joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a3759
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc0c9
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001713
mov byte [ebp - 4], 1
mov eax, dword [0x100d50b0]
mov dword [ebp - 0x30], eax
push dword [0x100d50b0]
push 0x5c
lea ecx, [ebp - 0x2c]
call fcn.1003772b
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [0x100d50b0]
je 0x100a3809
push dword [ebp - 0x30]
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100018f6
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.10001760
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.1000174b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
lea eax, [ebp - 0x2c]
push eax
call fcn.10001713
call fcn.100a3759
add esp, 0x1c
push 0
lea ecx, [ebp + 8]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100a382b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100a3845
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000174b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000174b
jmp 0x100a385d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000174b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000174b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100a390e
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc119
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x100a3943
xor eax, eax
jmp 0x100a3a99
call fcn.100202bf
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100a395d
and dword [ebp - 0x44], 0
jmp 0x100a39a3
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x100a3979
and dword [ebp - 0x48], 0
jmp 0x100a399d
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.10082f90
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
shl eax, 1
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x4c]
call fcn.10022f85
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.10070d30
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.10036e77
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call fcn.100b474a
pop ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
push str.TxdlService.dat
push dword [ebp - 0x54]
lea eax, [ebp - 0x28]
push eax
call fcn.100105fa
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100103c0
lea ecx, [ebp - 0x28]
call fcn.1002ffe8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a3a1e
lea ecx, [ebp - 0x28]
call fcn.1002ffe8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x24], 0
push 0x100cf9a4
lea ecx, [ebp - 0x28]
call fcn.1002ffe8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10076131
add esp, 0xc
cmp dword [ebp - 0x24], 0
je 0x100a3a87
push dword [ebp - 0x24]
push 1
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.10076321
add esp, 0x10
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 1
push dword [ebp - 0x10]
call fcn.10076321
add esp, 0x10
push dword [ebp - 0x24]
call fcn.100766da
pop ecx
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x28]
call fcn.100103c0
mov eax, dword [ebp - 0x3c]
jmp 0x100a3a99
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x28]
call fcn.100103c0
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100a3d46
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc181
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
call fcn.100b4878
pop ecx
and dword [ebp - 4], 0
push 0x100cf868
lea ecx, [ebp - 0x10]
call fcn.10009d23
lea ecx, [ebp - 0x10]
call fcn.1002ffe8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.1002ffe8
test eax, eax
je 0x100a3e1f
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.1002ffe8
mov dword [ebp - 0x3c], eax
push 0
push 0x100cf89c
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
push 0xa
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call fcn.1007549a
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1002ffe8
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100cf8a4
push 0x100cf8b0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x16
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.10073a50
add esp, 0xc
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100103c0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100a4656
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bca40
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d0], ecx
and dword [ebp - 0x2bc], 0
and word [ebp - 0x22c], 0
push 0x208
push 0
lea eax, [ebp - 0x22a]
push eax
call fcn.10073a50
add esp, 0xc
push 0x100d10c4
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x2b8], 0x100d1120
and word [ebp - 0x2b4], 0
push 0x7e
push 0
lea eax, [ebp - 0x2b2]
push eax
call fcn.10073a50
add esp, 0xc
push 0xa
push 0x40
lea eax, [ebp - 0x2b4]
push eax
push 0
call fcn.1007601f
pop ecx
push eax
call fcn.10075ff5
add esp, 0x10
lea ecx, [ebp - 0x2c0]
call fcn.10010322
and dword [ebp - 4], 0
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x2d0]
push dword [eax + 0x74]
mov ecx, dword [ebp - 0x2d0]
add ecx, 4
call fcn.10004cd2
push eax
lea eax, [ebp - 0x2b4]
push eax
push str._default__r_ntime_s_r_nPath_s_r_npara_s_r_nsrcName_s_r_n
lea eax, [ebp - 0x2c0]
push eax
call fcn.10015b98
add esp, 0x18
lea ecx, [ebp - 0x2c0]
call fcn.1002ffe8
push eax
lea ecx, [ebp - 0x234]
call fcn.1002f5c2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.1001042d
inc eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call fcn.10070158
pop ecx
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x234]
call fcn.1002ffe8
push eax
push dword [ebp - 0x10]
call fcn.10073ad0
add esp, 0xc
push 0x55
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.100a0619
add esp, 0xc
push 0x100d1198
lea eax, [ebp - 0x22c]
push eax
call fcn.1007611e
pop ecx
pop ecx
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x100a4801
push dword [ebp - 0x230]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x10]
call fcn.10076321
add esp, 0x10
push dword [ebp - 0x230]
call fcn.100766da
pop ecx
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c8], eax
push dword [ebp - 0x2c8]
call fcn.10072d0d
pop ecx
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2cc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.100103c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c0]
call fcn.100103c0
mov eax, dword [ebp - 0x2cc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10070dd1
leave
ret 8
Function at 0x100a5839
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push dword [ebp + 8]
call fcn.100016dd
call fcn.100a3759
add esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a5869
xor eax, eax
inc eax
jmp 0x100a586b
xor eax, eax
leave
ret
Function at 0x100a5f70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CServiceLauncher.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0
je 0x100a5fd4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x100a5fbf
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.1000189b
movzx eax, al
test eax, eax
jne 0x100a5fbf
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10004cd2
push eax
call fcn.100b395f
pop ecx
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0xcc
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.1000174b
mov ecx, dword [ebp - 4]
call fcn.1003656d
leave
ret

Function at 0x100a60f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CQQExternalShellLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.1000189b
movzx eax, al
test eax, eax
jne 0x100a6145
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100a6145
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.1000189b
movzx eax, al
test eax, eax
jne 0x100a616f
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.1000174b
mov ecx, dword [ebp - 4]
call fcn.1003635f
leave
ret
Function at 0x100a6e2d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd2a7
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
push 0x100cff28
lea ecx, [ebp - 0x440]
call fcn.100016dd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x448]
add eax, 4
push eax
lea ecx, [ebp - 0x440]
call fcn.10001776
push 0x100cff2c
lea ecx, [ebp - 0x440]
call fcn.10004c4b
push 0x100cff30
lea ecx, [ebp - 0x440]
call fcn.10004c4b
push dword [ebp + 8]
lea ecx, [ebp - 0x440]
call fcn.10004c4b
lea ecx, [ebp - 0x440]
call fcn.10004cd2
push eax
push 0x208
push section.DLLShare
call fcn.10074ec3
add esp, 0xc
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.10073a50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [0x1010722c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x100cff34
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.10075997
add esp, 0xc
and word [ebp - 0x424], 0
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.10073a50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.100b0fd5
add esp, 0x14
mov dword [ebp - 0x444], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.1000174b
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret 4
Function at 0x100a7a3a
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd405
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0x100cfcdc
lea ecx, [ebp - 0x48]
call fcn.100016dd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.10001776
push 0x100cfce0
lea ecx, [ebp - 0x48]
call fcn.10004c4b
push 0x100cfce4
lea ecx, [ebp - 0x48]
call fcn.10004c4b
push dword [ebp + 8]
lea ecx, [ebp - 0x48]
call fcn.10004c4b
lea ecx, [ebp - 0x48]
call fcn.10004cd2
push eax
call fcn.100a390e
pop ecx
test eax, eax
jne 0x100a7ad5
and dword [ebp - 0x4c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000174b
mov eax, dword [ebp - 0x4c]
jmp 0x100a7be3
mov ecx, dword [ebp - 0x5c]
call fcn.100a754a
test eax, eax
jne 0x100a7af9
and dword [ebp - 0x50], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000174b
mov eax, dword [ebp - 0x50]
jmp 0x100a7be3
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004cd2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a7b27
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100cfce8
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004cd2
push eax
push 0x277f
push dword [0x1010722c]
call fcn.100a4391
add esp, 0x14
test eax, eax
jne 0x100a7b69
and dword [ebp - 0x54], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000174b
mov eax, dword [ebp - 0x54]
jmp 0x100a7be3
push 0x100cfcfc
mov eax, dword [ebp - 0x5c]
add eax, 0xcc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000a694
add esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0x100cfd0c
lea ecx, [ebp - 0x2c]
call fcn.10004cd2
push eax
push 0x451
push dword [0x1010722c]
call fcn.100a4391
add esp, 0x14
mov ecx, dword [ebp - 0x5c]
add ecx, 0x94
call fcn.10004cd2
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.100a3ab3
mov dword [ebp - 0x58], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000174b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000174b
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret 4
Function at 0x100a7bfc
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd44b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x228]
call fcn.1001b790
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1001b790
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10010322
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x100a7c9e
push 0x100cfaa0
lea ecx, [ebp - 0x228]
call fcn.100128ce
push eax
push dword [0x10103140]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
push 0x100cfac8
lea ecx, [ebp - 0x230]
