joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404ef0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x404f2c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x404f2c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405003
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404f54
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404f60
movsx eax, bl
jmp 0x404f98
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x404fc2
sub eax, 1
je 0x404fc2
sub eax, 2
jne 0x405003
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404fe0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x405003
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406866
mov esp, ebp
pop ebp
ret 4
Function at 0x405750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40580c
cmp byte [esi + 0x3d], 0
je 0x40580c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4057fa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4057c1
sub eax, 1
je 0x4057c5
sub eax, 2
jne 0x4057fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4057e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4057fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406866
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00406866
mov esp, ebp
pop ebp
ret

Function at 0x40756f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4075ae
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4075ae
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4075ae
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4075ae
cmp dword [ecx + 0x74], 0xe
jbe 0x4075ae
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
push esi
push str._n___________NAND_n___________________________________
call fcn.00401000
mov ecx, dword [0x418eb4]
add esp, 4
mov esi, 1
test ecx, ecx
je 0x4010bf
mov eax, 0x1c
push ecx
lea eax, [eax + str.Unknown]
push eax
push esi
push str._n__2i___9.9s_____08x
call fcn.00401000
inc esi
add esp, 0x10
lea eax, [esi*8]
sub eax, esi
shl eax, 2
mov ecx, dword [eax + 0x418e98]
test ecx, ecx
jne 0x401092
push 0x414df4
call fcn.00401000
add esp, 4
push 0
call fcn.00404d98
int3

Function at 0x4010e0
Capabilities:
Terminate process

Disassembly:
xor eax, eax
mov dword [0x419d50], ecx
mov dword [0x419d20], eax
cmp dword [0x418e98], eax
je 0x401128
mov edx, 0x418e98
lea ebx, [ebx]
lea edx, [edx + 0x1c]
inc eax
cmp dword [edx], 0
jne 0x401100
mov dword [0x419d20], eax
cmp ecx, eax
jae 0x401128
lea eax, [ecx*8]
sub eax, ecx
mov eax, dword [eax*4 + 0x418e98]
mov dword [0x418e94], eax
ret
push ecx
push str._n_________i
call fcn.00401000
add esp, 8
push 1
call fcn.00404d98
int3
Function at 0x40ed0a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040904d
mov dword [ebp - 0x14], eax
cmp dword [0x419cf0], edi
jne 0x40edfb
push 0x800
push edi
push 0x4123ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40ed88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40eedb
push 0x4123ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40eedb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40eedb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x419cf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x419cf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x419cf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x419d00], eax
test eax, eax
je 0x40edf8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x419cfc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ee20
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ee13
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40ee35
push 4
pop eax
jmp 0x40eedd
cmp dword [ebp - 0x14], edi
je 0x40ee35
push dword [0x419cf0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ee1a
mov eax, dword [0x419cfc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40ee93
cmp dword [0x419d00], esi
je 0x40ee93
push eax
call ebx
push dword [0x419d00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40ee93
test eax, eax
je 0x40ee93
call ecx
test eax, eax
je 0x40ee88
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ee88
test byte [ebp - 8], 1
jne 0x40ee93
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40eec3
mov eax, dword [0x419cf4]
cmp eax, esi
je 0x40eec0
push eax
call ebx
test eax, eax
je 0x40eec0
call eax
mov edi, eax
test edi, edi
je 0x40eec0
mov eax, dword [0x419cf8]
cmp eax, esi
je 0x40eec0
push eax
call ebx
test eax, eax
je 0x40eec0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x419cf0]
call ebx
test eax, eax
je 0x40eedb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40eedd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040cb
leave
ret
Function at 0x101a509
Capabilities:
Encode data using xor

Disassembly:
push InitializeCriticalSection
push reloc.KERNEL32.dll_HeapSetInformation
call fcn.010146f4
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
lea esi, [ebp - 0x30]
xor eax, eax
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
je reloc.COMCTL32.dll_Ordinal_344
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 0x24], 0x2000000
je reloc.COMCTL32.dll_Ordinal_344
mov dword [ebp - 0x1c], 4
test dword [ebp - 0x24], 0x4000000
je reloc.COMCTL32.dll_Ordinal_344
or dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x1c]
jmp reloc.COMCTL32.dll_Ordinal_344
xor eax, eax
call fcn.01014739
ret

Function at 0x101caec
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push reloc.WINMM.dll_timeGetTime
mov esi, ecx
call fcn.01013f7b
xor ebx, ebx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x2314], ebx
jbe reloc.COMCTL32.dll_Ordinal_344
push edi
lea edi, [esi + 0x176c]
push dword [ebp - 4]
mov ecx, esi
call fcn.0101c1d1
cmp byte [edi + 1], bl
je reloc.COMCTL32.dll_Ordinal_344
mov eax, dword [esi]
mov ecx, esi
call dword [eax + reloc.msvcrt.dll__CIsin]
mov byte [edi + 1], bl
cmp byte [edi], bl
je reloc.COMCTL32.dll_Ordinal_344
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
mov byte [edi], bl
push dword [ebp - 4]
push reloc.WINMM.dll_timeGetTime
call fcn.01013f7b
mov eax, dword [esi + 0x2344]
pop ecx
pop ecx
cmp eax, ebx
je reloc.COMCTL32.dll_Ordinal_344
mov ecx, dword [eax]
push eax
call dword [ecx + reloc.USER32.dll_DefWindowProcW]
mov dword [esi + 0x2344], ebx
push dword [ebp - 4]
push reloc.WINMM.dll_timeGetTime
call fcn.01013f7b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
pop ecx
add edi, reloc.COMCTL32.dll_Ordinal_344
pop ecx
cmp eax, dword [esi + 0x2314]
jb reloc.COMCTL32.dll_Ordinal_344
pop edi
push reloc.WINMM.dll_timeGetTime
mov dword [esi + 0x2314], ebx
call fcn.01013f7b
add esi, reloc.COMCTL32.dll_Ordinal_344
mov eax, dword [esi]
pop ecx
cmp eax, ebx
je reloc.COMCTL32.dll_Ordinal_344
mov ecx, dword [eax]
push eax
call dword [ecx + reloc.USER32.dll_DefWindowProcW]
mov dword [esi], ebx
push reloc.WINMM.dll_timeGetTime
call fcn.01013f7b
mov dword [esp], 0x1011420
call fcn.01013f7b
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x10001746
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
push 0x100016a3
push esi
push esi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10001775
xor al, al
jmp 0x10001798
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000182e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
cmp dword [0x100113bc], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0x61647075
mov word [ebp - 8], 0x6574
jne 0x10001861
call esi
mov dword [0x100113bc], eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 2]
push eax
lea edx, [ebp - 1]
lea ecx, [ebp - 0x34]
call fcn.10004b1c
pop ecx
pop ecx
test al, al
jne 0x10001881
xor al, al
jmp 0x1000193c
push str.d1mib3adbtgkgp.cloudfront.net
mov edx, 0x100113d0
mov ecx, 0x100113d8
call fcn.1000161c
pop ecx
test al, al
je 0x1000187a
push dword [ebp + 0x10]
lea eax, [edi + 0x410]
push eax
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
call esi
sub eax, dword [0x100113bc]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
push dword [ebp + 8]
movzx eax, byte [ebp - 3]
push eax
movzx eax, byte [ebp - 2]
push eax
movzx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x208]
push eax
push edi
push str.003284
push ebx
call esi
xor edx, edx
mov ecx, 0x186a0
div ecx
lea eax, [ebp - 0x448]
push edx
push str.015b464
push str.iver_wsrnd_devent_dcampaign_wsbrowsercwibic_wsverifier_wsjs_wsbit_dadm_duac_dintevent_dinc_dup_drbic_ws_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x100113d0]
lea eax, [ebp - 0xc]
push 6
push eax
lea edx, [ebp - 0x448]
call fcn.1000179d
add esp, 0x4c
mov bl, al
cmp byte [ebp + 0xc], 0
je 0x1000193a
mov edx, 0x100113d0
mov ecx, 0x100113d8
call fcn.1000167a
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001a5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xa
mov esi, edx
mov dword [ebp - 8], 0x45f49414
pop eax
cmp esi, eax
mov byte [ebp - 4], 0xfe
mov edi, ecx
cmova esi, eax
xor ecx, ecx
test esi, esi
je 0x10001a98
push ebx
xor edx, edx
mov eax, ecx
push 5
pop ebx
div ebx
mov al, byte [ebp + edx - 8]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x10001a82
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001b39
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
and dword [ebp - 4], 0
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, edx
mov esi, ecx
je 0x10001b57
call fcn.1000408d
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ecx, 0xb7
test eax, eax
je 0x10001b76
cmp eax, ecx
je 0x10001b76
xor al, al
jmp 0x10001c76
cmp eax, ecx
push edi
sete byte [ebp + 0x1b]
and dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jbe 0x10001c73
add ebx, 0xc
push dword [ebx]
lea eax, [ebp - 0x21c]
push esi
push str._s_s
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
dec eax
cmp eax, 0x102
ja 0x10001c83
mov eax, dword [ebx - 4]
lea ecx, [ebp - 4]
mov edx, dword [ebx - 8]
push ecx
mov ecx, dword [ebx - 0xc]
push eax
mov dword [ebp - 8], eax
call fcn.10001a9e
pop ecx
pop ecx
test al, al
je 0x10001c83
cmp dword [ebp + 0xc], 0
je 0x10001bf8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx]
call dword [ebp + 0xc]
add esp, 0x10
test al, al
je 0x10001c83
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001c83
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001c7c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x10001c7c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10001c5c
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xc]
add ebx, 0x10
and dword [ebp - 4], 0
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp + 8]
jb 0x10001b8e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10001c9b
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp + 0x1b], 0
jne 0x10001ca8
mov ecx, esi
call fcn.1000408d
xor al, al
jmp 0x10001c75
Function at 0x10001cac
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], 4
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001dcc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.InstallDate
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001dcc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp - 8]
add eax, ecx
add eax, edx
cdq
add eax, 0xb6109100
push ebx
push 0x989680
adc edx, 2
push edx
push eax
call sub.ntdll.dll__allmul
mov dword [ebp - 0x14], eax
mov eax, edx
sar eax, 0x1f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], edx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
test eax, eax
je 0x10001dcc
movzx ecx, word [ebp - 0xc]
mov eax, ecx
and eax, 0x1f
push eax
mov eax, ecx
shr ecx, 9
shr eax, 5
and ecx, 0x3f
and eax, 0xf
add ecx, 0x7bc
push eax
push ecx
push str._d_02d_02d
lea eax, [ebp - 0xa0]
push 0x3f
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x18
test eax, eax
jle 0x10001dcc
cmp eax, 0x104
je 0x10001dcc
lea eax, [eax*2 + 2]
xor edi, edi
push eax
lea eax, [ebp - 0xa0]
inc edi
push eax
push edi
push ebx
push str.InstallDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
cmp dword [ebp - 4], 0
je 0x10001ddb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001de4
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push edx
push ecx
push str._s___s__2
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
test eax, eax
jle 0x10001f17
cmp eax, esi
je 0x10001f17
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10001f17
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 0x618
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10001f17
mov esi, dword [ebp + 0xc]
add esi, 0x820
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push ebx
push str.Publisher
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f17
push str.1.5.4
call edi
lea eax, [eax*2 + 2]
push eax
push str.1.5.4
push 1
push ebx
push str.DisplayVersion
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f17
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push str.UninstallString
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f17
push dword [ebp + 8]
call edi
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
push 1
push ebx
push str.Parameters
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10001f17
mov ecx, dword [ebp - 4]
call fcn.10001cac
mov bl, 1
cmp dword [ebp - 4], 0
je 0x10001f26
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x10001f3a
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001f43
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push 1
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
jbe 0x10001f92
push 0x10006810
push 0
push 0x18
mov edx, 0xc8
mov ecx, esi
call fcn.1000182e
add esp, 0xc
xor al, al
jmp 0x10001fc1
push 1
push ecx
push esi
push 0x100028d1
push 6
mov edx, 0x10011330
lea ecx, [ebp - 0x20c]
call fcn.10001b39
add esp, 0x14
test al, al
jne 0x10001fbf
push 0x10006810
push 0
push 3
jmp 0x10001f7f
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001fc6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 1
mov edi, edx
mov esi, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x104
lea eax, [ebp - 0x210]
push eax
push str._LOCALAPPDATA__PRODUCTNAME_Component2
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
jbe 0x1000200a
push 0x10006810
push 0
push 0x1a
jmp 0x1000203e
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.10002932
test al, al
jne 0x10002026
push 0x10006810
push 0
push 0x1b
jmp 0x1000203e
mov edx, esi
mov ecx, edi
call fcn.10002a41
mov bl, al
test bl, bl
jne 0x1000204f
push 0x10006810
push 0
push 0x1c
mov edx, 0xc8
mov ecx, esi
call fcn.1000182e
add esp, 0xc
jmp 0x10002051
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a41
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
and dword [ebp - 0x258], 0
lea eax, [ebp - 0x254]
push ebx
push esi
push edi
push 0x24c
mov edi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 4], edi
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x668]
lea esi, [ebx + 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esi
mov edx, eax
call fcn.10004d14
pop ecx
test al, al
jne 0x10002a9c
xor al, al
jmp 0x10002bc6
push edi
mov edi, dword [sym.imp.ntdll.dll__snwprintf]
lea eax, [ebp - 0x460]
push str._sdefaultspref
mov esi, 0x104
push esi
push eax
call edi
lea eax, [ebp - 0x668]
push eax
push str.__s.js
lea eax, [ebp - 0xa78]
push esi
push eax
call edi
lea eax, [ebp - 0x460]
push eax
push str._s_.js
lea eax, [ebp - 0x870]
push esi
push eax
call edi
add esp, 0x30
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002b4b
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x460]
push eax
push str._s_s
lea eax, [ebp - 0xc80]
push 0x104
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0xc80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10002b01
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor esi, esi
push dword [esi + 0x100112fc]
push str.conf.js
call edi
test eax, eax
jne 0x10002b7b
push 0
push ecx
push ebx
lea eax, [ebp - 0xa78]
push fcn.10002990
lea ecx, [ebp - 0x460]
jmp 0x10002b9e
push dword [esi + 0x100112fc]
push str.conf.cfg
call edi
test eax, eax
jne 0x10002bbc
push 0
push ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x668]
push ebx
push 0x10002a09
push 1
lea edx, [esi + 0x100112f0]
mov dword [esi + str.conf.cfg], eax
call fcn.10001b39
add esp, 0x14
test al, al
je 0x10002a95
add esi, 0x10
cmp esi, 0x30
jb 0x10002b53
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret