joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
cmp byte [edi + 0x75], 0
je 0x100c7cc6
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
lea ecx, [edi + 0x94]
call fcn.100aad40
push 0
push 0
push edi
push 0x100aae90
push 0
push 0
call sub.msvcrt.dll__beginthreadex
mov esi, dword [ebp - 8]
add esp, 0x18
or ebx, 0xffffffff
mov dword [edi + 0xb0], eax
test eax, eax
je 0x100c7d4d
mov byte [edi + 0x75], 1
test esi, esi
je 0x100c7d09
lock inc dword [esi + 4]
mov eax, dword [ebp - 0xc]
mov dword [edi + 0xa4], eax
mov ebx, dword [edi + 0xa8]
mov dword [edi + 0xa8], esi
test ebx, ebx
je 0x100c7d44
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x100c7d44
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x100c7d44
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 1], 1
or ebx, 0xffffffff
jmp 0x100c7d51
mov byte [ebp - 1], 0
test esi, esi
je 0x100c7d73
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x100c7d73
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x100c7d73
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov al, byte [ebp - 1]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100c89e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
push 0x20219
push 0x208
lea eax, [ebp - 0x414]
push eax
push 1
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSogou_Input
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10176900
add esp, 0x28
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100c8bd2
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x414]
push eax
call fcn.10023e80
test al, al
jne 0x100c8aa2
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8a80
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x418]
call fcn.10003740
push esi
push 0x10209334
lea ecx, [ebp - 0x418]
call fcn.100ca9e0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
add esp, 0xc
push str.ComponentsSogouComMgr.exe
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100c8af8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x100c8b11
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x100c8b1e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x418], eax
test esi, esi
je 0x100c8b2f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x418]
pop esi
cmp eax, 0xffffffff
je 0x100c8bba
test al, 0x10
jne 0x100c8bba
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, ebx
mov dword [ebx], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10023e80
test al, al
jne 0x100c8b8e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8b70
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10003740
add edi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100c8c01
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100c8bd2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, ebx
push 0x10202940
mov dword [ebx], eax
call fcn.10023e80
test al, al
jne 0x100c8c01
push 0
push 0x10202940
mov ecx, ebx
call fcn.10003740
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x100c9f80
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
push 0x208
push 0
lea edi, [eax + 0x10]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], edi
push eax
call sub.msvcrt.dll_memset
push 0x20219
push 0x208
lea eax, [ebp - 0x414]
push eax
push 1
push 0x10202940
push str.SOFTWARESogouExtension
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10176900
add esp, 0x28
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100ca14a
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x100ca010
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ca010
sub ecx, edx
lea eax, [ebp - 0x414]
push esi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x418]
call fcn.10003740
push 0x10209334
lea ecx, [ebp - 0x418]
call fcn.100ca9e0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
add esp, 0xc
push str.ExtensionManager.exe
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100ca088
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x100ca0a1
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x100ca0ae
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x418], eax
test esi, esi
je 0x100ca0bf
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x418]
pop esi
cmp eax, 0xffffffff
je 0x100ca14a
test al, 0x10
jne 0x100ca14a
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, ebx
mov dword [ebx], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10023e80
test al, al
jne 0x100ca11e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x100ca100
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ca100
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10003740
add edi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100ca191
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, ebx
push 0x10202940
mov dword [ebx], eax
call fcn.10023e80
test al, al
jne 0x100ca179
push 0
push 0x10202940
mov ecx, ebx
call fcn.10003740
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100ca191
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x100d4980
Capabilities:
Persist via run registry key

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0xc4]
mov esi, dword [edi + 0xc0]
cmp esi, ebx
je 0x100d49a9
mov ecx, esi
call fcn.100d3de0
add esi, 0x18
cmp esi, ebx
jne 0x100d4995
mov esi, dword [edi + 0xc0]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov ecx, edi
mov dword [edi + 0xc4], esi
call fcn.100d49e0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.100d49e0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100d96b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x100d96c7
xor eax, eax
pop ebp
ret 4
push 0x47
call fcn.10003680
add esp, 4
test eax, eax
je 0x100d96d8
pop ebp
jmp eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DeleteFileW]

Function at 0x100d96e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d96fb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x2a
call fcn.10003680
add esp, 4
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x100d9713
call eax
jmp 0x100d9719
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, eax
test esi, esi
je 0x100d9726
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x100d9730
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d974b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x49
call fcn.10003680
add esp, 4
push dword [ebp + 8]
test eax, eax
je 0x100d9760
call eax
jmp 0x100d9766
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test esi, esi
je 0x100d9773
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x100d9800
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
push edi
mov edi, dword [ebp + 8]
push SysReAllocString
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x100d9862
push esi
push SysReAllocString
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100d985b
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d9870
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x100d9905
cmp word [esi], 0
je 0x100d9905
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100d9890
sub eax, edx
xor ecx, ecx
sar eax, 1
mov edx, 2
lea ebx, [eax + 1]
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x100d9905
push esi
push ebx
push edi
