joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100230e4
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x318
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x318], eax
push 0x80
mov eax, 0x1005ee2a
call fcn.1003230f
mov esi, dword [ebp + 0x324]
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x88]
push ebx
push eax
mov dword [ebp - 0x8c], ebx
call fcn.10031b60
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x104
push edi
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.10031b60
add esp, 0x18
push 0x105
lea eax, [ebp]
push eax
push dword [0x1007cd54]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
lea eax, [ebp + 0x109]
push ebx
push eax
mov byte [ebp + 0x108], bl
call fcn.10031b60
push edi
lea eax, [ebp + 0x211]
push ebx
push eax
mov byte [ebp + 0x210], bl
call fcn.10031b60
push ebx
push ebx
lea eax, [ebp + 0x210]
push eax
lea eax, [ebp + 0x108]
push eax
lea eax, [ebp]
push eax
call fcn.10036224
add esp, 0x2c
lea eax, [ebp + 0x108]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001432
lea eax, [ebp + 0x210]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.10001c79
push str.hpqusgm.exe
lea ecx, [ebp - 0x1c]
call fcn.10001c79
lea ecx, [ebp - 0x14]
call fcn.100013fb
push esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str.__s___s
push eax
mov byte [ebp - 4], 1
call fcn.10001266
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.10001130
inc eax
push eax
call fcn.1002f7f6
push dword [ebp - 0x10]
mov esi, eax
push esi
call fcn.10031100
add esp, 0xc
call fcn.10023c2a
test eax, eax
je 0x1002324a
mov edi, 0x26d
push edi
call fcn.10023c32
pop ecx
test eax, eax
je 0x1002324a
push esi
push edi
call fcn.100248d5
pop ecx
pop ecx
cmp eax, 2
jne 0x1002324a
push dword [0x1007b714]
push dword [0x1007b710]
push edi
call fcn.10023c3b
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x8c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov edi, eax
call fcn.100312c8
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10001636
cmp edi, ebx
je 0x100232ea
cmp dword [ebp + 0x328], ebx
je 0x100232ea
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push dword [ebp - 0x2c]
call edi
test eax, eax
je 0x100232e1
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x100232c7
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
call esi
test eax, eax
jne 0x100232b3
push 0x64
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x100232c7
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x318]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x31c
leave
ret
Function at 0x10023aaa
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x10025806
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x264
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x264], eax
push 0x28
mov eax, 0x1005f306
call fcn.1003230f
mov eax, dword [ebp + 0x278]
mov esi, dword [ebp + 0x270]
mov edi, dword [ebp + 0x274]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x27c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x280]
xor ebx, ebx
push 0x13c
mov dword [ebp - 0x10], eax
lea eax, [ebp + 4]
push ebx
push eax
mov dword [ebp], ebx
call fcn.10031b60
xor eax, eax
push 0x104
mov word [ebp + 0x15c], ax
lea eax, [ebp + 0x15e]
push ebx
push eax
call fcn.10031b60
add esp, 0x18
push ebx
lea ecx, [ebp + 0x140]
mov dword [ebp + 0x158], 0xf
call fcn.10003416
push dword [ebp - 0x18]
lea eax, [ebp + 0x15c]
push dword [ebp - 0x14]
mov dword [ebp - 4], ebx
push edi
push esi
push eax
call fcn.10037b25
add esp, 0x14
lea eax, [ebp]
push eax
lea eax, [ebp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002590b
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x34]
call fcn.1000557a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.1001299f
push ebx
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.100048de
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100258cb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp + 0x140]
call fcn.100048de
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x268
leave
ret
Function at 0x10025d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10025da6
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.10031b60
add esp, 0xc
push 0
lea eax, [ebp - 0x108]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x10025da8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100302c9
leave
ret

Function at 0x100267c3
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x1005f396
call fcn.10032378
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 2
call fcn.1000e90d
jmp 0x1002688c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.1000545a
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.1000545a
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.1000c951
cmp dword [eax + 0x18], 0x10
jb 0x1002681d
mov eax, dword [eax + 4]
jmp 0x10026820
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.1000f7f0
lea ecx, [ebp - 0x50]
call fcn.1000c951
cmp dword [eax + 0x18], 0x10
jb 0x1002683c
mov eax, dword [eax + 4]
jmp 0x1002683f
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000f7f0
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x10026854
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x10026860
lea eax, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100048de
push 0
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.100048de
lea ecx, [ebp - 0x50]
call fcn.1000c97d
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x50]
lea ecx, [ebp - 0x58]
call fcn.1000e90d
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x50]
call fcn.1000c9ac
test al, al
je 0x100267ea
push 0
push 1
lea ecx, [ebp + 8]
call fcn.100048de
push 0
push 1
lea ecx, [ebp + 0x24]
call fcn.100048de
lea ecx, [ebp + 0x40]
call fcn.100114c4
push dword [ebp + 0x40]
call fcn.1002f915
xor eax, eax
pop ecx
inc eax
call fcn.100323fb
ret
Function at 0x100268e1
Capabilities:
Enumerate files on windows

Disassembly:
push 0x19c
mov eax, 0x1005f3d6
call fcn.10032378
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor edi, edi
push 0x13c
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x184]
push edi
push eax
mov dword [ebp - 0x188], edi
call fcn.10031b60
add esp, 0xc
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1000557a
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], edi
call fcn.1002640f
pop ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.1000f7f0
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x10026947
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x188]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100269d3
push ebx
lea ecx, [ebp - 0x48]
call fcn.1000557a
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.1002640f
pop ecx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.100104cc
add esp, 0xc
mov ecx, dword [ebp - 0x18c]
push eax
mov byte [ebp - 4], 2
call fcn.1001299f
push edi
push 1
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 1
call fcn.100048de
lea eax, [ebp - 0x188]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10026973
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.100048de
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.100048de
xor eax, eax
inc eax
call fcn.100323fb
ret
Function at 0x1002842b
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.100283d9
add esp, 0xc
neg eax
sbb eax, eax
inc eax
ret

Function at 0x10028553
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
call fcn.1002846b
test eax, eax
je 0x10028575
inc esi
jmp 0x100285b1
call fcn.10028453
test eax, eax
jne 0x100285b1
mov esi, 0x94
push esi
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.10031b60
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
sbb esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100302c9
leave
ret

Function at 0x10028783
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x1002879a
mov eax, dword [ebp + 0x14]
push 6
mov dword [eax], edi
pop eax
jmp 0x1002880c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x100287d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
cmp dword [ebp + 0x10], edi
je 0x100287cf
push dword [ebp + 0x10]
call fcn.1002f915
pop ecx
mov eax, esi
jmp 0x1002880b
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
cmp dword [ebp - 4], eax
jbe 0x10028825
push dword [ebp - 4]
call fcn.1002f7f6
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x1002880f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0x14]
push dword [eax]
push ebx
push dword [ebp + 0x10]
call fcn.1002fd60
add esp, 0xc
push 0xe
pop eax
jmp 0x10028802
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x1002884a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
jmp 0x1002880a
xor eax, eax
jmp 0x10028843
Function at 0x10028c38
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x3e8
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x3e8], eax
push 0x20
mov eax, 0x1005f92d
call fcn.1003230f
mov eax, dword [ebp + 0x3f8]
mov ebx, dword [ebp + 0x3f4]
mov esi, str.MarsUnknown
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x3fc]
movsd dword es:[edi], dword [esi]
push 0x1e8
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x200]
push 0
push eax
movsd dword es:[edi], dword [esi]
call fcn.10031b60
add esp, 0xc
push ebx
lea ecx, [ebp - 0x18]
call fcn.10001432
push dword [ebp - 0x24]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001432
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10028b25
lea eax, [ebp - 0x2c]
push eax
call fcn.10028514
add esp, 0xc
push dword [eax + 4]
lea eax, [ebp]
push 0x1f4
push eax
lea eax, [ebp + 0x1f4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x2c]
call fcn.10001636
lea eax, [ebp + 0x1f4]
push eax
lea eax, [ebp]
push eax
call fcn.10030de6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x10028d1a
lea eax, [ebp]
push eax
call fcn.10001145
mov al, 1
jmp 0x10028d21
call fcn.100010c6
xor al, al
lea ecx, [ebp - 0x20]
movzx esi, al
mov byte [ebp - 4], 0
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10001636
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3e8]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x3ec
leave
ret
Function at 0x100294e2
Capabilities:
Set registry value

Disassembly:
push 0x18
mov eax, 0x1005fb7c
call fcn.1003230f
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.10001432
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10001432
mov byte [ebp - 4], 1
call fcn.10028553
test eax, eax
je 0x10029546
push dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
call fcn.10001432
push dword [eax + 4]
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10028bb9
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.10001636
jmp 0x100295d9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.10028e96
push dword [ebp - 0x18]
push SysStringLen
call fcn.100285c4
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x1002958e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], al
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10001636
xor eax, eax
call fcn.100323e7
ret
push dword [ebp + 0x10]
call fcn.100300d0
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
test eax, eax
je 0x100295d3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10001636
mov eax, esi
jmp 0x10029588
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
inc esi
jmp 0x100295b7
Function at 0x10029dc6
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x810c]
mov eax, 0x810c
call fcn.10036ff0
push 0xffffffffffffffff
push 0x1005fd80
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x8108], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x811c]
mov eax, dword [ebp + 0x8118]
mov edi, dword [ebp + 0x8114]
mov dword [ebp - 0x1c], ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.10001432
xor esi, esi
mov dword [ebp - 4], esi
call fcn.10028553
test eax, eax
je 0x10029ec0
lea eax, [ebp - 0x14]
push eax
call fcn.10028514
pop ecx
push dword [eax + 4]
lea eax, [ebp]
push 0x7fff
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.10001636
cmp edi, esi
jbe 0x10029f6a
lea ebx, [ebp]
push 0x10062dd0
push ebx
call fcn.10030bd5
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x10029eaa
push 0x5c
push edi
call fcn.1003060d
pop ecx
pop ecx
cmp eax, esi
jne 0x10029eaa
push edi
lea ecx, [ebp - 0x14]
call fcn.10001432
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.10029c4d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.10001636
push esi
push ebx
call fcn.1003060d
inc eax
mov ebx, eax
cmp byte [ebx], 0
pop ecx
pop ecx
jne 0x10029e64
jmp 0x10029f6a
push dword [ebp - 0x20]
push edi
call fcn.10028f39
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
jne 0x10029f02
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10001636
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8108]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x810c
leave
ret
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.100013fb
mov edi, 0x104
push edi
lea eax, [ebp + 0x8000]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov byte [ebp - 4], 2
jmp 0x10029f50
lea eax, [ebp + 0x8000]
push eax
lea ecx, [ebp - 0x14]
call fcn.10001145
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
call fcn.10029c4d
inc dword [ebp - 0x18]
push edi
lea eax, [ebp + 0x8000]
push eax
push dword [ebp - 0x18]
push ebx
call esi
test eax, eax
je 0x10029f27
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.10001636
xor esi, esi
inc esi
jmp 0x10029ed1
Function at 0x1002ab2f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [ebx], ax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, ecx
push edi
push dword [ebp + 0x14]
shr eax, 4
inc eax
movzx edi, ax
push edi
push 6
push dword [ebp + 0x18]
and ecx, 0xf
mov dword [ebp + 0xc], ecx
call esi
test eax, eax
jne 0x1002ab7a
push 0x409
push edi
push 6
push dword [ebp + 0x18]
call esi
test eax, eax
je 0x1002abe2
push eax
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x1002abe2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002abd9
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x1002aba9
dec eax
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x1002ab9f
mov edi, dword [ebp + 0x10]
movzx eax, word [esi]
dec edi
cmp edi, eax
jge 0x1002abb6
mov eax, edi
push eax
lea eax, [esi + 2]
push eax
push ebx
call fcn.1003259e
movzx eax, word [esi]
add esp, 0xc
cmp edi, eax
jge 0x1002abcd
