joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d6d27
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1016420c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x428], eax
xor edi, edi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], edi
push eax
push 9
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov esi, edi
mov dword [ebp - 0x41c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100d6d7a
xor eax, eax
jmp 0x100d6e79
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100d6e66
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100d6e4c
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.100e23d0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d6e44
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.100e2d93
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100d6db6
push dword [ebp - 0x418]
call edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001cd0b
mov esp, ebp
pop ebp
ret 4
Function at 0x100d77bd
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1016420c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x418], ebx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x41c], ebx
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100d7908
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x100d78e2
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100d78d4
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.100e23d0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d78cc
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.100e2d93
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100d783e
push dword [ebp - 0x418]
call edi
test esi, esi
jne 0x100d79fd
xor ebx, ebx
lea eax, [ebp - 0x418]
push eax
push 9
push ebx
push 0x1014f2e8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d79fd
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
jmp 0x100d79e1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100d79d3
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.100e23d0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d79cb
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.100e2d93
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100d793d
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001cd0b
mov esp, ebp
pop ebp
ret 4
Function at 0x100d7b75
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x10110e23
call fcn.10109fe9
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x100d7be0
lea eax, [ebp - 0x218]
push eax
call fcn.100f8658
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.1001a800
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.100f8658
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.1001b4e0
xor ebx, ebx
cmp word [esi], bx
jne 0x100d7c1a
mov eax, ebx
jmp 0x100d7c21
push esi
call fcn.100f8658
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.1001b4e0
mov esi, str..lnk
push esi
call fcn.100f8658
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.1001b4e0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x100d7d2f
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.100e23d0
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.100e23d0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.100f8636
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.100d654c
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.100f8658
pop ecx
test eax, eax
jne 0x100d7d1d
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.100f8636
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x100d7d2f
xor esi, esi
inc esi
jmp 0x100d7d31
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.100ccb12
mov eax, esi
call fcn.10109f93
ret 4
Function at 0x100d7d49
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1016420c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x10170570]
test al, al
jne 0x100d7de2
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100d7dd9
lea eax, [ebp - 0x20c]
push eax
call fcn.100f8996
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.100e2d93
pop ecx
pop ecx
test eax, eax
jne 0x100d7dd1
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.100e2d93
pop ecx
pop ecx
test eax, eax
je 0x100d7dd9
mov byte [0x10170570], bl
jmp 0x100d7ddf
mov bl, byte [0x10170570]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001cd0b
mov esp, ebp
pop ebp
ret
Function at 0x100d8b14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1016420c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.100e23d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100d8b7f
lea eax, [ebp - 0x20c]
push 0x101126e4
push eax
call fcn.100f85c5
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.100d7e2b
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001cd0b
mov esp, ebp
pop ebp
ret 4

Function at 0x100d9027
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x1010fcff
call fcn.10109fe9
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100d9127
cmp byte [ebx + 0x3d], 0
je 0x100d9127
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x100d9061
xor al, al
jmp 0x100d9129
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.100d9173
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100d90bf
sub eax, 1
je 0x100d90c3
dec eax
sub eax, 1
je 0x100d9115
xor bl, bl
jmp 0x100d9117
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x100d90fb
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100ec841
add esp, 0x10
cmp esi, eax
jne 0x100d90bb
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x100d9115
test esi, esi
jne 0x100d9085
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.100ccbe0
jmp 0x100d907f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100ccabd
mov al, bl
jmp 0x100d9129
mov al, 1
call fcn.10109f93
ret

Function at 0x100d953b
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x100d9dcd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x100d9e9a
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10113240
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10113240
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10113240
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10113240
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.100f75e0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x100d9e76
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.100f75e0
pop ecx
pop ecx
test eax, eax
je 0x100d9eb7
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x100d9e00
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.100f8d70
pop ecx
test eax, eax
je 0x100d9eb7
push ebx
mov ecx, edi
call fcn.100da7f9
mov al, 1
jmp 0x100d9eb9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100da73c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1016420c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.100e23d0
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x100da79d
mov ecx, esi
call fcn.100da193
jmp 0x100da7b2
mov ebx, edi
test edi, edi
jne 0x100da7b2
mov ecx, esi
call fcn.100da06e
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x100da79f
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001cd0b
mov esp, ebp
pop ebp
ret

Function at 0x100de3f0
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push 0x20c
mov eax, 0x10111761
call fcn.10109fe9
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100de42f
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100e23d0
push 0x98967f
push 0xf4240
call fcn.100cb59f
add esp, 0x14
cmp dword [esi + 0x14], 8
jb 0x100de45b
mov esi, dword [esi]
push eax
push esi
lea eax, [ebp - 0x218]
push str._s__d
push eax
call fcn.1001c070
add esp, 0x10
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
cmovae eax, dword [ebp + 0xc]
push ebx
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x100de4a8
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100de4a8
mov bl, 1
push 0
push 1
lea ecx, [ebp + 0xc]
call fcn.100ccb12
mov al, bl
call fcn.10109f93
ret 0x1c
Function at 0x100de551
Capabilities:
Check if file exists