call fcn.101ef650
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x100d98ee
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100d98ee
push edi
call fcn.100d9870
add esp, 4
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100d9c10
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d9dd8
cmp word [esi], 0
je 0x100d9dd8
cmp dword [ebp + 0xc], 0
je 0x100d9c41
push 0
push esi
call fcn.1010aeb0
mov ecx, eax
call fcn.1010aad0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x100d9c71
push esi
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x100d9c66
push esi
call fcn.100d96b0
test eax, eax
je 0x100d9ca4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100d9c5c
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x100d9c5c
push esi
call fcn.100dc6a0
add esp, 4
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
jmp 0x100d9c62
push ebx
push esi
lea ecx, [ebp - 4]
call fcn.10002490
push 0x10205260
push 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.10009ca0
push eax
call fcn.10033f60
mov edx, dword [ebp - 8]
or ebx, 0xffffffff
add esp, 8
mov byte [ebp + 0xb], al
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100d9ced
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp + 0xb]
test al, al
je 0x100d9db5
mov edi, dword [ebp - 4]
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x100d9d08
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x100d9d14
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, 1
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [edi - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], esi
lea edx, [eax + 4]
mov eax, dword [esi - 8]
sub eax, edx
or ecx, eax
jge 0x100d9d47
push edx
lea ecx, [ebp + 8]
call fcn.10003310
mov esi, dword [ebp + 8]
test esi, esi
jne 0x100d9d5d
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.101e6c20
jmp 0x100d9d6c
mov eax, dword [0x10205260]
mov dword [esi], eax
mov eax, dword [0x10205264]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push edi
push eax
lea eax, [esi + 8]
push eax
call fcn.10004510
mov eax, dword [ebp - 8]
xor ecx, ecx
add eax, 4
add esp, 0x10
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.10002790
lea ecx, [ebp + 8]
call fcn.10007e10
mov esi, dword [ebp - 4]
push 1
push esi
call fcn.100d9c10
add esp, 8
mov edi, eax
jmp 0x100d9dba
mov esi, dword [ebp - 4]
xor edi, edi
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
pop ebx
jg 0x100d9dd0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100da9e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100da9fb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 8
call fcn.10003680
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
test eax, eax
je 0x100daa22
call eax
jmp 0x100daa28
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test esi, esi
je 0x100daa35
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0xffffffff
jne 0x100daa40
pop edi
xor eax, eax
pop esi
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100daa60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10259508]
sub esp, 0xc
test al, 1
jne 0x100daa8b
or eax, 1
push 0x4000
mov dword [0x10259508], eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [0x10259504], eax
jmp 0x100daa90
mov eax, dword [0x10259504]
test eax, eax
je 0x100daaf6
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100daaf6
cmp eax, 0x3ffe
ja 0x100daaf6
push dword [0x10259504]
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100daaf6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x10202944
push dword [0x10259504]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100daaf6
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0xa]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100dab60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10259500]
sub esp, 0xc
test al, 1
jne 0x100dab8b
or eax, 1
push 0x4000
mov dword [0x10259500], eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [0x102594fc], eax
jmp 0x100dab90
mov eax, dword [0x102594fc]
test eax, eax
je 0x100dabfd
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100dabfd
cmp eax, 0x3ffe
ja 0x100dabfd
push dword [0x102594fc]
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100dabfd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x10202944
push dword [0x102594fc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100dabfd
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + 0xc]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100dac10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x200c]
push edi
mov edi, dword [ebp + 0xc]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100daca4
cmp eax, 0x1fff
ja 0x100daca4
lea ecx, [ebp - 0x2004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100daca4
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x2008]
push eax
push 0x10202944
lea eax, [ebp - 0x2004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100daca4
mov ecx, dword [ebp - 0x2008]
mov eax, dword [ecx + 0xc]
mov dword [edi], eax
mov eax, dword [ecx + 8]
mov dword [edi + 4], eax
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100dc8d0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100dc931
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100dc928
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100dd0c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 4]
push str.360EntClient.exe
push eax
call fcn.101b0cc0
add esp, 4
push eax
lea eax, [ebp - 8]
push eax
call fcn.10007f40
mov edx, dword [ebp - 4]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100dd104
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100dd126
push esi
call fcn.100a1350
add esp, 4
test eax, eax
je 0x100dd126
mov edi, 1
jmp 0x100dd128
xor edi, edi
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x100dd13d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dd880
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10259510], 0
jne 0x100dd949
push 0x10258e8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10259510], 0
jne 0x100dd93e
call fcn.100de1d0
test eax, eax
je 0x100dd934
push 0xf023f
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], 1
push eax
lea eax, [ebp - 0x40c]
push eax
push str.NoIE4StubProcessing
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100585c0
test eax, eax
jne 0x100dd934
push 0x1025950c
call fcn.100db490
add esp, 4
test eax, eax
je 0x100dd934
cmp dword [0x1025acd4], 0
je 0x100dd934
cmp dword [0x1025ad00], 1
jne 0x100dd934
mov dword [0x1025950c], 9
mov dword [0x10259510], 1
push 0x10258e8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [0x1025950c]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100ddff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de02a
cmp dword [ebp - 0x110], 0
jbe 0x100de03f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de09c
cmp dword [ebp - 0x110], 2
jae 0x100de09e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
jbe 0x100de08c
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de0c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x100de15f
cmp dword [ebp - 0x110], 1
jne 0x100de15f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret