joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10916058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.109161a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1091607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1091606a
add dl, dl
jne 0x10916089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109160dc
xor eax, eax
add dl, dl
jne 0x10916096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1091617d
add dl, dl
jne 0x109160a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109160b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109160bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109160c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x109160d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10916075
mov eax, 1
add dl, dl
jne 0x109160ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109160f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109160e1
sub eax, ebx
mov ebx, 1
jne 0x10916128
mov ecx, 1
add dl, dl
jne 0x1091610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10916119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10916105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10916075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1091613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1091614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10916136
cmp eax, 0x7d00
jae 0x1091616d
cmp eax, 0x500
jb 0x10916168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10916075
cmp eax, 0x7f
ja 0x10916170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10916075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1091619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10916075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x930058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009301a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x93007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93006a
add dl, dl
jne 0x930089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9300dc
xor eax, eax
add dl, dl
jne 0x930096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93017d
add dl, dl
jne 0x9300a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9300b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9300bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9300c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9300d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x930075
mov eax, 1
add dl, dl
jne 0x9300ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9300f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9300e1
sub eax, ebx
mov ebx, 1
jne 0x930128
mov ecx, 1
add dl, dl
jne 0x93010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x930119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x930105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x930075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x93013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x930136
cmp eax, 0x7d00
jae 0x93016d
cmp eax, 0x500
jb 0x930168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x930075
cmp eax, 0x7f
ja 0x930170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x930075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x93019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x930075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1007ec4
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov edi, ecx
call fcn.01007e83
test eax, eax
je 0x1007ee1
xor eax, eax
inc eax
jmp 0x1007fe6
push ebx
push esi
mov ebx, 0xf003f
push ebx
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1007f15
push esi
add edi, 0x84
push edi
push 0x1002bd4
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x1007fe4
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push 0x1002bc4
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push 1
push 3
push 0x10
push 0xf01ff
add edi, 0x84
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, esi
jne 0x1007f6a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
push 0x1002b94
jmp 0x1007f07
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push esi
push esi
push esi
push 0x1002b18
push 0x80000002
mov dword [ebp - 0xc], 7
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1007fe1
mov edi, str._systemroot__system32_rsopprov.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 2
push esi
push 0x1002af0
push dword [ebp - 8]
call edi
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push esi
push 0x1002ad0
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x1007fe9
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.01007e83
test eax, eax
jne 0x1007ffe
inc eax
jmp 0x1008090
push ebx
push ebp
push edi
push 0xf003f
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebp
jne 0x1008025
push ebp
add esi, 0x84
push esi
push 0x1002bd4
jmp 0x100804c
push 0x10020
lea ebx, [esi + 0x84]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebp
jne 0x100804f
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
push ebx
push 0x1002c4c
push ebp
jmp 0x1008085
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
je 0x100807b
xor eax, eax
inc eax
jmp 0x100808d
push 0
push ebx
push 0x1002c10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x1008199
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x1008627
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x2000
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x1008655
mov eax, 0x8007000e
jmp 0x10087be
push eax
mov ecx, ebx
call fcn.01008535
test eax, eax
jge 0x1008668
mov edi, eax
jmp 0x10087ae
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.010083e2
test eax, eax
jne 0x1008682
mov edi, 0x80020009
jmp 0x10087ae
push edi
call esi
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0xc], esi
jne 0x1008699
mov edi, 0x8007000e
jmp 0x10087ae
mov ecx, ebx
call fcn.01008513
push esi
mov ecx, ebx
call fcn.01008535
test eax, eax
jl 0x10087a4
movzx eax, word [ebp - 2]
sub eax, 8
je 0x1008789
sub eax, 9
je 0x10086ec
dec eax
dec eax
jne 0x1008795
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.0100817f
jmp 0x1008795
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
je 0x1008704
mov edi, 0x80004005
jmp 0x10087a6
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.0100a870
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 4], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
je 0x10086fa
cmp dword [ebp - 8], edi
jle 0x1008770
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.01008463
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x100873a
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1008795
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.01008199
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.01008535
test eax, eax
jge 0x10087bc
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x10087be
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10092ed
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.0100814a
cmp eax, esi
jne 0x1009365
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100932e
lea eax, [ebp - 0x210]
push eax
call fcn.010092ed
cmp eax, esi
jne 0x1009364
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x100931e
call fcn.010080e5
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.010080e5
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x100a01b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x100a06b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100a056
call esi
mov esi, eax
jmp 0x100a133
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100a133
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100a08c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x100a0b1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100a09f
call esi
jmp 0x100a128
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100a12a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x100a0f0
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0100a870
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + ebx], 0
mov dword [ebp + 8], eax
mov edi, esp
test edi, edi
jne 0x100a0f8
xor eax, eax
jmp 0x100a11c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.0100a870
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.01007d53
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push eax
call fcn.01009c25
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100a62f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10031c0
call fcn.0100a8cc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100a66a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100a66a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100a682
cmp eax, 0x20b
je 0x100a66f
mov dword [ebp - 0x1c], edi
jmp 0x100a696
cmp dword [ecx + 0x84], 0xe
jbe 0x100a66a
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100a690
cmp dword [ecx + 0x74], 0xe
jbe 0x100a66a
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10104c8], 0xffffffff
or dword [0x10104cc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1010468]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1010464]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10104c4], eax
call fcn.010080b5
cmp dword [0x10100c0], edi
jne 0x100a6f3
push fcn.010080b5
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100a8ba
push 0x10012d0
push 0x10012cc
call sub.msvcrt.dll__initterm
mov eax, dword [0x1010460]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x101045c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x10012c8
push 0x10012b8
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x100a759
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x100a813
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x100a7a7
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x100a775
cmp ax, 0x22
jne 0x100a762
cmp word [esi], 0x22
jne 0x100a780
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x100a78e
cmp ax, 0x20
jbe 0x100a77b
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x100a7b4
movzx eax, word [ebp - 0x48]
jmp 0x100a7b7
cmp word [esi], 0x20
jbe 0x100a780
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x100a7a7
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x100a7d8
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100a80d
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100a905
ret
Function at 0x100cd81
Capabilities:
Move file
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
mov esi, ecx
and byte [esi + 0x30], 0
push edi
lea eax, [ebp - 0x10]
lea edi, [esi + 0x34]
push eax
mov dword [edi], 0x10001
call fcn.0100a9d1
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100cde2
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push 0
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], 4
call fcn.0100a9d1
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 8], 0
je 0x100cefa
lea ecx, [ebp - 0xc]
call fcn.0100a92e
lea eax, [esi + 0x18]
push eax
push 0x1005d7c
lea eax, [ebp - 0x20]
push eax
call fcn.0100aab8
push eax
lea ecx, [ebp - 0xc]
call fcn.0100aa23
lea ecx, [ebp - 0x20]
call fcn.0100aa1e
lea ecx, [ebp - 0xc]
call fcn.0100a9d4
test al, al
lea ecx, [ebp - 0xc]
je 0x100cede
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x230]
push eax
call fcn.0100a9d1
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call edi
test eax, eax
je 0x100cedb
cmp eax, 0x104
ja 0x100cedb
lea eax, [esi + 0x24]
push eax
push 0x1005d7c
lea eax, [ebp - 0x20]
push eax
call fcn.0100aab8
push eax
lea ecx, [ebp - 0xc]
call fcn.0100aa23
lea ecx, [ebp - 0x20]
call fcn.0100aa1e
lea ecx, [ebp - 0xc]
call fcn.0100a9d4
test al, al
lea ecx, [ebp - 0xc]
je 0x100cede
push ebx
lea eax, [ebp - 0x43c]
push eax
call fcn.0100a9d1
push eax
call edi
xor edi, edi
cmp eax, edi
je 0x100cedb
cmp eax, 0x104
ja 0x100cedb
push 1
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push edi
push 2
push edi
push 1
push 0x40000000
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100cee7
lea ecx, [ebp - 0xc]
call fcn.0100aa1e
xor al, al
jmp 0x100cf00
cmp eax, edi
je 0x100cef2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.0100aa1e
mov byte [esi + 0x30], 1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100dfd6
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 4], esi
je 0x100e03c
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x100e03c
cmp dword [ebp + 0x10], esi
je 0x100e03c
mov eax, dword [edi]
cmp eax, esi
jne 0x100e034
lea eax, [ebp - 4]
push eax
push 0x100324c
push 1
push esi
push 0x100330c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp ebx, esi
jl 0x100e01d
mov eax, dword [ebp - 4]
mov dword [edi], eax
jmp 0x100e055
push ebx
push 0x1006738
push 2
push 0x10100e0
call fcn.0100cfc0
add esp, 0x10
jmp 0x100e055
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x100e055
push 0x10066e8
push 2
push 0x10100e0
mov ebx, 0x80070057
call fcn.0100cfc0
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x100e08a
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.01006910
cmp dword [ebp + 8], esi
je 0x100e081
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
mov ebx, eax
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x407130
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2e0
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2fc]
push esi
push edi
mov edi, dword [esp + 0x2f4]
mov ebx, ecx
push 0x1008
mov dword [esp + 0x38], ebx
call fcn.004c1c10
mov ecx, dword [esp + 0x300]
mov esi, eax
mov eax, dword [esp + 0x2fc]
add esp, 4
push edi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.0047eb20
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x407187
cmp dword [ebx + 4], 0x50000
jb 0x4071b7
call fcn.0044b030
cmp eax, 0x400
je 0x4071b7
cmp byte [esp + 0x310], 0
jne 0x407202
mov ebx, dword [esp + 0x300]
cmp ebx, 0xffffffff
je 0x4071c7
test ebp, ebp
jne 0x407209
cmp dword [esp + 0x2f8], 2
mov eax, 0x4201
jne 0x4071db
mov eax, 0x4203
push eax
push 0x2b4
lea edx, [esp + 0x40]
push edx
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp ebx, 0xffffffff
jne 0x4071f8
mov ebx, dword [esp + 0x3c]
test ebp, ebp
jne 0x407209
lea ebp, [esp + 0x44]
jmp 0x407209
mov ebx, dword [esp + 0x300]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], 0x37
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x407247
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
push 0
mov dword [esp + 0x34], ecx
mov ecx, dword [eax]
push 0x40b
push ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c0c62
add esp, 0x2e0
ret 0x20