Disassembly:
push 0x228
mov eax, 0x1011179b
call fcn.10109fe9
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov ebx, dword [ebp + 0xc]
push 0x208
push 0
push eax
mov dword [ebp - 0x234], 1
call fcn.100e23d0
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100cc064
and dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.100cb0d8
add edi, 0x58
add esp, 0x1c
cmp ebx, edi
je 0x100de5cd
push 0xffffffffffffffff
push 0
push edi
mov ecx, ebx
call fcn.1001a6e0
mov esi, str.CfgPath
push esi
call fcn.100f8658
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.1001b4e0
mov esi, 0x101126e4
push esi
call fcn.100f8658
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.1001b4e0
cmp dword [ebx + 0x14], 8
jb 0x100de601
mov eax, dword [ebx]
jmp 0x100de603
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100de625
cmp dword [ebx + 0x14], 8
jb 0x100de618
mov eax, dword [ebx]
jmp 0x100de61a
mov eax, ebx
push eax
call fcn.100cab3e
pop ecx
mov esi, eax
jmp 0x100de62b
mov esi, dword [ebp - 0x234]
cmp word [ebp - 0x218], 0
jne 0x100de639
xor eax, eax
jmp 0x100de646
lea eax, [ebp - 0x218]
push eax
call fcn.100f8658
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.1001b4e0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.100ccb12
mov eax, esi
call fcn.10109f93
ret 8

Function at 0x100de66e
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x840
mov eax, 0x101117ce
call fcn.10109fe9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x830]
mov esi, dword [ebp + 0xc]
mov ebx, 0x208
and dword [ebp - 0x84c], 0
push ebx
push 0
push eax
call fcn.100e23d0
lea eax, [ebp - 0x848]
push esi
push eax
call fcn.100cc064
xor esi, esi
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push ecx
cmovae eax, dword [ebp - 0x848]
push eax
mov dword [ebp - 4], esi
call fcn.100cb0d8
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100e23d0
push ebx
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.100e23d0
push ebx
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.100e23d0
add esp, 0x40
lea eax, [ebp - 0x420]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100f8636
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100f85c5
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100de76d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.1001ab20
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.100ccb12
mov eax, edi
call fcn.10109f93
ret 8
Function at 0x100df15d
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x101118c4
call fcn.10109fe9
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
cmp ecx, ebx
sete al
test al, al
je 0x100df189
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x100df2ea
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x100df1b7
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100df1b7
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x100df2ea
cmp dword [esi + 0x4c], 0
je 0x100df2e8
mov ecx, esi
call fcn.100defff
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x100df1e7
push dword [esi + 0x4c]
mov esi, dword [ebp + 8]
push esi
call fcn.100ddd2c
test al, al
pop ecx
pop ecx
cmovne ebx, esi
jmp 0x100df2e8
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.100d9173
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x1c]
test eax, eax
js 0x100df2dc
cmp eax, 1
jg 0x100df2c1
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x100df292
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.100ec841
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x100df2dc
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x40], eax
jne 0x100df2bc
test edx, edx
jne 0x100df212
cmp dword [ebp - 0x18], 0x20
jae 0x100df2dc
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.100ccbe0
jmp 0x100df20f
mov ebx, dword [ebp + 8]
jmp 0x100df2dc
cmp eax, 3
jne 0x100df2dc
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.100ddd2c
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100ccabd
mov eax, ebx
call fcn.10109f93
ret 4
Function at 0x100df9c9
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x1014fe90
mov esi, ecx
call ebx
mov dword [esi], eax
test eax, eax
je 0x100dfa49
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10150b38
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push 0x10150b8c
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x100dfa48
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x100e05e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea esi, [ebx + 0x7c]
test edi, edi
je 0x100e065b
cmp dword [ebp + 0x14], 0
je 0x100e065b
cmp esi, dword [ebp + 0x14]
jbe 0x100e0606
xor eax, eax
jmp 0x100e065d
cmp esi, 0x40
jb 0x100e0602
push 0x80
push 0x1016cc28
push edi
call fcn.100e10e0
lea eax, [esi - 0x80]
push eax
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea eax, [edi + 0x80]
push eax
call fcn.100e10e0
mov eax, 0x5a4d
add esp, 0x18
cmp word [edi], ax
jne 0x100e0602
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 0x3c], eax
test eax, eax
js 0x100e0602
cmp eax, ebx
jg 0x100e0602
xor ecx, ecx
cmp dword [eax + edi], 0x4550
cmovne esi, ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100ff17c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fee3c

Function at 0x1010025d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101000dc

Function at 0x1010a580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111b23
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1016420c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x10171014
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x10171014
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x10112463
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1010e0b0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40381c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x408008], 0x8088405
inc edx
mov dword [ebx + 0x408008], edx
mul edx
mov eax, edx
pop ebx
ret