joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d81a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101eb938
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [ebp - 4], 0
cmp dword [ebx], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0
je 0x100d8222
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100d81f9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x100d820d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebx]
mov dword [esi + 8], 0
test ecx, ecx
je 0x100d8230
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
jmp 0x100d8230
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
mov dword [ebx], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [esi + 0x10], eax
test eax, eax
jns 0x100d8260
cmp eax, 0x80010119
jne 0x100d834e
lea eax, [ebp - 0x18]
push eax
push 0x10228290
push 1
push 0
push 0x10228360
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esi + 0x10], eax
test eax, eax
js 0x100d834e
push edi
lea ecx, [ebp - 0x1c]
call fcn.100d7020
mov byte [ebp - 4], 1
mov eax, dword [eax]
test eax, eax
je 0x100d829a
mov edx, dword [eax]
jmp 0x100d829c
xor edx, edx
mov eax, dword [ebp - 0x18]
push ebx
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x1c]
mov dword [esi + 0x10], eax
test edi, edi
je 0x100d830d
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x100d8306
test edi, edi
je 0x100d8306
mov eax, dword [edi]
test eax, eax
je 0x100d82e6
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x100d82fd
push eax
call fcn.101a1ad1
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.101a02f0
add esp, 4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x18], 0
jl 0x100d834e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [esi + 0x10], eax
test eax, eax
jns 0x100d8374
mov eax, dword [ebx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebx], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x100d8356
Function at 0x100db77a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0x111
jne 0x100db7c8
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3f5
jne 0x100db7c8
push 0
mov ecx, dword [ebp - 4]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0x10
mov ecx, dword [ebp - 4]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10038ad0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100dc7e1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.101a01b0
add esp, 0xc
push 0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.100e0573
add esp, 0xc
and dword [ebp - 0x210], 0
push 0
lea eax, [ebp - 0x210]
push eax
push str.AppData
push str.Softwarelightregulate_
push SysReAllocStringLen
call fcn.10020b30
add esp, 0x14
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push str.StartInstall_szAppDir_s_reg_exist_bExist_d
push 0
push str.InstallPageDoing.cpp
call fcn.10036720
add esp, 0x14
cmp dword [ebp - 0x210], 0
jne 0x100dc8a2
push 1
lea eax, [ebp - 0x20c]
push eax
push 0
push str.AppData
push str.Softwarelightregulate_
push SysReAllocStringLen
call fcn.10020f00
add esp, 0x18
push str.StartInstall
push 0
push str.InstallPageDoing.cpp
call fcn.10036720
add esp, 0xc
push 0
push 1
push 0x408
push dword [0x10276338]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [0x10276338]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push str.ck_W
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x8c]
call fcn.10038fe0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x8c]
call fcn.10039320
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret
Function at 0x100de0d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100de0fe
xor eax, eax
jmp 0x100de190
lea eax, [ebp - 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x100de120
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100de190
mov dword [ebp - 0x14], 1
push 0xc
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp + eax - 0x10], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp + eax - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x100de14a
mov dword [ebp - 0x1c], 2
jmp 0x100de151
mov dword [ebp - 0x1c], 4
push 0xc
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + eax - 8], ecx
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100de184
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100de190
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret
Function at 0x100de512
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x10276338], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1027641c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10276420], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10276424], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.101a01b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.100de3d6
lea eax, [ebp - 0x210]
push eax
call fcn.101a012b
pop ecx
mov dword [0x1027633c], eax
lea eax, [ebp - 0x210]
push eax
call fcn.100de3d6
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.100031d0
lea eax, [ebp - 0x210]
push eax
call fcn.100de3d6
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x10276368
call fcn.100032d0
lea eax, [ebp - 0x210]
push eax
call fcn.100de3d6
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x10276380
call fcn.100032d0
mov ecx, 0x10276368
call fcn.10003390
push eax
lea ecx, [ebp - 0x228]
call fcn.10003390
push eax
push str.CreateInstallWnd_operation___s_g_strSrcPath_s
push 0
push str.InstallUI.cpp
call fcn.10036720
add esp, 0x14
push 0
push dword [0x10276338]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x80
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [0x10276338]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push str.Install
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de65c
mov dword [section..data], 1
jmp 0x100de72e
push str.UnInstall
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de67c
and dword [section..data], 0
