joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ac930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109ca8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10145fb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov edi, dword [ecx + 4]
test edi, edi
je 0x100ac9e9
cmp dword [edi + 4], 0
je 0x100ac9fe
push 0x628
call fcn.100a8b30
mov esi, eax
add esp, 4
test esi, esi
je 0x100ac9ad
push 0x618
lea ecx, [esi + 8]
mov dword [esi], 0
push 0
push ecx
mov dword [esi + 4], 0
call fcn.100cdc50
add esp, 0xc
mov byte [esi + 0x620], 0
jmp 0x100ac9af
xor esi, esi
lea eax, [edi + 0x3c]
mov dword [esi + 0x624], 0
cmp dword [eax + 0x14], 8
jb 0x100ac9c4
mov eax, dword [eax]
push eax
lea eax, [esi + 0x418]
push 0x104
push eax
call fcn.100d7d7d
add esp, 0xc
push esi
push edi
push 0x800
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_PostMessageW]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 8]
lea ecx, [edi + 0xc]
call fcn.10079108
push dword [ebp + 0xc]
lea ecx, [edi + 0x24]
call fcn.10079108
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 0x3c]
push dword [ebp + 0x14]
mov dword [edi + 8], eax
call fcn.10079108
push 0x38
call fcn.100a8b30
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x100aca8d
push dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov ecx, esi
mov word [esi], ax
call fcn.10079108
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
mov word [ecx], ax
call fcn.10079108
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
jmp 0x100aca8f
xor esi, esi
push 0
push 0
push esi
push 0x100ac620
push 0
push 0
mov byte [edi + 0x58], 0
call fcn.100d59f1
add esp, 0x18
mov dword [edi + 4], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100b0660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10145fb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x100b07e7
xorps xmm0, xmm0
push 0x1014c030
push 4
movlpd qword [ebp - 0x20], xmm0
call fcn.100b33f7
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100b06b7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100b06b9
xor eax, eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
mov dword [ebp - 0x1c], 0
call fcn.100acb70
cmp dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
je 0x100b07bf
mov eax, dword [esi + 4]
push 0x1014c030
push 0x18
mov dword [ebp - 0x18], eax
call fcn.100b33f7
mov edi, eax
add esp, 8
test edi, edi
je 0x100b07bf
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
test ebx, ebx
je 0x100b07bf
cmp dword [ebx + 0x5c], 0x10
lea eax, [ebx + 0x48]
mov dword [ebp + 0xc], eax
jb 0x100b0748
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp dword [ebx + 0x44], 0x10
lea eax, [ebx + 0x30]
mov dword [ebp - 0x10], eax
jb 0x100b0759
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x14], ebx
jb 0x100b0767
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
call fcn.100ad2d0
mov esi, dword [ebp + 8]
mov ecx, eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.100ace40
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
jne 0x100b078d
test eax, eax
je 0x100b07bf
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x20]
push 0
mov dword [edi + 0x14], ecx
mov ecx, dword [ebp - 0x18]
push edi
mov dword [edi], eax
mov dword [edi + 8], ecx
mov eax, dword [eax]
push 0x100b0ca0
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x60]
push 0
push 0
mov dword [edi + 0xc], eax
call fcn.100d59f1
add esp, 0x18
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x100b07e7
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x100b07e7
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x100b07e7
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b1070
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x4c0], ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x100b114f
test ebx, ebx
je 0x100b114f
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100b114f
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x100b114f
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x100b113a
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.100e429e
add esp, 0xc
test eax, eax
je 0x100b1162
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x100b10e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100b11b9
cmp edi, 0x7fffffff
ja 0x100b11b0
mov ecx, ebx
mov esi, SysReAllocString
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x100b119b
movzx eax, word [ebx + ecx]
test ax, ax
je 0x100b119b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b1180
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x100b11b9
test edi, edi
je 0x100b11b9
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x100b11c7
cmp edi, 0x7fffffff
jbe 0x100b11cc
mov ecx, 0x80070057
test ecx, ecx
js 0x100b11fe
mov esi, edi
mov eax, ebx
test edi, edi
je 0x100b11e6
cmp word [eax], 0
je 0x100b11e6
add eax, 2
sub esi, 1
jne 0x100b11d8
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x100b1200
xor esi, esi
test ecx, ecx
js 0x100b1256
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x100b1249
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x100b1249
movzx eax, word [edi + ecx]
test ax, ax
je 0x100b1249
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x100b1230
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b254d
mov esp, ebp
pop ebp
ret
Function at 0x100b1630
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.100b2560
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x100b1761
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jl 0x100b1761
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100b1761
push 0x400
lea eax, [ebp - 0x804]
mov dword [ebp - 0x804], 0
push eax
push 0
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x100b1736
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.100cdc50
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.100ce07b
add esp, 0x14
test eax, eax
je 0x100b16f8
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x100b16f8
mov ecx, 1
jmp 0x100b16fa
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
lea eax, [ebp - 0x804]
push edi
cmovne eax, edx
push eax
push ebx
call fcn.100e420f
add esp, 0xc
mov edi, dword [ebp - 0x1008]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x100b1716
push edi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.100b1070
add esp, 0xc
mov edi, eax
jmp 0x100b171c
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b254d
mov esp, ebp
pop ebp
ret
Function at 0x100b1780
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b17d0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.1000b050
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x270], ebx
cmp ebx, 0xffffffff
je 0x100b1933
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.100cdc50
add esp, 0xc
mov dword [ebp - 0x26c], 0x22c
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100b192c
nop
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b1860
sub ecx, edx
lea eax, [ebp - 0x248]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.1000b050
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov edi, dword [ebp - 0x40]
lea esi, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmp ebx, 8
cmovae eax, edi
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x30]
jne 0x100b18dd
mov edx, ecx
test edx, edx
je 0x100b18c1
sub esi, eax
nop dword [eax]
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x100b18dd
add eax, 2
sub edx, 1
jne 0x100b18b0
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x40]
call fcn.100087f0
jmp 0x100b1935
cmp ebx, 8
jb 0x100b1911
lea ecx, [ebx*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x100b1907
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100b1989
push ecx
push edi
call fcn.100b21ce
add esp, 8
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100b1840
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100b196b
mov edx, dword [ebp - 0x28]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100b1961
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100b1989
push ecx
push edx
call fcn.100b21ce
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret
call fcn.100d129a
int3
Function at 0x100b1c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a556
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2e0]
push 0x2d0
push 0
push eax
call fcn.100cdc50
mov esi, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea eax, [ebp - 0x2e4]
add esp, 0xc
mov dword [ebp - 0x2e4], 0x168
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x1010fcb8
push str.http
push 1
push 0
call esi
xor ebx, ebx
test eax, eax
setns bl
test eax, eax
jns 0x100b1cc2
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.iexplore.exe
push 2
push 2
call esi
xor ebx, ebx
test eax, eax
setns bl
test ebx, ebx
je 0x100b1e06
call fcn.10009850
mov ecx, eax
test ecx, ecx
je 0x100b1e24
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2e0]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.10034600
test al, al
jne 0x100b1d32
lea ecx, [ebp - 0x2e0]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b1d10
sub ecx, edx
lea eax, [ebp - 0x2e0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000a120
mov esi, dword [ebp - 0x2e8]
mov dword [ebp - 4], 1
cmp dword [esi - 0xc], 0
jge 0x100b1d4a
or eax, 0xffffffff
jmp 0x100b1d65
push str..exe
push esi
call fcn.100ce142
add esp, 8
test eax, eax
jne 0x100b1d61
or eax, 0xffffffff
jmp 0x100b1d65
sub eax, esi
sar eax, 1
mov ecx, dword [esi - 0xc]
test eax, eax
jle 0x100b1d96
sub ecx, eax
add eax, 4
add ecx, 4
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.10055d20
push 1
push 0
lea ecx, [ebp - 0x2e8]
call fcn.10055d20
mov esi, dword [ebp - 0x2e8]
push 1
push 0
push dword [edi]
push esi
push 0x1010fcb8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x100b1dd0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100b1e06
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x100b1e06
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 1
push dword [edi]
push esi
call fcn.100b1ee0
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100b1e06
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10009640
int3
Function at 0x100b1e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a588
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10145fb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 0x10], 0
call fcn.100810a0
push 0x1011c470
push 0x1011c474
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.100614f0
push 0xa
push 0
push dword [esi]
push 0x1011c478
push 0x1010fcb8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb esi, esi
add eax, 0xfffffff0
neg esi
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100b1ec5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b1ee0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
test edi, edi
jne 0x100b1f24
xor eax, eax
jmp 0x100b20b5
cmp word [edi], 0
je 0x100b1f1d
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b1f30
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x100b1f1d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b1f1d
cmp dword [ebp + 0x14], 0
je 0x100b1f68
push dword [ebp - 0x6c]
push edi
call fcn.100a5900
add esp, 8
test eax, eax
je 0x100b1f1d
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0
call fcn.10033940
push esi
push edi
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push str.__s___s
push eax
call fcn.10014e70
mov esi, dword [ebp - 0x68]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x100b1fa8
push dword [esi - 0xc]
lea ecx, [ebp - 0x68]
call fcn.100097a0
mov esi, dword [ebp - 0x68]
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
xor eax, eax
movlpd qword [ebp - 0x60], xmm0
mov word [ebp - 0x22], ax
mov eax, 0xa
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x32], xmm0
movlpd qword [ebp - 0x2a], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x81
mov word [ebp - 0x34], ax
call fcn.10055e90
mov dword [ebp - 0x74], eax
test eax, eax
je 0x100b208c
push 0x1010df80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100b2024
push 0x1010df80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100b2074
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100b2074
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x74]
call eax
test eax, eax
je 0x100b2074
cmp dword [ebp - 0x20], 0
je 0x100b2074
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100b207a
push eax
call esi
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x6c], 1
jmp 0x100b207a
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x6c], 0
je 0x100b208c
mov esi, 1
jmp 0x100b20ab
push 0xa
push 0
push dword [ebp - 0x70]
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov dword [ebp - 0x70], ecx
mov esi, ecx
lea ecx, [ebp - 0x68]
call fcn.100085e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret
Function at 0x100b38e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x100b38ef
pop ebp
jmp fcn.100b4750
xor eax, eax
pop ebp
ret 0xc
Function at 0x100b4a50
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a833
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10145fb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x100b4af5
cmp word [esi], di
je 0x100b4af5
test eax, eax
je 0x100b4ab1
cmp word [eax], di
je 0x100b4ab1
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x100b4af5
jmp 0x100b4af0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100cdc50
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x100b4af5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100b4b6c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x100b4b57
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x100b4b25
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x100b4b46
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x100b4b8c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x100b4b57
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100b4b6c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b254d
mov esp, ebp
pop ebp
ret 0x30
call fcn.10074039
int3

Function at 0x100b5630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x100b5645
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100b5650
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100b7090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret