0xc]
call fcn.10004076
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharLowerW]
push esi
push str.explorer.exe
lea ecx, [ebp + 0xc]
call fcn.10003b43
cmp eax, 0xffffffff
je 0x1001d6d6
lea ecx, [ebp + 0xc]
call fcn.10003b75
xor eax, eax
jmp 0x1001d835
mov esi, 0x101f84e8
mov ecx, esi
call fcn.10050b3b
push eax
call fcn.1009ebc5
pop ecx
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.10055672
push eax
mov ecx, 0x101f9270
call fcn.10007845
lea ecx, [ebp + 8]
call fcn.10003b75
call fcn.1008d46a
push 1
call fcn.100ffadb
pop ecx
lea ecx, [ebp + 0xc]
call fcn.10003b75
jmp 0x1001d832
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x1001d832
mov ecx, dword [0x101f8440]
cmp ecx, esi
je 0x1001d743
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [0x101f8440], esi
push ebx
push edi
push esi
call fcn.100ffadb
cmp dword [0x101f87d4], esi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ecx
je 0x1001d78b
cmp dword [0x101f87d8], esi
je 0x1001d78b
mov esi, 0x101f8fb0
push esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1001d78b
mov eax, dword [0x101f87d8]
mov ecx, dword [eax]
push str.http
push dword [0x101f87d4]
push eax
call dword [ecx + 0x10]
push esi
call edi
mov ebx, 0x101f9088
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x101f8d6c]
mov esi, 0x101f8d68
push esi
push dword [eax]
lea ecx, [ebp - 8]
call fcn.1001a47d
jmp 0x1001d7f8
call fcn.10018c20
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 8]
call fcn.10018c20
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 8]
call fcn.10018c20
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
cmp eax, 2
lea ecx, [ebp - 8]
ja 0x1001d7ae
call fcn.10018c20
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 8]
call fcn.10018e9b
push esi
push dword [0x101f8d6c]
lea ecx, [ebp - 0x10]
call fcn.1001a47d
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001767d
test al, al
je 0x1001d7cb
mov ecx, esi
call fcn.1001d621
push ebx
call edi
call fcn.1000f56b
mov ecx, 0x101f7cf4
call fcn.10018893
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
leave
ret 0xc
Function at 0x1001f0b1
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x1001f0f6
cmp dword [esi + 0x3c], eax
je 0x1001f0f6
lea edi, [esi + 0x44]
mov ecx, edi
call fcn.10004cde
test eax, eax
jbe 0x1001f0f6
push dword [esi + 0x54]
mov ecx, edi
call fcn.10004cf1
push dword [eax]
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.10147f14
xor eax, eax
add esp, 0xc
inc eax
jmp 0x1001f109
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x1001fc86
Capabilities:
Get graphical window text

Disassembly:
push 0x10
mov eax, 0x1017b0f4
call fcn.10145d80
mov esi, ecx
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
call fcn.1007a762
cmp dword [ebp - 0x14], edi
pop ecx
je 0x1001fd84
mov eax, dword [0x101f3028]
mov dword [ebp - 0x10], eax
push 0x401
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.1000401e
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, 0x400
push ebx
push eax
push dword [esi + 4]
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100041f7
cmp word [ebp + 0xc], 0xd
je 0x1001fcf2
cmp word [ebp + 0xc], 0xa
jne 0x1001fd76
cmp word [ebp + 0xc], 0xa
jne 0x1001fd6f
mov eax, dword [0x101f3028]
mov dword [ebp + 0xc], eax
push 0x401
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.1000401e
push ebx
push eax
push dword [esi + 4]
call edi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
call fcn.100041f7
lea eax, [ebp + 0xc]
push eax
push str.www.
lea eax, [ebp - 0x1c]
push eax
call fcn.1000ed2f
push str..com
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.10007b6e
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.10003b75
mov ecx, esi
call fcn.1001f7c9
mov eax, dword [ebp + 0x14]
and dword [eax], 0
lea ecx, [ebp - 0x10]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret 0x10
Function at 0x100224e7
Capabilities:
Check for unmoving mouse cursor
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x18
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov dword [eax], 1
jl 0x1002260e
mov eax, dword [ebp + 0xc]
sub eax, 0x200
push ebx
push edi
je 0x10022551
sub eax, 0xa
jne 0x1002260c
push dword [esi + 0x40]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
call edi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x10022534
push 0
push dword [esi + 0x40]
call ebx
add esi, 0xa8
push dword [esi]
call edi
test eax, eax
je 0x1002260c
push 0
push dword [esi]
call ebx
jmp 0x1002260c
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
je 0x100225a7
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100225a7
lea eax, [ebp - 8]
push eax
call edi
lea eax, [ebp - 8]
push eax
push dword [esi + 0x40]
call ebx
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x100225fd
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10022605
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10022605
lea eax, [ebp - 8]
push eax
call edi
lea eax, [ebp - 8]
push eax
push dword [esi + 0xa8]
call ebx
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x10022605
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x1002260c
mov ecx, esi
call fcn.10022229
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x10023c25
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
sub esp, 0x39c
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push 8
mov eax, 0x1017b6d2
call fcn.10145d80
mov eax, dword [0x101f3028]
mov edi, ecx
lea esi, [edi + 4]
mov dword [ebp - 0x14], edi
mov dword [esi], eax
lea eax, [ebp]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 4], 4
jne 0x10023c86
cmp dword [ebp + 0x10], 1
jne 0x10023cbb
push str.BDGuard.VXD
push str.._s
jmp 0x10023ca8
cmp dword [ebp + 4], 5
jne 0x10023cbb
cmp dword [ebp + 8], ebx
jne 0x10023c98
push str.BDGuard
jmp 0x10023c7f
cmp dword [ebp + 8], 1
jb 0x10023cbb
push str.BDGuard
push str..Global_s
push 0xffffffffffffffff
lea eax, [ebp + 0x31c]
push 0x40
push eax
call fcn.1014612c
add esp, 0x14
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
lea eax, [ebp + 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x206
mov dword [edi], eax
lea eax, [ebp + 0x116]
push ebx
push eax
mov word [ebp + 0x114], bx
call fcn.10146c80
add esp, 0xc
push 0x104
lea eax, [ebp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x114]
push eax
mov ecx, esi
call fcn.1000425b
mov eax, dword [esi]
mov ecx, dword [eax - 8]
movzx eax, word [eax + ecx*2 - 2]
cmp ax, 0x5c
je 0x10023d46
push 0x5c
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.10023c05
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10007845
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x3a0
leave
ret

Function at 0x10023d6b
Capabilities:
Delete file
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10023d7b
xor eax, eax
jmp 0x10023db8
push dword [ebp + 8]
add ecx, 4
push ecx
lea eax, [ebp - 4]
push eax
call fcn.10007b6e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp + 8]
push str.SystemCurrentControlSetServicesBdGuardmodules
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x10023dae
xor esi, esi
inc esi
lea ecx, [ebp - 4]
call fcn.10003b75
mov eax, esi
pop esi
leave
ret 4

Function at 0x1002504f
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x101f7d24], edi
jne 0x100250a7
push esi
push edi
push 4
push edi
push 0x10024e7e
push edi
push edi
call fcn.10147cdf
mov esi, eax
add esp, 0x18
cmp esi, edi
je 0x1002509a
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x101f7d24], edi
pop esi
jne 0x100250a7
xor eax, eax
pop edi
ret
xor eax, eax
inc eax
pop edi
ret
Function at 0x100258e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x1c], 0
test eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x20], eax
je 0x100259cd
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jbe 0x100259cc
push edi
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 8]
lea eax, [eax + ebx + 4]
push eax
push dword [esi + 4]
mov byte [ebp - 6], 0x38
call fcn.1014692a
test eax, eax
pop ecx
pop ecx
je 0x100259cb
mov ecx, dword [esi + 8]
lea edi, [ecx + eax]
mov dword [esi + 4], eax
lea eax, [ecx + ebx + 4]
push ebx
push dword [ebp - 0x20]
mov byte [ebp - 5], 0x35
mov dword [esi + 8], eax
mov dword [edi], ebx
add edi, 4
push edi
mov byte [ebp - 0x18], 0x39
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0x37
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x38
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0x33
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x34
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0x43
mov byte [ebp - 8], 0x41
mov byte [ebp - 7], 0x32
call fcn.10147010
push 0xa0
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.10073949
add esp, 0x1c
mov dword [ebp - 0x1c], 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop esi
call fcn.10145d71
leave
ret 8
Function at 0x100265a6
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100266d5
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x100266d5
push esi
push edi
push eax
call fcn.1013c5c9
mov dword [ebp - 4], eax
add eax, 0xc
push eax
call fcn.10144fc2
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 8], edi
je 0x100266b1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push ebx
push edi
call fcn.10146c80
mov eax, dword [ebp + 8]
mov esi, str.BarData
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 8]
mov byte [edi + 7], 1
mov ecx, dword [eax + 4]
mov dword [edi + 8], ecx
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.1013c5ae
add esp, 0x1c
test eax, eax
jne 0x10026633
mov eax, dword [ebp - 4]
add eax, 0xc
mov dword [ebp - 0xc], eax
jmp 0x1002663f
push edi
call fcn.10145563
pop ecx
mov dword [ebp - 0xc], ebx
mov edi, ebx
cmp edi, ebx
je 0x100266b1
push ebx
push ebx
push ebx
push ebx
push 0x101a2c60
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, dword [ebp + 8]
movzx ecx, word [esi + 0x10]
push ebx
push ebx
push 3
push ebx
push ebx
mov dword [ebp - 8], eax
mov eax, dword [esi + 8]
push ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, dword [esi + 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push str.POST
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push dword [ebp - 0xc]
mov esi, eax
push edi
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 8]
call esi
push edi
call fcn.10145563
pop ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, ebx
je 0x100266c1
push eax
call fcn.10146bbe
pop ecx
mov ecx, esi
call fcn.10025c1b
push esi
call fcn.10145084
pop ecx
pop edi
xor eax, eax
pop esi
jmp 0x100266d8
or eax, 0xffffffff
pop ebx
leave
ret 4