jmp 0x100de72e
push str.InstallExist
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de6a9
mov dword [section..data], 1
mov dword [0x1027632c], 1
jmp 0x100de72e
push str.UnInstallExist
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de6d0
and dword [section..data], 0
mov dword [0x1027632c], 1
jmp 0x100de72e
push str.HasHighVersionExist
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de6f0
mov dword [0x10276330], 1
jmp 0x100de72e
push str.MustRebootToContinueInstall
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de710
mov dword [0x10276334], 1
jmp 0x100de72e
push str.reboot
lea ecx, [ebp - 0x228]
call fcn.1001f760
test eax, eax
jne 0x100de72e
mov dword [0x10276344], 1
call fcn.100e21d0
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x22c]
call dword [eax + 4]
lea ecx, [ebp - 0x228]
call fcn.100032a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret

Function at 0x100df511
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x10276338], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1027641c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10276420], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10276424], eax
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x100dfba7
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1027641c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10276420], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10276424], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.101a01b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.100de3d6
push 1
call fcn.100de0d0
pop ecx
lea eax, [ebp - 0x210]
push eax
push str.KillRunningProcess_:_s
push 0
push str.InstallUI.cpp
call fcn.10036720
add esp, 0x10
and dword [ebp - 0x43c], 0
push 0x228
push 0
lea eax, [ebp - 0x438]
push eax
call fcn.101a01b0
add esp, 0xc
mov dword [ebp - 0x43c], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffff
jne 0x100dfc64
jmp 0x100dfd1d
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x440]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x100dfc7f
jmp 0x100dfd1d
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100dfcef
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x434]
je 0x100dfcef
push dword [ebp - 0x434]
push str.get_a_process_:_d
push 0
push str.InstallUI.cpp
call fcn.10036720
add esp, 0x10
push dword [ebp - 0x434]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x444], eax
push 0
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x440]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100dfc7f
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.100de0d0
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret
Function at 0x100e0014
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [0x10276338], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1027641c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10276420], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10276424], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.Softwarelightregulate_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100e00bd
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.RebootTag
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.MustReboot
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x100e0499
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
movsd xmm0, qword [0x1023a4a0]
movsd qword [ebp - 0x2c], xmm0
push 0
push 0x101ff358
mov ecx, dword [ebp + 0xc]
call fcn.1001b6b0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x100e0519
push 0
push 0x101ff35c
mov ecx, dword [ebp + 0xc]
call fcn.1001b6b0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x100e0519
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
dec eax
push eax
mov eax, dword [ebp - 0x20]
inc eax
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10007c70
lea ecx, [ebp - 0x1c]
call fcn.10003390
push eax
call fcn.101a1be7
pop ecx
fstp qword [ebp - 0x2c]
lea ecx, [ebp - 0x1c]
call fcn.100032a0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003390
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x100e0562
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.101a1f8e
movsd xmm1, qword [ebp - 0x2c]
mulsd xmm1, qword [0x101ff408]
mulsd xmm1, qword [0x101ff408]
comisd xmm1, xmm0
jbe 0x100e0562
xor eax, eax
jmp 0x100e0565
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret
Function at 0x100e0975
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ec10f
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x238], 0
lea ecx, [ebp - 0x230]
call fcn.100031b0
and dword [ebp - 4], 0
call fcn.100e0bbc
test eax, eax
je 0x100e0a2b
push str.SHGetKnownFolderPath
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x100e0a2b
and dword [ebp - 0x234], 0
lea eax, [ebp - 0x234]
push eax
push 0
push 0x8000
push 0x1020ec5c
call dword [ebp - 0x23c]
cmp dword [ebp - 0x234], 0
je 0x100e0a2b
push dword [ebp - 0x234]
lea ecx, [ebp - 0x230]
call fcn.100032d0
push dword [ebp - 0x234]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x230]
call fcn.100033b0
movzx eax, al
test eax, eax
je 0x100e0a9e
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.101a01b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x100e0a8c
push 0x104
lea eax, [ebp - 0x218]
push eax
push str._APPDATA_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.100032d0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003230
mov eax, dword [ebp - 0x238]
or eax, 1
mov dword [ebp - 0x238], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.100032a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret

Function at 0x100e0bbc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x102680a8], 0xffffffff
jne 0x100e0c35
push 0x114
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.101a01b0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jb 0x100e0c23
