joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40534a
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
inc ebp
clc
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call 0x40a197
test ebx, ebx
je 0x4053a0
push str..
push esi
call 0x40a1c2
add bl, ch
push es
push edi
call 0x409ce8
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call 0x40a1e3
push edi
call 0x40a1e3
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call 0x409d1d
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call 0x40a22a
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call 0x409b6b
jmp 0x405479
push edi
call 0x409f06
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call 0x409605
push 0
push edi
call 0x409fbd
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call 0x40961f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call 0x40a5c2
add byte [eax], al
test eax, eax
je 0x4054f9
push edi
call 0x409dc4
push edi
call 0x409f8f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call 0x40968e
push esi
push edi
call 0x40a045
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call 0x40969f
pop edi
pop esi
leave
ret 8
Function at 0x40537a
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
inc ebp
clc
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call 0x40a197
test ebx, ebx
je 0x4053a0
push str..
push esi
call 0x40a1c2
add bl, ch
push es
push edi
call 0x409ce8
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call 0x40a1e3
push edi
call 0x40a1e3
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call 0x409d1d
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call 0x40a22a
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call 0x409b6b
jmp 0x405479
push edi
call 0x409f06
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call 0x409605
push 0
push edi
call 0x409fbd
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call 0x40961f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call 0x40a5c2
add byte [eax], al
test eax, eax
je 0x4054f9
push edi
call 0x409dc4
push edi
call 0x409f8f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call 0x40968e
push esi
push edi
call 0x40a045
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call 0x40969f
pop edi
pop esi
leave
ret 8
Function at 0x40539d
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
inc ebp
clc
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call 0x40a197
test ebx, ebx
je 0x4053a0
push str..
push esi
call 0x40a1c2
add bl, ch
push es
push edi
call 0x409ce8
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call 0x40a1e3
push edi
call 0x40a1e3
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call 0x409d1d
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call 0x40a22a
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call 0x409b6b
jmp 0x405479
push edi
call 0x409f06
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call 0x409605
push 0
push edi
call 0x409fbd
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call 0x40961f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call 0x40a5c2
add byte [eax], al
test eax, eax
je 0x4054f9
push edi
call 0x409dc4
push edi
call 0x409f8f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call 0x40968e
push esi
push edi
call 0x40a045
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call 0x40969f
pop edi
pop esi
leave
ret 8
Function at 0x40549d
Capabilities:
Delete directory

Disassembly:
inc ebp
clc
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call 0x40a197
test ebx, ebx
je 0x4053a0
push str..
push esi
call 0x40a1c2
add bl, ch
push es
push edi
call 0x409ce8
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call 0x40a1e3
push edi
call 0x40a1e3
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call 0x409d1d
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call 0x40a22a
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call 0x409b6b
jmp 0x405479
push edi
call 0x409f06
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call 0x409605
push 0
push edi
call 0x409fbd
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call 0x40961f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call 0x40a5c2
add byte [eax], al
test eax, eax
je 0x4054f9
push edi
call 0x409dc4
push edi
call 0x409f8f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call 0x40968e
push esi
push edi
call 0x40a045
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call 0x40969f
pop edi
pop esi
leave
ret 8
Function at 0x4054bd
Capabilities:
Delete directory

Disassembly:
inc ebp
clc
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call 0x40a197
test ebx, ebx
je 0x4053a0
push str..
push esi
call 0x40a1c2
add bl, ch
push es
push edi
call 0x409ce8
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call 0x40a1e3
push edi
call 0x40a1e3
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call 0x409d1d
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call 0x40a22a
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call 0x409b6b
jmp 0x405479
push edi
call 0x409f06
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call 0x409605
push 0
push edi
call 0x409fbd
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call 0x40961f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call 0x40a5c2
add byte [eax], al
test eax, eax
je 0x4054f9
push edi
call 0x409dc4
push edi
call 0x409f8f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call 0x40968e
push esi
push edi
call 0x40a045
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call 0x40969f
pop edi
pop esi
leave
ret 8

