joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x428565
cmp dword [esi + 0x6af90], 3
jb 0x4283c7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x428407
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x428407
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4283ef
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00425ad0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x428407
mov edi, eax
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x4284e4
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.004255a0
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x4284ae
cmp eax, 3
jb 0x4284ae
mov eax, 1
sub edi, eax
lea ecx, [ecx]
add dword [esi + 0x6af84], eax
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub edi, eax
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x428450
add dword [esi + 0x6af84], eax
jmp 0x428507
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
xor edi, edi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
jmp 0x428507
movzx edx, byte [ecx + esi + 0x1af70]
push edx
push 0
push esi
call fcn.004255a0
dec dword [esi + 0x6af90]
add esp, 0xc
inc dword [esi + 0x6af84]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x428543
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x428520
lea ecx, [eax + esi + 0x1af70]
jmp 0x428522
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.004281c0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x428558
push esi
call fcn.00425c30
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x428373
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x428578
lea ecx, [eax + esi + 0x1af70]
jmp 0x42857a
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.004281c0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42a12a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456900]
jne 0x42a134
repz ret
jmp fcn.004309f5

Function at 0x438f7f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004320c2
and dword [ebp - 0x14], 0
cmp dword [0x46a308], 0
mov dword [ebp - 0x18], eax
jne 0x439032
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4390da
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4390da
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46a308], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46a30c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46a310], eax
call edi
push eax
call esi
mov dword [0x46a318], eax
test eax, eax
je 0x439032
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46a314], eax
mov eax, dword [0x46a314]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43908b
cmp dword [0x46a318], ecx
je 0x43908b
push eax
call esi
push dword [0x46a318]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43908b
test ebx, ebx
je 0x43908b
call edi
test eax, eax
je 0x439082
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x439082
test byte [ebp - 8], 1
jne 0x43908b
or dword [ebp + 0x10], 0x200000
jmp 0x4390be
mov eax, dword [0x46a30c]
cmp eax, dword [ebp - 0x18]
je 0x4390be
push eax
call esi
test eax, eax
je 0x4390be
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4390be
mov eax, dword [0x46a310]
cmp eax, dword [ebp - 0x18]
je 0x4390be
push eax
call esi
test eax, eax
je 0x4390be
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46a308]
call esi
test eax, eax
je 0x4390da
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4390dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a12a
leave
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xe86830
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe8683a
pushal
call 0xe86840
pop ebp
sub ebp, 0x10
sub ebp, 0xa86830
jmp 0xe86856
mov eax, 0xa86830
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
dec esp
add byte [eax], al
add byte [ecx + 0x5c3], bh
mov edx, 0x32bf5817
xor byte [eax], dl
inc eax
dec ecx
jne 0xe8686d
jmp 0xe86880
pushfd
ficomp dword [esi + ebx*4 + 0x1717172b]
xchg esi, eax
salc
out dx, eax
pop ss
pop ss
pop ss
adc al, 0xda
scasd eax, dword es:[edi]
sbb al, 0x17
pop ss
pop ss
lodsd eax, dword [esi]
aas
pop ss
pop ss
pop ss
loopne 0xe86891
adc al, 0xdf
pushfd
xchg esi, eax
sbb edx, dword [edi]
pop ss
pop ss
adc al, 0xd2
lcall 0x3313, 0x9eeb3373
inc edi
jg 0xe8685f
add eax, 0x6f7f1735
inc edx
xchg ecx, eax
pop ss
push ss
cmp esi, dword [ebx]
jg 0xe8688a
xchg ecx, eax
push 0x1712ff79
pop ss
pop ss
invalid
Function at 0x1001881
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c1f4]
push ebx
xor ebx, ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
cmp eax, 2
jne 0x10019b0
lea eax, [ebp - 0x10]
push eax
call fcn.010017d1
test eax, eax
jne 0x100199e
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10019b0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1001992
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001992
push esi
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1001991
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x100198a
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100198a
cmp dword [esi], ebx
jbe 0x1001981
lea edi, [esi + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1001976
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x100195d
jmp 0x1001981
xor eax, eax
inc eax
mov dword [0x100c1f4], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x10019ad
cmp dword [ebp - 0x10], ebx
je 0x10019ad
mov dword [0x100c1f4], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01006b07
leave
ret
Function at 0x1001af2
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
jne 0x1001b28
push esi
push 0x10
push esi
push esi
push 0x4f5
push esi
call fcn.010037c2
xor eax, eax
jmp 0x1001b8f
lea eax, [ebp - 0x14]
push eax
push 0x10012e4
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebp - 8], esi
jne 0x1001b74
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001b1e
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001b8c
push esi
push 0x10
push esi
push esi
push 0x4f7
jmp 0x1001b1e
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x1001b97
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [0x100c600], 0
je 0x1001bdc
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001bdc
push 0x100c600
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x1001c23
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1001c9e
push 0x10012f8
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01007480
lea eax, [ebp - 0x108]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x40
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c9e
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01006b07
leave
ret

Function at 0x1001cb3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001cfe
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001cf5
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x1001d0b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d5a
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1001d51
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1001dce
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001dee
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1001df1
and eax, 0x10
pop ebp
ret 4

Function at 0x1001fd4
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [ebp + 8], 2
jne 0x1001fe9
call fcn.01001fa2
cmp eax, 2
jne 0x1002026
test byte [ebp + 8], 4
jne 0x100200b
push 4
push 0x40
push 0
push 0x10012e1
push 0x522
push 0
call fcn.010037c2
cmp eax, 6
jne 0x1002026
cmp word [0x100d0cc], 0
jne 0x1002021
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1002026
call fcn.01001af2
pop ebp
ret 4
Function at 0x100228f
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x100c600], bl
je 0x10023ac
lea eax, [ebp - 0x344]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10023ac
push esi
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x340]
push eax
push ebx
push ebx
mov esi, 0x100c600
push esi
push dword [ebp - 0x344]
mov dword [ebp - 0x348], 0x238
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100239f
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002354
push 0x10012e1
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.01007480
push 0x100d2a4
lea eax, [ebp - 0x108]
push eax
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
lea eax, [ebp - 0x340]
push 0x238
push eax
call fcn.01001f43
add esp, 0x14
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x340]
push eax
push 1
push ebx
push esi
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01006b07
leave
ret
Function at 0x10023be
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002504
cmp byte [edi], 0
je 0x1002504
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01001eb0
push 0x1001328
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01001eea
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp eax, 0xffffffff
je 0x1002503
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push edi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01001eb0
test byte [ebp - 0x248], 0x10
lea eax, [ebp - 0x21c]
je 0x10024a7
push 0x1001324
push eax
call ebx
test eax, eax
je 0x10024d4
push 0x1001320
lea eax, [ebp - 0x21c]
push eax
call ebx
test eax, eax
je 0x10024d4
lea eax, [ebp - 0x21c]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01001eea
push 0x10012e1
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01007480
lea eax, [ebp - 0x108]
push eax
call fcn.010023be
jmp 0x10024d4
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01001eea
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002438
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01006b07
leave
ret 4
Function at 0x1002614
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x110], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov byte [esi], 0
cmp byte [ebx], 0x23
push edi
jne 0x1002752
inc ebx
movsx eax, byte [ebx]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov edi, dword [sym.imp.USER32.dll_CharNextA]
push ebx
mov byte [ebp - 0x109], al
call edi
push eax
call edi
cmp byte [ebp - 0x109], 0x53
mov ebx, eax
je 0x1002752
cmp byte [ebp - 0x109], 0x57
je 0x1002746
push 0x1001330
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x11c], edi
call fcn.01001eb0
push ebx
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01007480
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002765
lea eax, [ebp - 0x11c]
push eax
push esi
lea eax, [ebp - 0x114]
push eax
push 0
push 0x10012e1
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002738
cmp dword [ebp - 0x114], 2
jne 0x1002725
push edi
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1002725
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push esi
call fcn.01001eb0
jmp 0x100272e
cmp dword [ebp - 0x114], 1
jne 0x1002738
mov dword [ebp - 0x110], 1
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100275c
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1002765
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x110], 0
jne 0x100276f
push ebx
push dword [ebp + 0xc]
push esi
call fcn.01007480
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.01006b07
leave
ret 0xc
Function at 0x1002788
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x7c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
jle 0x10028c9
mov dword [ebp - 0xc], ebx
jmp 0x10027b1
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi + 0x80]
add eax, edi
lea esi, [eax + ecx + 0x84]
mov eax, dword [esi + 0x38]
lea eax, [eax + edi + 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01002614
test eax, eax
je 0x10028d0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x10028ad
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10028d0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x10028d0
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10028a2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x1001364
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10028a2
cmp dword [ebp - 0x1c], 0
je 0x10028a2
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0xc]
mov ebx, dword [eax + 8]
lea ecx, [esi + 0x10]
xor edx, edx
push dword [ecx - 0xc]
push dword [ecx - 0x10]
push edi
push ebx
call fcn.01001e82
push dword [ecx]
mov dword [ebp + edx - 0x28], eax
push dword [ecx - 4]
push edi
push ebx
call fcn.01001e82
mov dword [ebp + edx - 0x30], eax
add edx, 4
add ecx, 0x18
cmp edx, 8
jl 0x100285b
cmp dword [ebp - 0x28], 0
jl 0x1002893
cmp dword [ebp - 0x30], 0
jle 0x100289f
cmp dword [ebp - 0x24], 0
jl 0x10028f1
cmp dword [ebp - 0x2c], 0
jg 0x10028f1
mov edi, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10028b6
cmp dword [esi], ebx
jne 0x10028d0
cmp dword [esi + 4], ebx
jne 0x10028d0
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], 0x3c
cmp eax, dword [edi + 0x7c]
jl 0x10027af
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
je 0x10028ea
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
leave
ret 0x10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10028d0