call fcn.100128ce
push eax
push dword [0x1010313c]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
lea ecx, [ebp - 0x228]
call fcn.1002ffe8
push eax
lea ecx, [ebp - 0x22c]
call fcn.10003b3f
push 0x100cfad8
lea ecx, [ebp - 0x22c]
call fcn.10009d23
lea ecx, [ebp - 0x230]
call fcn.1002ffe8
push eax
lea ecx, [ebp - 0x22c]
call fcn.10009d23
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10073a50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.1002ffe8
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x20a
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10073a50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x22c]
call fcn.1002ffe8
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x100cfadc
lea eax, [ebp - 0x224]
push eax
push 0x277e
push dword [0x1010722c]
call fcn.100a4391
add esp, 0x14
lea eax, [ebp - 0x224]
push eax
call fcn.10037d0c
mov ecx, eax
call fcn.100371ea
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.100103c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1000a70e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000a70e
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100a7de5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd47b
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x40]
call fcn.1003753d
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.10009d66
and dword [ebp - 0x20], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0x44
call fcn.1002ffe8
mov dword [ebp - 0x54], eax
push 0
push str.EnableExePackUac
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
je 0x100a7eeb
push 0
push 0
lea eax, [ebp - 0x40]
push eax
push 0x100a2b66
push 0
push 0
call fcn.1007466a
add esp, 0x18
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x100a7ee2
push 0x64
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x100a7eac
jmp 0x100a7ed9
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x3c], 1
jne 0x100a7ed4
cmp dword [0x10107224], 0
jne 0x100a7ed4
mov ecx, dword [ebp - 0x50]
call fcn.100a0ea9
test eax, eax
je 0x100a7ed4
mov dword [0x10107224], 1
xor eax, eax
inc eax
jne 0x100a7e94
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10037551
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret 4
Function at 0x100ab230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0x78
call fcn.10009d66
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.1002ffe8
test eax, eax
je 0x100ab2a7
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.1002ffe8
mov dword [ebp - 0x18], eax
push 0
push 0x100cfc60
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call dword [eax + 0x18]
cmp eax, 0x64
jne 0x100ab2a7
mov eax, dword [0x10110014]
dec eax
mov dword [0x10110014], eax
cmp dword [0x10110014], 0xffffffff
jne 0x100ab2a7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10110018], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.1002ffe8
test eax, eax
je 0x100ab2e4
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.1002ffe8
mov dword [ebp - 0x1c], eax
push 0
push 0x100cfc6c
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100ab2e4
call fcn.10036f8f
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.1002ffe8
mov dword [ebp - 0x20], eax
push 0
push str.EnableLsp
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call dword [eax + 0x20]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc], esp
push 0x100cfc84
call fcn.10001427
push 0
push 0x3e8
push 0
push 0x25
mov ecx, 0x10107310
call fcn.100b1eeb
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp - 0x14]
push 0x100ab046
push 0
push 0
call fcn.1007466a
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
call fcn.100106a8
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
add ecx, 0x74
call fcn.10035fd2
lea ecx, [ebp - 0x10]
call fcn.100206ad
mov ecx, dword [ebp - 0x14]
add ecx, 0x74
call fcn.1002ffe8
test eax, eax
je 0x100ab39c
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x94
call fcn.1002ffe8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x98]
jmp 0x100ab39e
xor eax, eax
leave
ret 4
Function at 0x100ab630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, 0x10107310
call fcn.100b1397
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x6c], eax
mov ecx, dword [ebp - 0x14]
call fcn.100a3e4d
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], eax
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x100ab672
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0x4c
call fcn.10009d66
push dword [ebp - 0x14]
call fcn.10011734
mov ecx, eax
call fcn.100a6192
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x40], 0
jbe 0x100ab6b0
push 0
push 0
push dword [ebp - 0x14]
push 0x100ab60f
push 0
push 0
call fcn.1007466a
add esp, 0x18
mov dword [ebp - 8], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100ab6eb
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x6c], 0
je 0x100ab6c3
mov ecx, 0x10107310
call fcn.100b12b2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100ab6e7
push 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x100ab6eb
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x100ab6f2
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0xc], eax
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ab7c0
and dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.10073a50
add esp, 0xc
mov dword [ebp - 0x118], 0x100
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.KAVINSTALLNEEDREBOOT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100ab7b0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.KAV7NEEDREBOOT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ab7b7
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10070dd1
leave
ret