joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100159b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
push str.CSDVersion
push str.SYSTEMCurrentControlSetControlWindows
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret

Function at 0x10015d70
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10077d88
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
mov ecx, str._SYSTEM
call fcn.10016190
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.10030fc0
test eax, eax
je 0x10015e7b
push 0xd
push str._ntoskrnl.exe
lea ecx, [esp + 0x18]
push ecx
call fcn.10016570
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10015e7b
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x14]
call fcn.10015430
test eax, eax
je 0x10015e7b
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 4]
mov eax, ecx
shr eax, 0x10
movzx ecx, cx
cmp edx, eax
jb 0x10015e10
jne 0x10015e7b
cmp dword [esi + 8], ecx
jae 0x10015e7b
mov dword [esi + 8], ecx
lea ecx, [esp + 0x14]
mov dword [esi + 0x10], 2
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0
call fcn.100159b0
mov eax, dword [esp + 0x14]
shr eax, 8
mov word [esi + 0x114], ax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10015e64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x20
ret
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10015ea3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x20
ret

Function at 0x100167e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [0x100902c0]
cmp eax, 1
jne 0x100167fe
call fcn.100152c0
neg eax
sbb eax, eax
and eax, 0x100
mov dword [0x100902c0], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp]
push ecx
or eax, 0x20019
push eax
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10016853
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push esi
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push ecx
push 0x1007f0d8
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0x18
Function at 0x10020da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x434
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x430], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_standards_v1.0.0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10020def
xor eax, eax
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.10055232
add esp, 0x434
ret
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
push esi
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x238]
push edx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
xor edi, edi
push edi
mov esi, 0x104
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
call ebp
test eax, eax
jne 0x10020eac
push ebx
cmp dword [esp + 0x1c], 4
jne 0x10020e7a
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3a]
push str._d._d
push eax
call fcn.1005702a
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
imul ecx, ecx, 0x3e8
add ecx, dword [esp + 0x38]
add esp, 0x10
add esi, 0xc
lea ebx, [esp + 0x24]
mov dword [esp + 0x24], ecx
call fcn.10021c20
mov esi, 0x104
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x40]
push eax
inc edi
push edi
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
call ebp
test eax, eax
je 0x10020e30
pop ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10055232
add esp, 0x434
ret
Function at 0x10020f30
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x10074c5b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREClassesTypeLibF5078F18_C551_11D3_89B9_0000F81FE221
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10020f95
xor eax, eax
jmp 0x10021071
mov edx, dword [0x1009238c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1009238c
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
mov dword [esp + 0x244], edi
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
push edx
push edi
push eax
mov dword [esp + 0x24], 0x104
call ebp
cmp eax, edi
jne 0x10021036
add esi, 0xc
lea ebx, [ebx]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push str._d._d
push eax
call fcn.1005702a
mov ecx, dword [esp + 0x38]
imul ecx, ecx, 0x3e8
add ecx, dword [esp + 0x2c]
add esp, 0x10
lea ebx, [esp + 0x20]
mov dword [esp + 0x20], ecx
call fcn.10021c20
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
inc edi
push edi
push ecx
mov dword [esp + 0x24], 0x104
call ebp
test eax, eax
je 0x10020fe0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002106c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10055232
add esp, 0x230
ret
Function at 0x10021a50
Capabilities:
Access peb ldr_data
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10077c50
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x1009238c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1009238c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov ecx, str._PROGRAM_FILESInternet_ExplorerIEXPLORE.EXE
mov dword [esp + 0x30], ebx
call fcn.10016190
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.100307c0
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10021b06
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x1c]
call fcn.10015430
test eax, eax
je 0x10021b04
mov eax, dword [esp + 0x1c]
movzx edx, ax
push edx
shr eax, 0x10
push eax
mov eax, dword [esp + 0x28]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._d._d._d._d
lea edi, [esp + 0x28]
call fcn.10016c70
add esp, 0x14
xor ebx, ebx
jmp 0x10021b22
xor ebx, ebx
lea edx, [esp + 0x14]
push edx
mov edx, str.Version
mov edi, str.SOFTWAREMicrosoftInternet_Explorer
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10015900
add esp, 4
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str._d._d
push esi
call fcn.1005702a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
imul edx, edx, 0x3e8
mov ecx, dword [esp + 0x44]
add eax, edx
xor edx, edx
add esp, 0x10
cmp eax, ebx
setg dl
mov dword [ecx + 4], eax
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edi, edx
mov edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10021b84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10021ba8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x10023de0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 9
jne 0x10023e16
push str.path
push str.SOFTWAREMicrosoftOffice9.0CommonInstallRoot
call fcn.10024e00
test eax, eax
jne 0x10023e01
pop edi
pop esi
ret
push 9
push str.mso9.dll
push esi
call fcn.10016570
pop edi
mov eax, 1
pop esi
ret
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x104
or ecx, edx
jge 0x10023e3c
mov ecx, 0x104
mov eax, esi
call fcn.10016aa0
mov eax, dword [esi]
push 0x104
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x10023e66
push ecx
push eax
call fcn.1005723d
add esp, 8
test eax, eax
jl 0x10023e90
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x10023e90
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
push edi
xor edx, edx
push str.Common_FilesMicrosoft_SharedOffice_dmso.dll
mov edi, esi
mov word [ecx + eax*2], dx
call fcn.10024fc0
add esp, 8
pop edi
mov eax, 1
pop esi
ret
push 0x80070057
call fcn.100125e0
int3
Function at 0x10024e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 0x104
mov dword [esp], ecx
mov dword [esp + 4], 1
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, ecx
or edx, eax
jge 0x10024e30
mov eax, esi
call fcn.10016aa0
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esi]
push edi
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10024e83
mov edx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x14]
push ecx
push edx
push 0x1007f0d8
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [esp + 0x14]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
xor edx, edx
test edi, edi
sete dl
mov edi, edx
test eax, eax
je 0x10024ea3
push ecx
push eax
call fcn.1005723d
add esp, 8
test eax, eax
jl 0x10024ebf
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x10024ebf
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, edi
pop edi
pop ebx
add esp, 8
ret 8
push 0x80070057
call fcn.100125e0
int3

Function at 0x10024ed0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10024f2c
mov ecx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
push 0x1007f0d8
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0xc
ret 8

Function at 0x10025070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10077c16
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
lea eax, [esp + 0x4c]
push eax
call fcn.10026370
push str._expected.
push ecx
lea ecx, [esp + 0x54]
push 0x1007fc88
push ecx
mov dword [esp + 0xec], 0
call fcn.1002b360
mov cl, byte [esp + 0xf4]
push eax
call fcn.1002b5b0
add esp, 0x10
push eax
call fcn.1002b360
add esp, 8
lea ecx, [esp + 0x30]
lea eax, [esp + 0x4c]