cmp dword [ebp - 0x114], 6
jb 0x100e0c23
mov dword [ebp - 0x120], 1
jmp 0x100e0c2a
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [0x102680a8], eax
cmp dword [0x102680a8], 1
jne 0x100e0c47
mov byte [ebp - 0x119], 1
jmp 0x100e0c4e
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret
Function at 0x100e1f72
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x100e1fb6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100e1fab
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 4]
mov dword [ebp - 0x10], eax
jmp 0x100e1faf
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
and dword [eax + 4], 0
call fcn.10045ec0
mov ecx, eax
call fcn.10046000
push 0
call fcn.101a261a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100e5752
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0x111
jne 0x100e581c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7f2
je 0x100e57c2
cmp dword [ebp - 8], 0x7f5
je 0x100e57a2
cmp dword [ebp - 8], 0x7f6
je 0x100e57b2
cmp dword [ebp - 8], 0x7f7
je 0x100e580e
jmp 0x100e581c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d0]
call fcn.100e584a
jmp 0x100e581c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d0]
call fcn.100e5833
jmp 0x100e581c
push str.its_going_to_restart_pc
push 0
push str.MessageBoxDlg.cpp
call fcn.10036720
add esp, 0xc
push str.SeShutdownPrivilege
push 1
mov ecx, dword [ebp - 4]
call fcn.100e5861
push 0x10
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push str.SeShutdownPrivilege
push 0
mov ecx, dword [ebp - 4]
call fcn.100e5861
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d0]
call fcn.100e584a
jmp 0x100e581c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d0]
call fcn.100e5833
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100430b0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100e8651
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10038b60
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x98]
jne 0x100e867b
mov ecx, dword [ebp - 4]
call fcn.100e8902
jmp 0x100e86f6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x9c]
jne 0x100e86ad
mov ecx, dword [ebp - 4]
call fcn.100e86fc
test eax, eax
jne 0x100e86ab
push 0xc8
mov ecx, dword [ebp - 4]
call fcn.10038b30
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x9c], eax
jmp 0x100e86f6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xa0]
jne 0x100e86f6
push 0
push 1
push 0x408
push dword [0x10276338]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [0x10276338]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x7fa
mov ecx, dword [ebp - 4]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esp, ebp
pop ebp
ret 8
Function at 0x100e8902
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jbe 0x100e8930
mov eax, dword [ebp - 4]
push dword [eax + 0x9c]
mov ecx, dword [ebp - 4]
call fcn.10038b60
mov eax, dword [ebp - 4]
and dword [eax + 0x9c], 0
push 0xc8
mov ecx, dword [ebp - 4]
call fcn.10038b30
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x9c], eax
push str.StartUninstall
push 0
push str.UninstallPageDoing.cpp
call fcn.10036720
add esp, 0xc
push 0
push 1
push 0x408
push dword [0x10276338]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [0x10276338]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x100e9492
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x111
jne 0x100e953c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x134
jne 0x100e9515
push str.its_going_to_restart_pc
push 0
push str.UninstallPageFinish.cpp
call fcn.10036720
add esp, 0xc
push 1
push str.SeShutdownPrivilege
push 0
call fcn.10085210
add esp, 0xc
push 0x10
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
push 0
call fcn.10085210
add esp, 0xc
push 1
push 0
push 0x10
mov ecx, dword [ebp - 8]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100e953c
cmp dword [ebp - 4], 0x135
je 0x100e9527
cmp dword [ebp - 4], 0x136
jne 0x100e953c
push 1
push 0
push 0x10
mov ecx, dword [ebp - 8]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10104c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test bl, 3
mov ecx, 0
sete cl
test ecx, ecx
jne 0x10104c7a
test esi, esi
je 0x10104c7a
movzx ecx, byte [ebx]
inc ebx
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10203f40]
dec esi
jmp 0x10104c51
cmp esi, 4
jb 0x10104cc3
mov edx, esi
shr edx, 2
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x10203f40]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10203f40]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10203f40]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10203f40]
dec edx
jne 0x10104c84
test esi, esi
je 0x10104cdf
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10203f40]
dec esi
jne 0x10104cc7
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10104cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x102775da], 0
push edi
mov edi, ecx
jne 0x10104d04
call fcn.10129c10
cmp byte [0x102775de], 0
je 0x10104d24
lea eax, [edi + 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1012a0d0
add esp, 0xc
pop edi
pop ebp
ret 8
mov eax, dword [edi + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
nop
test bl, 3
mov ecx, 0
sete cl
test ecx, ecx
jne 0x10104d59
test esi, esi
je 0x10104d59
movzx ecx, byte [ebx]
inc ebx
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10204340]
dec esi
jmp 0x10104d30
cmp esi, 4
jb 0x10104da2
mov edx, esi
shr edx, 2
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x10204340]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10204340]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10204340]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10204340]
dec edx
jne 0x10104d63
test esi, esi
je 0x10104dbe
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10204340]
dec esi
jne 0x10104da6
pop esi
pop ebx
mov dword [edi + 4], eax
pop edi
pop ebp
ret 8