joyce8/EMBER2024-capa huggingface dataset:
Function at 0x112d6070
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x112f5fe0]
sub esp, 0x114
test eax, eax
jne 0x112d61bd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x112f5d78
mov dword [0x112f5fe0], 1
mov dword [0x112f5d78], 0x114
call esi
mov edx, dword [0x112f5d88]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x112f29f0], eax
je 0x112d6198
push ebx
push 0x112f5e90
mov dword [0x112f5e90], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x112f0318
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x112f5fd4], eax
call edi
mov dword [0x112f5fd8], eax
mov eax, dword [0x112f5fd4]
test eax, eax
push 0x112f5fb0
je 0x112d6114
call eax
jmp 0x112d611a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x112f5e94]
cmp eax, 6
jae 0x112d6132
cmp eax, 5
jne 0x112d6146
cmp dword [0x112f5e98], 2
jb 0x112d6146
cmp word [0x112f5fb0], 9
jne 0x112d6146
mov dword [0x112f5d6c], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x112d6164
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x112f5fdc], edx
jmp 0x112d616a
mov edx, dword [0x112f5fdc]
test edx, edx
je 0x112d6198
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x112d6198
mov ecx, dword [esp + 0x14]
mov dword [0x112f5d84], ecx
push 0x112f5d80
push 0x112f5d7c
call fcn.112d6560
add esp, 8
call fcn.112d61d0
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x112d73f0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x112eaaa0
push 0x112dc148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x112f5fe4]
xor ebx, ebx
cmp eax, ebx
jne 0x112d7550
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x112d754b
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x112f04cc
lea edx, [ebp - 0x42c]
push edx
call fcn.112b005d
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.112a23d6
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x112d754b
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x112d7542
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x112f3ab4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x112d7542
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x112f5fe4], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x112d7542
push esi
call fcn.112a1dd8
add esp, 4
mov eax, dword [0x112f5fe4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x112d9a40
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx], 0x112eaaac
jmp 0x112db8b0
sub esp, 8
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov dword [esi], 0x112eaabc
test eax, eax
je 0x112db929
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 8], ecx
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x112db910
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x112db940
push eax
call edi
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x10]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
pop edi
pop esi
add esp, 8
ret
Function at 0x112db960
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x112db9f5
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x112db9af
call fcn.112d67d0
test eax, eax
je 0x112db9af
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x112db99c
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x112db99c
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x112db9a8
add edi, ebx
mov ebx, 0x10004
jmp 0x112db9b1
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x112dbbb0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x112db9f5
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x112db9e4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x112dba20
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x112dba34
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x112dba80
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x1000768d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
inc esp
cmp eax, 0xc4833b38
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x2f4]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x36c], edx
push ecx
push ecx
add esp, 4
or ecx, 0xcf71
sub ecx, 0xcf30
sub ecx, 0x15b7c
pop ecx
push ecx
xor ecx, 0x11add
pop ecx
push esi
jmp 0x100076c6
xor esi, 0x1ef
jmp 0x100076d1
pop esi
mov dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0
jne 0x10007702
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, dword [ebp - 0x1690]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1694], eax
jne 0x1000772a
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1694]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1698], edx
cmp dword [ebp - 0x1698], 0
jne 0x1000775c
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x524], eax
jmp 0x100079f3
mov ecx, dword [ebp - 0x36c]
add ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x78c], ecx
jne 0x10007781
mov edx, dword [ebp - 0x798]
mov dword [ebp - 0x524], edx
jmp 0x100079f3
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19d0], ecx
mov edx, dword [ebp - 0x78c]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19d4], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19d8], edx
mov dword [ebp - 0x790], 0
jmp 0x100077db
mov eax, dword [ebp - 0x790]
add eax, 1
mov dword [ebp - 0x790], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x790]
cmp edx, dword [ecx + 0x18]
jae 0x100079e7
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d0]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x794], edx
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19d8]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19dc], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x1000784b
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x794]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100078fd
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x100078fd
push ecx
call 0x10007888
add byte [eax + 0x47], al
inc ebx
dec esi
dec ebx
dec ebp
inc esp
dec edx
add esp, 4
and ecx, 0x1800b
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x1540c
sub ebx, 0x840f
sub ebx, 0x140b9
pop ebx
mov ecx, dword [ebp - 0x794]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
invalid
invalid
pushal

Function at 0x100096db
Capabilities:
Encode data using xor

Disassembly:
pop eax
cmp eax, dword [ebx]
add al, byte [ebx + 0x3339cca]
add bl, byte [edx + 0x54]
Function at 0x10032e1d
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10034088
test eax, eax
jne 0x10032e31
xor edi, edi
jmp 0x10032ec5
mov ecx, esi
call fcn.10034886
mov edi, eax
test edi, edi
jne 0x10032e52
mov ecx, esi
call fcn.10032eca
mov edi, eax
test edi, edi
je 0x10032ec5
mov ecx, esi
call fcn.1003691e
mov eax, dword [esi + 0x180]
push ebx
mov dword [esi + 0x300], eax
xor ebx, ebx
mov eax, dword [esi + 0x244]
push ebx
mov dword [esi + 0x304], eax
mov eax, dword [esi + 0x20c]
push 0xffff
mov dword [esi + 0x308], eax
mov eax, dword [esi + 0x284]
push ebx
mov dword [esi + 0x30c], eax
mov eax, dword [esi + 0x2a4]
push ebx
mov dword [esi + 0x310], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x2bc], eax
test eax, eax
je 0x10032ec4
push ebx
push ebx
push esi
push 0x1003645a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10032ec4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x1004197b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push edi
push 0
push eax
mov dword [esi], vtable.CBootInIWriteWorker.0
call fcn.1012db70
and dword [esi + 4], 0
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], edi
xor edi, edi
inc edi
mov dword [ebp - 0x214], edi
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
cmp word [ebp - 0x20c], 0
je 0x10041a14
push str.0804
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jmp 0x10041a22
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x804
cmp ax, cx
jne 0x10041a27
mov dword [esi + 4], edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret
Function at 0x10041a79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push 0x208
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.1012db70
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
mov dword [esi], ebx
lea eax, [ebp - 0x414]
mov ecx, edi
push 0x208
push eax
call fcn.10041f82
test eax, eax
je 0x10041b3c
push 0x208
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10042160
test eax, eax
je 0x10041b3c
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x10041b10
xor eax, eax
inc eax
mov dword [esi], eax
jmp 0x10041b3e
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.10042097
test eax, eax
je 0x10041b3c
mov eax, dword [ebp - 0x418]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x10041b3e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4

Function at 0x10041bbf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x208
mov esi, ecx
push ebx
push 0
and dword [edi], 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push ebx
push eax
call fcn.10042160
test eax, eax
je 0x10041c61
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x10041c5a
push ebx
push ebx
push 0x1018d75c
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
cmp eax, 1
jne 0x10041c61
cmp dword [esi + 4], ebx
jne 0x10041c55
push ebx
push ebx
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
xor eax, eax
inc eax
jmp 0x10041c63
xor eax, eax
inc eax
mov dword [edi], eax
jmp 0x10041c63
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4
Function at 0x1004ed05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
xor eax, eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov word [ebx], ax
cmp edi, 0x100
jge 0x1004ed6a
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x1004eec9
lea eax, [ebp - 4]
push eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1004ed5c
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1004eec9
cmp dword [0x102458e8], eax
jne 0x1004eea4
push esi
mov esi, 0x104
push esi
push 0x10245af8
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
push 0x10245d00
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x10246728
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call fcn.10130fe5
pop ecx
lea eax, [eax*2 + 0x10246726]
cmp word [eax], 0x5c
jne 0x1004edbe
xor ecx, ecx
mov word [eax], cx
push 0x10245af8
push 0x208
mov esi, 0x102458f0
push esi
call fcn.100100b8
push 0x3a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x1004ede6
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov dword [ebp + 8], 1
push eax
mov word [0x10245f08], ax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x208
push eax
push 0x10245f08
lea eax, [ebp + 8]
push eax
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push esi
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
xor eax, eax
mov dword [ebp + 8], 1
push eax
mov word [0x10246110], ax
lea eax, [ebp + 0xc]
push eax
push 0x10246110
lea eax, [ebp + 8]
mov dword [ebp + 0xc], 0x104
push eax
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push esi
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
push 0x104
push 0x10246318
push str._UserProfile_
mov word [0x10246318], ax
call esi
push 0x104
push 0x10246520
xor eax, eax
push str._AllUserProfile_
mov word [0x10246520], ax
call esi
mov dword [0x102458e8], 1
pop esi
cmp edi, 0x107
jg 0x1004eec9
lea eax, [edi - 0x100]
imul eax, eax, 0x208
add eax, 0x102458f0
push eax
push 0x208
push ebx
call fcn.100100b8
pop edi
pop ebx
leave
ret
Function at 0x1008a118
Capabilities:
Get common file path

Disassembly:
push 0x418
mov eax, 0x10163391
call fcn.1012b6ae
mov esi, ecx
mov dword [ebp - 0x414], esi
push dword [esi + 0x30]
call fcn.10130fe5
pop ecx
test eax, eax
je 0x1008a1f7
push dword [esi + 0x3c]
lea ecx, [ebp - 0x424]
call fcn.1001de59
mov ebx, eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x420]
push dword [esi + 0x38]
call fcn.1001de59
mov edi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x41c]
push dword [esi + 0x34]
call fcn.1001de59
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x418]
mov eax, dword [ebp - 0x414]
push dword [eax + 0x30]
call fcn.1001de59
mov byte [ebp - 4], 3
push dword [ebx]
mov ecx, dword [ebp - 0x414]
push dword [edi]
push dword [esi]
mov ecx, dword [ecx + 4]
push dword [eax]
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
setne bl
mov byte [ebp - 4], 2
push dword [ebp - 0x418]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov byte [ebp - 4], 1
push dword [ebp - 0x41c]
call esi
mov byte [ebp - 4], 0
push dword [ebp - 0x420]
call esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x424]
call esi
test bl, bl
jne 0x1008a25c
mov ecx, dword [ebp - 0x414]
call fcn.1008a264
jmp 0x1008a25e
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x410]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1008a25c
push str.360Quarant
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1008a25c
mov eax, dword [esi + 4]
lea edx, [ebp - 0x410]
push ebx
push str.union
push str.360safe
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1008a25c
mov ecx, esi
jmp 0x1008a1f0
xor eax, eax
call fcn.1012b658
ret

Function at 0x1008ad99
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
mov eax, dword [ebp + 0x14]
and eax, 0x100
or eax, 0xf003f
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1008addf
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1008ade4
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x10163542
call fcn.1012b67a
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
mov ebx, edi
push eax
and ebx, 0x100
or ebx, 0xf003f
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.10116ff7
and dword [ebp - 4], 0
cmp esi, 5
jne 0x1008ae5b
push 1
shr edi, 8
lea ecx, [ebp - 0x30]
push 1
not edi
and edi, 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10117648
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1008ae76
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10117027
mov eax, esi
call fcn.1012b643
ret

Function at 0x1009c899
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x1009cae2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009cb08
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1009cb08
xor al, al
jmp 0x1009cb1c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x100a076c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10134acf
mov ecx, dword [ebp + 0x1c]
add esp, 0x10
and dword [ecx + 4], 0
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0x18

Function at 0x100a08d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10137bcd
mov ecx, dword [ebp + 0x1c]
add esp, 0x10
and dword [ecx + 4], 0
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0x18

Function at 0x100a25b6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xffffffff
jne 0x100a25ca
mov eax, 0x80070057
jmp 0x100a25ff
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100a25e8
mov eax, 0x80004005
jmp 0x100a25ff
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
pop ebp
ret 0xc