call fcn.10026470
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xe0], 1
call fcn.10001220
push 0x10086058
lea edx, [esp + 0xc]
push edx
call fcn.10059524
int3
Function at 0x1002d280
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d2b9
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8

Function at 0x1002d2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d32e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x1002d2ff
cmp eax, 2
jne 0x1002d31a
mov eax, dword [esp]
test esi, esi
je 0x1002d328
test eax, eax
je 0x1002d323
test al, 1
jne 0x1002d31a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x1002d328
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x1002e160
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4014
call fcn.1006d050
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x4010], eax
mov eax, dword [esp + 0x401c]
push ebx
mov ebx, dword [esp + 0x4028]
push ebp
mov ebp, dword [esp + 0x4030]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x4028]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], esi
cmp ebx, esi
je 0x1002e312
mov edx, dword [esp + 0x403c]
lea ecx, [esp + 0x10]
push ecx
push edx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e312
push 0x1ffe
push eax
lea ecx, [esp + 0x202a]
push ecx
mov dword [esp + 0x20], 1
mov word [esp + 0x202c], ax
call fcn.10061ab0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push esi
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x2034]
push eax
push esi
push ecx
mov dword [esp + 0x38], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1002e2fd
jmp 0x1002e220
xor edx, edx
push 0x1ffe
push edx
lea eax, [esp + 0x2a]
push eax
mov word [esp + 0x2c], dx
call fcn.10061ab0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x1002e253
push 0x1000
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x2020]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [esp + 0x4030], 0
je 0x1002e29a
mov edx, dword [esp + 0x403c]
push edx
push ebp
push ebx
push 1
lea eax, [esp + 0x30]
push eax
push edi
call fcn.1002e160
add esp, 0x18
cmp eax, 2
je 0x1002e2f5
push ebp
lea ecx, [esp + 0x24]
push ecx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x1002e2f5
push 0x2000
lea edx, [esp + 0x2024]
push 0
push edx
inc esi
mov dword [esp + 0x24], 0x1000
call fcn.10061ab0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x2034]
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1002e220
jmp 0x1002e2fd
mov dword [esp + 0x14], 2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002e30c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
jmp 0x1002e314
mov eax, esi
mov ecx, dword [esp + 0x4020]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10055232
add esp, 0x4014
ret
Function at 0x100309e0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
mov edx, ebp
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov ecx, SysReAllocString
call fcn.10015900
add esp, 4
test eax, eax
je 0x10030a07
pop edi
mov eax, 1
pop ebp
ret
push esi
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi*8 + 0x1008ffb0]
push ebp
push eax
call fcn.10056eb4
add esp, 8
test eax, eax
je 0x10030a31
inc esi
cmp esi, 0x19
jb 0x10030a10
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov eax, dword [ebx]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x104
or ecx, edx
jge 0x10030a57
mov ecx, 0x104
mov eax, ebx
call fcn.10016aa0
mov ecx, dword [esi*8 + 0x1008ffb4]
mov eax, dword [ebx]
push 0
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
test eax, eax
je 0x10030a85
push ecx
push eax
call fcn.1005723d
add esp, 8
test eax, eax
jl 0x10030a9d
mov ecx, dword [ebx]
cmp eax, dword [ecx - 8]
jg 0x10030a9d
mov dword [ecx - 0xc], eax
mov edx, dword [ebx]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, esi
pop esi
pop edi
pop ebp
ret
push 0x80070057
call fcn.100125e0
int3

Function at 0x10030ab0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push edi
push 0x2e
push eax
mov edi, ecx
call fcn.10056d7d
add esp, 8
test eax, eax
jne 0x10030af3
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
push esi
push 0xa
add eax, 2
push 0
push eax
call fcn.100576c8
add esp, 0xc
xor esi, esi
cmp eax, dword [esi*8 + 0x10090078]
je 0x10030b2e
inc esi
cmp esi, 6
jb 0x10030b06
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.10061ab0
add esp, 0xc
push 0
push 0x2b
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10030b15
mov eax, dword [esi*8 + 0x1009007c]
push eax
lea ecx, [esp + 0xc]
push ecx
push str._sMicrosoft_SharedOFFICE_d
call fcn.10016c70
mov ecx, dword [esp + 0x21c]
add esp, 0xc
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.10055232
add esp, 0x20c
ret
Function at 0x100310b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x100311ef
movzx eax, word [esi]
add eax, 0xffffffdb
cmp eax, 0x56
ja case.0x100310e8.39
movzx eax, byte [eax + 0x1003121c]
jmp dword [eax*4 + 0x10031208]
push edi
push esi
call fcn.100308f0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
push ebx
add esi, 2
push esi
mov ebx, edi
call fcn.100309e0
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
add esi, 2
push esi
mov ecx, edi
call fcn.10030ab0
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
push edi
lea ecx, [esi + 2]
call fcn.10030d70
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call fcn.10061ab0
push str.systemroot
push esi
call fcn.10056eb4
add esp, 0x14
test eax, eax
jne 0x100311ef
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100311ef
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov esi, eax
test esi, esi
je 0x100311d6
lea edx, [esp + 8]
call fcn.10016240
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10055232
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10055232
add esp, 0x20c
ret
Function at 0x10033100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100743cd
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [edi], vtable.tinyxml2::XMLDocument.0
mov dword [esp + 0x14], 4
call fcn.10031d80
mov eax, dword [edi + 0x40]
xor esi, esi
push eax
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
call fcn.10056100
mov dword [edi + 0x40], esi
lea esi, [edi + 0x128]
add esp, 4
mov ecx, esi
mov dword [esi], vtable.tinyxml2::MemPoolT_44_.0
call fcn.10033990
mov eax, dword [esi + 4]
lea ecx, [esi + 8]
cmp eax, ecx
je 0x10033179
push eax
call fcn.10056100
add esp, 4
mov dword [esi], vtable.tinyxml2::MemPool.0
lea esi, [edi + 0xdc]
mov ecx, esi
mov dword [esi], vtable.tinyxml2::MemPoolT_48_.0
call fcn.10033990
mov eax, dword [esi + 4]
lea edx, [esi + 8]
cmp eax, edx
je 0x100331a5
push eax
call fcn.10056100
add esp, 4
mov dword [esi], vtable.tinyxml2::MemPool.0
lea esi, [edi + 0x90]
mov ecx, esi
mov dword [esi], vtable.tinyxml2::MemPoolT_36_.0
call fcn.10033990
mov eax, dword [esi + 4]
lea ecx, [esi + 8]
cmp eax, ecx
je 0x100331d1
push eax
call fcn.10056100
add esp, 4
mov dword [esi], vtable.tinyxml2::MemPool.0
lea esi, [edi + 0x44]
mov ecx, esi
mov dword [esi], vtable.tinyxml2::MemPoolT_52_.0
call fcn.10033990
mov eax, dword [esi + 4]
lea edx, [esi + 8]
cmp eax, edx
je 0x100331fa
push eax
call fcn.10056100
add esp, 4
mov ecx, edi
mov dword [esi], vtable.tinyxml2::MemPool.0
mov dword [esp + 0x14], 0xffffffff
call fcn.10031cd0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100334b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
call fcn.10031d80
mov eax, dword [edi + 0x40]
xor ebx, ebx
push eax
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
call fcn.10056100
push ebx
push ebx
push ebp
mov dword [edi + 0x40], ebx
call fcn.1005645f
push ebp
call fcn.10055acd
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1003350c
push ebp
call fcn.10058d6e
add esp, 4
test eax, eax
je 0x1003350c
mov eax, 5
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x30], eax
pop edi
pop ebp
pop ebx
ret 4
push esi
push 2
push ebx
push ebp
call fcn.1005645f
push ebp
call fcn.10058f3f
push ebx
push ebx
push ebp
mov esi, eax
call fcn.1005645f
add esp, 0x1c
cmp esi, 0xffffffff
je 0x10033569
cmp esi, 0xffffffff
jae 0x10033569
cmp esi, ebx
jne 0x1003354c
pop esi
mov eax, 0xf
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x30], eax
pop edi
pop ebp
pop ebx
ret 4
lea ecx, [esi + 1]
push ecx
call fcn.100544f1
push ebp
push esi
push 1
push eax
mov dword [edi + 0x40], eax
call fcn.10058d51
add esp, 0x14
cmp eax, esi
je 0x1003357e
pop esi
mov eax, 5
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x30], eax
pop edi
pop ebp
pop ebx
ret 4
mov edx, dword [edi + 0x40]
mov byte [esi + edx], bl
call fcn.10033690
mov eax, dword [edi + 0x30]
pop esi
pop edi
pop ebp
pop ebx
ret 4