Function at 0x40563d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call 0x409f3d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4
Function at 0x107b0f6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.010aa5e1
leave
ret

Function at 0x107b13d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x10024b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x107b172
xor eax, eax
inc eax
jmp 0x107b1ea
push esi
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov esi, 0x10027d0
push esi
push dword [ebp - 4]
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x107b1b4
cmp eax, ebx
jne 0x107b1ac
cmp dword [ebp - 0xc], edi
jne 0x107b1ac
mov ebx, dword [ebp - 0x10]
cmp ebx, 2
jbe 0x107b1b2
xor ebx, ebx
inc ebx
cmp ebx, 2
je 0x107b1d4
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x107b1d4
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x107b1f2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10024b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x107b23c
push eax
push 0x10027f8
push 0x90a
push 0x1002768
call fcn.010a38d3
add esp, 0x10
jmp 0x107b283
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x10027d0
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10027dc
push 0x923
push 0x1002768
call fcn.010a38d3
add esp, 0xc
pop esi
leave
ret
Function at 0x107b3b7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10024b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x107b405
push eax
push dword [ebp + 8]
push 0x10028b4
push 0x9e4
push 0x1002768
call fcn.010a38d3
add esp, 0x14
xor al, al
jmp 0x107b435
push edi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
sete al
pop edi
pop esi
leave
ret 0xc

Function at 0x107c6a5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
push eax
cmp byte [ecx + 0x6c], al
je 0x107c6c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x4c]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x107c6e6
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push dword [ebp + 8]
push dword [ecx + 0x4c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
shr ecx, 1
mov dword [edx], ecx
pop ebp
ret 0xc
Function at 0x107e9b8
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 0x2e4]
test eax, eax
je 0x107e9cc
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
ret
xor al, al
ret

Function at 0x10839c1
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.010831c6
push 0xf
mov ecx, esi
call fcn.01083218
mov eax, dword [esi]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0x10
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, esi
test eax, eax
jne 0x10839fe
call fcn.010831c6
xor eax, eax
jmp 0x1083a11
push dword [ebp - 4]
call fcn.01083218
mov ecx, esi
call fcn.010832fe
mov eax, dword [esi]
mov eax, dword [eax]
pop esi
leave
ret