mov eax, edi
xor ecx, ecx
mov word [ebx + eax*2], cx
movzx eax, word [esi]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002c16b
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x4a0]
sub esp, 0x520
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x49c], eax
mov eax, dword [ebp + 0x4b0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x4ac]
push eax
push 0x104
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x4a8]
call fcn.1002ac98
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ebx, ebx
cmp eax, 0x3fffffff
jle 0x1002c1c5
xor eax, eax
jmp 0x1002c1de
lea esi, [eax + eax]
mov eax, esi
call fcn.10031b30
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.100013bb
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.10031100
lea eax, [ebp + 0x190]
push str..lnk
push eax
call fcn.10031110
mov esi, 0x103
push esi
lea eax, [ebp + 0x399]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp + 0x398], bl
call fcn.10031b60
push esi
lea eax, [ebp + 0x295]
push ebx
push eax
mov byte [ebp + 0x294], bl
call fcn.10031b60
add esp, 0x28
lea eax, [ebp - 0x7c]
push eax
push 2
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1002c323
lea eax, [ebp + 0x398]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov esi, eax
cmp esi, 1
jne 0x1002c2a7
lea eax, [ebp + 0x398]
push eax
call fcn.100300d0
pop ecx
test eax, eax
jbe 0x1002c2a7
lea eax, [ebp + 0x398]
push eax
call fcn.1002c12c
lea eax, [ebp + 0x398]
push edi
push eax
call fcn.10031110
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x294]
push eax
call fcn.10031100
lea eax, [ebp + 0x398]
push eax
call fcn.1002c12c
add esp, 0x18
cmp dword [ebp - 0x7c], ebx
je 0x1002c2ce
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x80]
push dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
je 0x1002c323
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push eax
call fcn.10031110
pop ecx
pop ecx
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002c323
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1002c323
lea eax, [ebp + 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp + 0x294]
push eax
call fcn.1002c0df
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x49c]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x4a0
leave
ret
Function at 0x1002c864
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0xc
mov eax, 0x10060254
call fcn.1003230f
mov esi, dword [ebp + 0x114]
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.100013fb
lea eax, [ebp - 0x10]
push eax
push 0x17
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1002c8f6
push 0x104
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.10031b60
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x1002c8f6
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10001145
push esi
call fcn.1002c7fe
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x10c
leave
ret

Function at 0x1002c95a
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0xc
mov eax, 0x100602c9
call fcn.1003230f
mov esi, dword [ebp + 0x114]
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.100013fb
lea eax, [ebp - 0x10]
push eax
push 2
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1002c9ec
push 0x104
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.10031b60
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x1002c9ec
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10001145
push esi
call fcn.1002c7fe
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x10c
leave
ret

Function at 0x1002e971
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push dword [esi + 0x104]
call fcn.1003837c
push dword [esi + 0x104]
mov ebx, dword [esp + 0x18]
push 0x64
push 1
push ebx
mov ebp, eax
call fcn.100381c2
add esp, 0x14
test eax, eax
jne 0x1002e9a1
inc eax
jmp 0x1002e9e8
movsx eax, byte [esi + 0x108]
push edi
push eax
push ebx
call fcn.1003060d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1002e9e5
sub eax, ebx
push 0
lea eax, [eax + ebp + 1]
push eax
push dword [esi + 0x104]
call fcn.10037e80
push dword [esi + 0x104]
call fcn.1003837c
push 0x100648b4
push edi
call fcn.10031100
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4