joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d690
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3a89
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10003b9b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1002414c
or dword [ebp - 0x250], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
push 0x22c
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32FirstW
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
call fcn.1006f6e0
pop ecx
pop ecx
test eax, eax
je 0x1009d764
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003c06
mov eax, dword [ebp - 0x258]
jmp 0x1009d839
xor eax, eax
inc eax
je 0x1009d81b
push 0x22c
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1009d7a9
or dword [ebp - 0x250], 0xffffffff
jmp 0x1009d81b
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x254]
call fcn.10003b9b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.1002414c
lea ecx, [ebp - 0x254]
call fcn.1003c888
push eax
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
call fcn.1006f6e0
pop ecx
pop ecx
test eax, eax
je 0x1009d807
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.10003c06
jmp 0x1009d81b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.10003c06
jmp 0x1009d764
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003c06
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006ef21
leave
ret 4
Function at 0x1009d852
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x100ff008
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1009d910
push 0x100c6240
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009d910
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x1003b7ea
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 8
call fcn.1006ec8d
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1009d8be
mov ecx, dword [ebp - 0x18]
call fcn.100374a1
mov dword [ebp - 0x1c], eax
jmp 0x1009d8c2
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0x100ff218
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10003c30
push 0x100ff42c
push 0
push dword [ebp - 0x10]
push 0x1009bdf1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1009d910
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x1009d912
xor eax, eax
leave
ret

Function at 0x1009daea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x118], ecx
and word [ebp - 0x110], 0
push 0xfe
push 0
lea eax, [ebp - 0x10e]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x80
lea eax, [ebp - 0x110]
push eax
push 0x100c5bbc
call dword [sym.imp.ole32.dll_StringFromGUID2]
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
call fcn.100345bf
push 0x2001f
push 0x100c5d0c
push SysReAllocString
lea ecx, [ebp - 8]
call fcn.10009a1a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 8]
call fcn.10009cb2
mov ecx, dword [ebp - 0x118]
add ecx, 0x84
call fcn.10003b52
movzx eax, al
test eax, eax
jne 0x1009db9d
mov ecx, dword [ebp - 0x118]
add ecx, 0x84
call fcn.1003c888
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x114], 1
lea ecx, [ebp - 8]
call fcn.10009a8c
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
leave
ret

Function at 0x1009dbc1
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CRemoteInjectLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10003b52
movzx eax, al
test eax, eax
jne 0x1009dbf9
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.1003c888
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10003c06
mov ecx, dword [ebp - 4]
call fcn.10036334
leave
ret
Function at 0x1009dc0e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3f85
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000177b
mov byte [ebp - 4], 1
mov eax, dword [0x100cb580]
mov dword [ebp - 0x30], eax
push dword [0x100cb580]
push 0x5c
lea ecx, [ebp - 0x2c]
call fcn.100375af
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [0x100cb580]
je 0x1009dcbe
push dword [ebp - 0x30]
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001944
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.100017c8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.100017b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
lea eax, [ebp - 0x2c]
push eax
call fcn.1000177b
call fcn.1009dc0e
add esp, 0x1c
push 0
lea ecx, [ebp + 8]
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1009dce0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009dcfa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100017b3
jmp 0x1009dd12
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100017b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
leave
ret
Function at 0x1009ddc3
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3fd5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x1009ddf8
xor eax, eax
jmp 0x1009df4e
call fcn.10020926
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1009de12
and dword [ebp - 0x44], 0
jmp 0x1009de58
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x1009de2e
and dword [ebp - 0x48], 0
jmp 0x1009de52
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.10081050
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
shl eax, 1
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x4c]
call fcn.1002373f
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.1006ee80
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.10036ead
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call fcn.100ac644
pop ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
push str.TxdlService.dat
push dword [ebp - 0x54]
lea eax, [ebp - 0x28]
push eax
call fcn.100105f6
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10003c06
lea ecx, [ebp - 0x28]
call fcn.1003c888
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009ded3
lea ecx, [ebp - 0x28]
call fcn.1003c888
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x24], 0
push 0x100c55f4
lea ecx, [ebp - 0x28]
call fcn.1003c888
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100748c9
add esp, 0xc
cmp dword [ebp - 0x24], 0
je 0x1009df3c
push dword [ebp - 0x24]
push 1
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.10074a78
add esp, 0x10
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 1
push dword [ebp - 0x10]
call fcn.10074a78
add esp, 0x10
push dword [ebp - 0x24]
call fcn.10074b6c
pop ecx
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x28]
call fcn.10003c06
mov eax, dword [ebp - 0x3c]
jmp 0x1009df4e
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x28]
call fcn.10003c06
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.1006ef21
leave
ret
Function at 0x1009df68
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b400d
mov eax, dword fs:[0]
push eax
mov eax, 0x8440
call fcn.100886d0
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x844c], ecx
mov eax, dword [ebp - 0x844c]
cmp dword [eax + 0x70], 0
je 0x1009e1ba
and word [ebp - 0x8444], 0
push 0x208
push 0
lea eax, [ebp - 0x8442]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x8444]
push eax
call fcn.10072233
add esp, 0xc
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009e011
push 0
lea eax, [ebp - 0x8444]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10018e49
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.10037f52
push 0x100c551c
lea ecx, [ebp - 0x10]
call fcn.10037ea1
and word [ebp - 0x8234], 0
push 0x208
push 0
lea eax, [ebp - 0x8232]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x8234]
push eax
call fcn.1009bd51
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
lea eax, [ebp - 0x8234]
push eax
push 0x100c5528
push 0x100c5540
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and word [ebp - 0x401c], 0
push 0x4002
push 0
lea eax, [ebp - 0x401a]
push eax
call fcn.10071bc0
add esp, 0xc
and word [ebp - 0x8024], 0
push 0x4002
push 0
lea eax, [ebp - 0x8022]
push eax
call fcn.10071bc0
add esp, 0xc
push section.Downlaod
call fcn.1006ef0b
pop ecx
push eax
push section.Downlaod
push 0x2002
lea eax, [ebp - 0x401c]
push eax
call fcn.1009bcfb
add esp, 0x10
push 0x10102008
call fcn.1006ef0b
pop ecx
push eax
push 0x10102008
push 0x2002
lea eax, [ebp - 0x8024]
push eax
call fcn.1009bcfb
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
lea eax, [ebp - 0x8024]
push eax
push 0x100c5554
push 0x100c5564
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
lea eax, [ebp - 0x401c]
push eax
push 0x100c5578
push 0x100c558c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x8448]
call fcn.10003b68
mov byte [ebp - 4], 1
push dword [0x10106014]
push 0x100c55a0
lea eax, [ebp - 0x8448]
push eax
call fcn.10015e00
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
lea ecx, [ebp - 0x8448]
call fcn.1003c888
push eax
push 0x100c55a8
push 0x100c55b4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8448]
call fcn.10003c06
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100175d8
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006ef21
leave
ret 4
Function at 0x1009e1d6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b403d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
call fcn.100ac772
pop ecx
and dword [ebp - 4], 0
push 0x100c54b8
lea ecx, [ebp - 0x10]
call fcn.10009de9
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.1003c888
test eax, eax
je 0x1009e2af
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.1003c888
mov dword [ebp - 0x3c], eax
push 0
push 0x100c54ec
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
push 0xa
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call fcn.1007360a
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1003c888
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100c54f4
push 0x100c5500
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x16
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003c06
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006ef21
leave
ret
Function at 0x1009eb60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push dword [ebp + 8]
call fcn.10001745
call fcn.1009dc0e
add esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009eb90
xor eax, eax
inc eax
jmp 0x1009eb92
xor eax, eax
leave
ret

Function at 0x1009edb7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push edi
call fcn.1005afcd
movzx eax, al
test eax, eax
je 0x1009ede6
push section.DLLShare
push str.EntryPoint__g_szCmdline_s
push 0xd2
push 0x100c5db8
call fcn.1005ae5c
add esp, 0x10
push section.DLLShare
call fcn.1006ef0b
pop ecx
test eax, eax
jne 0x1009ee1a
call fcn.1005afcd
movzx eax, al
test eax, eax
je 0x1009ee18
push str.EntryPoint__g_szCmdline_is_empty
push 0xd2
push 0x100c5e60
call fcn.1005ae5c
add esp, 0xc
jmp 0x1009ee89
and dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.10071bc0
add esp, 0xc
and dword [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x81
and word [ebp - 0x30], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push section.DLLShare
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1009ee89
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret 0x10
Function at 0x1009f36e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CServiceLauncher.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0
je 0x1009f3d2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x1009f3bd
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.100018e9
movzx eax, al
test eax, eax
jne 0x1009f3bd
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10004dc8
push eax
call fcn.100ab859
pop ecx
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0xcc
call fcn.100017b3
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.100017b3
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.100017b3
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.100017b3
mov ecx, dword [ebp - 4]
call fcn.100366f0
leave
ret

Function at 0x1009f4ee
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CQQExternalShellLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.100018e9
movzx eax, al
test eax, eax
jne 0x1009f543
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1009f543
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.100018e9
movzx eax, al
test eax, eax
jne 0x1009f56d
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.100017b3
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.100017b3
mov ecx, dword [ebp - 4]
call fcn.100363fe
leave
ret
Function at 0x1009ff99
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4eb9
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
push 0x100c5ec0
lea ecx, [ebp - 0x440]
call fcn.10001745
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x448]
add eax, 4
push eax
lea ecx, [ebp - 0x440]
call fcn.100017de
push 0x100c5ec4
lea ecx, [ebp - 0x440]
call fcn.10004d18
push 0x100c5ec8
lea ecx, [ebp - 0x440]
call fcn.10004d18
push dword [ebp + 8]
lea ecx, [ebp - 0x440]
call fcn.10004d18
lea ecx, [ebp - 0x440]
call fcn.10004dc8
push eax
push 0x208
push section.DLLShare
call fcn.1007299c
add esp, 0xc
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [0x100fd2ec]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x100c5ecc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.10074be8
add esp, 0xc
and word [ebp - 0x424], 0
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.100a8ea1
add esp, 0x14
mov dword [ebp - 0x444], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.100017b3
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
leave
ret 4
Function at 0x100a0bcc
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5017
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0x100c5948
lea ecx, [ebp - 0x48]
call fcn.10001745
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.100017de
push 0x100c594c
lea ecx, [ebp - 0x48]
call fcn.10004d18
push 0x100c5950
lea ecx, [ebp - 0x48]
call fcn.10004d18
push dword [ebp + 8]
lea ecx, [ebp - 0x48]
call fcn.10004d18
lea ecx, [ebp - 0x48]
call fcn.10004dc8
push eax
call fcn.1009ddc3
pop ecx
test eax, eax
jne 0x100a0c67
and dword [ebp - 0x4c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017b3
mov eax, dword [ebp - 0x4c]
jmp 0x100a0d75
mov ecx, dword [ebp - 0x5c]
call fcn.100a06dc
test eax, eax
jne 0x100a0c8b
and dword [ebp - 0x50], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017b3
mov eax, dword [ebp - 0x50]
jmp 0x100a0d75
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004dc8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a0cb9
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100c5954
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004dc8
push eax
push 0x277f
push dword [0x100fd2ec]
call fcn.1009e3ff
add esp, 0x14
test eax, eax
jne 0x100a0cfb
and dword [ebp - 0x54], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017b3
mov eax, dword [ebp - 0x54]
jmp 0x100a0d75
push 0x100c5968
mov eax, dword [ebp - 0x5c]
add eax, 0xcc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000a6a6
add esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0x100c5978
lea ecx, [ebp - 0x2c]
call fcn.10004dc8
push eax
push 0x451
push dword [0x100fd2ec]
call fcn.1009e3ff
add esp, 0x14
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004dc8
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.1009df68
mov dword [ebp - 0x58], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100017b3
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
leave
ret 4
Function at 0x100a0d8e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.10009e2c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x98], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.1003c888
test eax, eax
je 0x100a0e05
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.1003c888
mov dword [ebp - 0x14], eax
push 0
push 0x100c5920
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call dword [eax + 0x18]
cmp eax, 0x64
jne 0x100a0e05
mov eax, dword [0x10106014]
dec eax
mov dword [0x10106014], eax
cmp dword [0x10106014], 0xffffffff
jne 0x100a0e05
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10106018], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.1003c888
test eax, eax
je 0x100a0e42
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.1003c888
mov dword [ebp - 0x18], eax
push 0
push str.EnableLsp
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a0e42
call fcn.10036fc5
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp - 0x10]
push 0x1009ce63
push 0
push 0
call fcn.100728ee
add esp, 0x18
push eax
lea ecx, [ebp - 0xc]
call fcn.1000b6ee
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.1003614d
lea ecx, [ebp - 0xc]
call fcn.10020d14
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.1003c888
test eax, eax
je 0x100a0eb3
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.1003c888
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x98]
jmp 0x100a0eb5
xor eax, eax
leave
ret 4