Function at 0x1084efc
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x84
mov eax, 0x11b3f45
call fcn.010aa62e
lea ecx, [ebp - 0x1c]
call fcn.0107f04e
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0107f04e
push 0xa
push 0x100354c
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.0107adab
push eax
lea ecx, [ebp - 0x1c]
call fcn.01081ffd
lea eax, [ebp - 0x14]
push eax
push esi
push 0x1003544
push 0x1003534
mov dword [ebp - 4], 1
call fcn.010ac155
test eax, eax
je 0x1084f8a
push 0x1003508
push 0x464
push 0x1002768
call fcn.010a38d3
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0107d6e4
lea ecx, [ebp - 0x1c]
call fcn.0107d6e4
mov al, 1
call fcn.010aa6e2
ret
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0108f4eb
cmp eax, esi
je 0x1084fa7
push 0x10034d8
push 0x46d
jmp 0x1084f65
mov eax, dword [ebp - 0x14]
push dword [eax + 0xc]
mov ebx, 0x1002768
push 0x10034bc
push 0x470
push ebx
call fcn.010a38d3
push 0x44
lea eax, [ebp - 0x90]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x1c
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
call fcn.01081fbb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
push esi
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1085022
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.0107d6e4
lea ecx, [ebp - 0x14]
call fcn.0107d6e4
lea ecx, [ebp - 0x1c]
call fcn.0107d6e4
mov al, bl
jmp 0x1084f84
lea ecx, [ebp - 0x18]
call fcn.01084449
push 0x1003484
lea ecx, [ebp - 0x18]
call fcn.010830c4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.01083522
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x90]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x108507c
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
xor bl, bl
jmp 0x1085003
push dword [esi + 0xc]
push 0x100346c
push 0x48c
push ebx
call fcn.010a38d3
add esp, 0x10
jmp 0x1085001
Function at 0x10877d1
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x11b42a8
call fcn.010aa62e
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push 0x1085b09
push ebx
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
jne 0x108789c
cmp dword [esi + 0x1038], ebx
jbe 0x1087850
lea edi, [esi + 0x34]
xor ecx, ecx
lea eax, [esi + 0x104c]
inc ecx
lock xadd dword [eax], ecx
mov ecx, dword [edi]
call fcn.0107e9b8
mov eax, dword [edi]
mov eax, dword [eax + 0x2e4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esi + 0x104c]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
inc ebx
add edi, 4
cmp ebx, dword [esi + 0x1038]
jb 0x1087810
xor ebx, ebx
push 0x278d
push 0x673
push 0x1003590
mov dword [esi + 0x18], 5
mov dword [ebp - 4], ebx
call fcn.010b32d2
mov ecx, dword [ebp + 8]
push ebx
push eax
push dword [esi + 0x18]
call fcn.01084dca
mov al, 1
jmp 0x10878df
lea edi, [esi + 0x1038]
mov dword [esi + 0x1084], eax
mov dword [ebp - 0x14], ebx
cmp dword [edi], ebx
jbe 0x10878c6
lea ebx, [esi + 0x34]
mov ecx, dword [ebx]
call fcn.0107e9b8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add ebx, 4
cmp eax, dword [edi]
jb 0x10878b2
push 4
pop eax
mov dword [esi + 0x18], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.010831c6
mov byte [esi + 8], 0
xor al, al
call fcn.010aa6e2
ret 4
Function at 0x108d3c2
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1232c24]
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
mov eax, dword [eax + 0xc]
push esi
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x108d41c
mov eax, dword [0x1232c24]
push dword [eax + 0xc]
push 0x10062f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2b8
push 0x10062d0
call fcn.010a4cf0
add esp, 0x14
mov esi, eax
jmp 0x108d594
push esi
call fcn.010a96af
pop ecx
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov eax, dword [0x1232c24]
mov eax, dword [eax + 0xc]
push esi
push dword [ebp - 0x10]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x108d45a
mov eax, dword [0x1232c24]
push dword [eax + 0xc]
push 0x1006278
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c2
jmp 0x108d48c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1006240
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x108d4a0
mov eax, dword [0x1232c24]
push dword [eax + 0xc]
push 0x10061f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2cc
push 0x10062d0
call fcn.010a4cf0
add esp, 0x14
mov esi, eax
jmp 0x108d585
mov eax, dword [ebp - 4]
push ebx
movzx ebx, word [eax]
push edi
movzx edi, word [eax + 2]
mov esi, 0x1232c44
push 0x40
mov ecx, esi
call fcn.010820b6
movzx edi, di
movzx ebx, bx
push edi
push ebx
push 0x10061a0
push esi
call fcn.0108446c
mov eax, dword [0x1232c44]
mov eax, dword [eax + 0xc]
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x108d508
mov eax, dword [0x1232c24]
push dword [eax + 0xc]
push 0x1006148
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e1
jmp 0x108d566
push dword [ebp - 4]
mov ecx, esi
call fcn.0108354b
mov esi, 0x1232c40
push 0x40
mov ecx, esi
call fcn.010820b6
push edi
push ebx
push 0x10060f8
push esi
call fcn.0108446c
mov eax, dword [0x1232c40]
mov eax, dword [eax + 0xc]
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x108d577
mov eax, dword [0x1232c24]
push dword [eax + 0xc]
push 0x10060a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2f2
push 0x10062d0
call fcn.010a4cf0
add esp, 0x14
mov esi, eax
jmp 0x108d583
push dword [ebp - 4]
mov ecx, esi
call fcn.0108354b
xor esi, esi
pop edi
pop ebx
cmp dword [ebp - 8], 0
je 0x108d594
push dword [ebp - 8]
call fcn.010a9620
pop ecx
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret