joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a75db
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
mov ecx, 0x4e8580
call fcn.00404654
mov byte [0x4e8598], 0
mov ecx, 0x4e859c
call fcn.004125f1
mov byte [ebp - 2], 0
mov byte [ebp - 1], 1
push 0
push 0
push 0
push 0x4a725a
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a7661
push 0xbb8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a7658
mov al, byte [0x4e8598]
mov byte [ebp - 1], al
push 0x4e859c
mov ecx, dword [ebp + 0xc]
call fcn.00404654
mov byte [ebp - 2], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a7675
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 0xc]
call fcn.004125f1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4a7810
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4df06c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x4e8d28]
test eax, eax
jne 0x4a7936
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x40
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4c3674
lea ecx, [ebp - 0x2c]
call fcn.00417443
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
push eax
push 0x4e8d28
lea eax, [ebp - 0x54]
push eax
push 0x4c3670
mov ecx, dword [ebp - 0x58]
call fcn.0040a237
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4a788d
mov dword [ebp - 0x4c], 1
jmp 0x4a7891
and dword [ebp - 0x4c], 0
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x2c]
call fcn.00409fcb
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x4a7936
and dword [ebp - 0x14], 0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
xor edx, edx
lea ecx, [ebp - 0x14]
call fcn.0042144a
pop ecx
movzx eax, al
test eax, eax
je 0x4a78e9
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4c36a4
push 0x4e8d28
call fcn.00413c60
add esp, 0x18
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4c36bc
lea ecx, [ebp - 0x44]
call fcn.00417443
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
push 0x4e8d28
call fcn.00464470
pop ecx
push eax
push 0x4e8d28
push 1
push 0x4c36b8
mov ecx, dword [ebp - 0x5c]
call fcn.0040a237
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x44]
call fcn.00409fcb
mov eax, 0x4e8d28
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e3e7
mov esp, ebp
pop ebp
ret
Function at 0x4a828c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4df06c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
push 2
pop ecx
call fcn.0044c610
cmp dword [ebp - 0x20], 6
jl 0x4a830e
push 5
push str._dump
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
push dword [ecx + eax]
call fcn.0046729d
add esp, 0xc
test eax, eax
jne 0x4a830e
push str.SE_Install
lea ecx, [ebp - 0x1c]
call fcn.004097aa
push dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call fcn.0044ca3b
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040a301
xor eax, eax
jmp 0x4a832e
call fcn.0044cc05
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
call fcn.004a3beb
add esp, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e3e7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001777
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100017c8
cmp dword [ebp + 0x10], 1
je 0x100017b1
cmp dword [ebp + 0x10], 2
jne 0x100017bf
test edi, edi
mov eax, dword [ebp - 4]
je 0x100017c4
cmp byte [eax + edi - 1], 0
je 0x100017c4
push 0xd
pop eax
jmp 0x100017c8
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x10002500
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1001ae61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
mov eax, dword [0x100215e0]
push esi
mov dword [esp + 0x120], eax
mov eax, dword [0x10034220]
push edi
mov ecx, 0x10034220
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push 0x10027250
lea ecx, [esp + 0x14]
push str.SOFTWAREClassesCLSID_sInprocServer32
xor esi, esi
push ecx
mov dword [esp + 0x13c], esi
call fcn.10001ad4
add esp, 0xc
mov edi, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 0x20019
push esi
push edi
push 0x80000002
mov byte [esp + 0x144], 1
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x100025e8
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], 0x104
call fcn.10008d70
mov esi, eax
add esp, 8
test esi, esi
je 0x10002617
test ebp, ebp
je 0x100025bc
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x134], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100025e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
jmp 0x100026ff
lea eax, [edi - 0x10]
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000260d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 0x3f8
jmp 0x10002700
mov eax, dword [0x10034220]
mov ecx, 0x10034220
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x10027468
push 0x10027358
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push str._s_s_s
push edx
mov byte [esp + 0x148], 2
call fcn.10001ad4
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
or edx, 0xffffffff
test eax, eax
lea eax, [esi - 0x10]
mov byte [esp + 0x134], 1
lea ecx, [eax + 0xc]
jne 0x100026bc
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002685
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebp, ebp
je 0x10002690
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x134], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100026b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 2
jmp 0x100026ff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100026cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebp, ebp
je 0x100026d8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x134], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100026fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x128]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x120]
pop esi
call fcn.1000e24e
add esp, 0x12c
ret
Function at 0x10002750
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100027b8
mov edx, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100027b8
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x100027cb
cmp eax, 2
mov eax, 0xd
jne 0x100027cd
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x100027e0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push CreateFileA
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002830
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
inc eax
push eax
mov eax, dword [esp + 8]
push ecx
push 2
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x10002840
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100215e0]
push ebx
push esi
mov dword [esp + 0x110], eax
push 0x104
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [esp + 0x118]
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.1000f1ca
test eax, eax
push str.Toolbar_Uninstaller
push esi
setne bl
call fcn.1000f1ca
test eax, eax
push 0x1001c3fc
push esi
setne byte [esp + 0x23]
call fcn.1000f1ca
add esp, 0x18
test eax, eax
setne al
pop esi
test bl, bl
pop ebx
je 0x100028ca
mov cl, byte [esp + 3]
test cl, cl
je 0x100028ca
test al, al
je 0x100028ca
mov eax, 1
mov ecx, dword [esp + 0x108]
call fcn.1000e24e
add esp, 0x10c
ret
mov ecx, dword [esp + 0x108]
xor eax, eax
call fcn.1000e24e
add esp, 0x10c
ret
Function at 0x10002970
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x1001ae86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
mov eax, dword [0x100215e0]
push ebx
xor ebx, ebx
mov dword [esp + 0x320], eax
mov dword [esp + 4], ebx
mov dword [esp + 0x32c], ebx
mov dword [esp + 8], ebx
cmp byte [0x10027a20], bl
mov byte [esp + 0x32c], 1
jne 0x100029c0
xor eax, eax
jmp 0x10002b24
push esi
push edi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edx, dword [esp + 0x33c]
lea eax, [esp + 0x1c]
mov ecx, eax
xor esi, esi
mov edi, 0x104
sub edx, ecx
nop
mov cl, byte [edx + eax]
cmp cl, bl
je 0x100029ef
mov byte [eax], cl
inc eax
dec edi
jne 0x100029e0
jmp 0x100029f3
cmp edi, ebx
jne 0x100029f9
dec eax
mov esi, 0x8007007a
or edi, 0xffffffff
cmp esi, ebx
mov byte [eax], bl
jl 0x10002ac6
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.10009fd2
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x1001c364
push 7
push ebx
push 0x1001ee04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x10002ac6
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x1001c374
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x10002ac6
push 0x104
lea eax, [esp + 0x124]
push eax
push edi
push 0x10027a20
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 2
lea edx, [esp + 0x124]
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x10002ac6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov esi, eax
cmp esi, ebx
jl 0x10002ac6
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x10002ac6
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
push ebx
push eax
call dword [ecx + 0x18]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, ebx
mov eax, dword [esp + 0x10]
mov byte [esp + 0x334], bl
jge 0x10002b01
cmp eax, ebx
je 0x10002ae5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
cmp eax, ebx
mov dword [esp + 0x334], edi
je 0x10002afa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x1f
jmp 0x10002b22
cmp eax, ebx
je 0x10002b0b
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
cmp eax, ebx
mov dword [esp + 0x334], edi
je 0x10002b20
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x324]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x320]
pop ebx
call fcn.1000e24e
add esp, 0x32c
ret
Function at 0x10002f50
Capabilities:
Get installed programs

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001aed0
push eax
mov al, byte [0x10027e28]
mov dword fs:[0], esp
sub esp, 8
push ebp
or ebp, 0xffffffff
test al, al
push esi
jne 0x10003055
mov al, byte [0x10028030]
test al, al
je 0x1000310f
mov eax, dword [0x10034220]
mov ecx, 0x10034220
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 8]
push ecx
push 0x10028030
mov dword [esp + 0x20], 0
call fcn.10002d20
mov esi, eax
add esp, 8
test esi, esi
je 0x10002ff0
mov eax, dword [esp + 8]
or ebp, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x18], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x10002fdd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [str.HostUninstallKey]
mov ecx, dword [0x10033758]
push edi
mov edi, dword [esp + 0xc]
push edi
push eax
call fcn.10007a80
call fcn.10004e30
mov eax, 0x10027e28
mov edx, edi
mov esi, 0x200
sub edx, eax
lea ebx, [ebx]
mov cl, byte [edx + eax]
test cl, cl
je 0x1000302f
mov byte [eax], cl
inc eax
dec esi
jne 0x10003020
jmp 0x10003033
test esi, esi
jne 0x10003034
dec eax
mov byte [eax], 0
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
jg 0x10003055
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [0x10034220]
mov ecx, 0x10034220
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionUninstall]
push 0x10027e28
push ecx
lea edx, [esp + 0x10]
push str._s_s
push edx
mov dword [esp + 0x28], 1
call fcn.10001ad4
mov esi, dword [esp + 0x18]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100030f4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100030c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x100030e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea eax, [esi - 0x10]
mov dword [esp + 0x18], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x1000310f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
pop esi
mov eax, 0x490
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10003790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100037a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x100037bd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x100037de
cmp esi, eax
jae 0x100037b7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100037d0
cmp esi, eax
jae 0x100037b7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10005210
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000523c
pop esi
mov eax, 0x3ee
pop ebx
pop ecx
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10005254
mov ebx, 0x3ee
jmp 0x1000527f
lea ecx, [edi + 1]
push ecx
call fcn.1000f970
mov edx, dword [esp + 0x18]
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000527f
mov ebx, 0x1e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov eax, ebx
jne 0x10005292
mov edx, dword [esp + 0x18]
mov dword [edx], edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10005b20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1001b056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
mov eax, dword [0x100215e0]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x144], eax
xor ebx, ebx
lea eax, [esi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], bl
call fcn.10005550
mov edx, dword [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x158], ebx
call dword [edx + 8]
mov esi, eax
cmp esi, ebx
jne 0x10005c79
mov edx, dword [str.0ACFE224713A92B4]
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x24]
inc ebp
mov ecx, eax
push edi
mov dword [esp + 0x14], ebp
mov esi, 0x20
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x10005bb4
mov byte [eax], cl
inc eax
dec esi
jne 0x10005ba5
jmp 0x10005bb8
cmp esi, ebx
jne 0x10005bb9
dec eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4c]
mov byte [eax], 0
call fcn.1000ca40
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x160], 1
call fcn.1000c830
mov edx, dword [esp + 0x160]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edx
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005c1c
mov esi, 0x3ee
jmp 0x10005c59
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x28]
push eax
push 4
push 0x100213cc
push esi
call ebx
test eax, eax
je 0x10005c46
push 0
lea ecx, [esp + 0x28]
push ecx
push edi
push ebp
push esi
call ebx
test eax, eax
jne 0x10005c4e
mov dword [esp + 0x18], 0x1d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push edx
call fcn.1000ef2d
add esp, 4
lea ecx, [esp + 0x48]
mov byte [esp + 0x158], 0
call fcn.1000a820
pop edi
pop ebp
mov al, byte [esp + 0x18]
test al, al
je 0x10005c8c
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x148]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x140]
pop ebx
call fcn.1000e24e
add esp, 0x14c
ret 4
Function at 0x10005fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x20]
push edi
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
jne 0x10005f58
and edi, 0x3ff
push edi
mov edi, dword [esp + 0x24]
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
jne 0x10005f58
push 0x409
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
jne 0x10005f58
pop edi
pop esi
pop ebp
mov eax, 0x490
pop ebx
pop ecx
ret 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x10005f74
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x10005f8d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x10005f9a
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
push 1
add esi, 0xfffffffc
push esi
add eax, 4
push eax
call fcn.10005920
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
movzx edx, word [esp + 8]
mov dword [esp + 8], edx
jmp 0x10005ef0
Function at 0x10008c00
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x80
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x10008c20
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10008c33
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10008d70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x20
mov eax, dword [0x100215e0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
jne 0x10008e52
mov ecx, dword [ebx]
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
mov dword [esp + 0x1c], ecx
push str.ProgramFilesDir
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov ebp, esi
call fcn.10001777
cmp eax, 0xea
jne 0x10008df2
lea eax, [esp + 0x14]
push eax
xor ebp, ebp
push ebp
push str.ProgramFilesDir
lea ecx, [esp + 0x24]
call fcn.10001777
test eax, eax
jne 0x10008dfc
test ebp, ebp
jne 0x10008e30
jmp 0x10008e01
cmp eax, 0x7a
jne 0x10008e2c
mov eax, dword [esp + 0x10]
test eax, eax
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
je 0x10008e16
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0x7a
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.1000e24e
add esp, 0x20
ret
test eax, eax
jne 0x10008e52
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10008e3f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.1000e24e
add esp, 0x20
ret
mov ecx, dword [0x1001d240]
mov ebp, dword [ebx]
mov edx, dword [str._PROGRAMFILES_]
mov eax, dword [0x1001d23c]
push ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
mov dx, word [0x1001d244]
mov dword [esp + 0x24], eax
mov al, byte [0x1001d246]
push esi
lea ecx, [esp + 0x24]
push ecx
mov word [esp + 0x34], dx
mov byte [esp + 0x36], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebp
jbe 0x10008ebd
test edi, edi
mov dword [ebx], eax
mov byte [esi], 0
je 0x10008ea7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0x7a
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.1000e24e
add esp, 0x20
ret
test eax, eax
jbe 0x10008edf
test edi, edi
je 0x10008ecc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.1000e24e
add esp, 0x20
ret
test edi, edi
je 0x10008eea
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov eax, 0x490
pop ebx
call fcn.1000e24e
add esp, 0x20
ret