joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c692
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x100c6b0
xor eax, eax
jmp 0x100c81e
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1010f60]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100c6e3
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.0100cb7a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100c7b5
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
jbe 0x100c7ed
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
mov dword [ebp - 8], edi
cmp ecx, dword [ebp + 0x10]
jae 0x100c73e
mov edx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100c72f
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 8]
mov byte [eax], dl
inc eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x400
jl 0x100c712
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100c77e
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp eax, edi
jl 0x100c787
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x100c703
jmp 0x100c789
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x100c819
cmp dword [ebp - 4], edi
je 0x100c7ed
push 5
pop esi
cmp dword [ebp - 4], esi
jne 0x100c7e2
call fcn.01009070
mov dword [eax], 9
call fcn.01009083
mov dword [eax], esi
jmp 0x100c814
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100c7d7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
jmp 0x100c789
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100c789
push dword [ebp - 4]
call fcn.01009096
pop ecx
jmp 0x100c814
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100c802
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x100c802
xor eax, eax
jmp 0x100c81c
call fcn.01009070
mov dword [eax], 0x1c
call fcn.01009083
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x100c81c
sub eax, dword [ebp - 0x14]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x609b78a7
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x128f2117
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10007bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x10007bed
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10007bf1
xor eax, eax
jmp 0x10007c53
mov ecx, dword [ebp + 8]
push ecx
call fcn.10059240
add esp, 4
test eax, eax
jne 0x10007c05
xor eax, eax
jmp 0x10007c53
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10007c38
push str.GetConfigCenterEx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10007c38
call dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x10007c49
mov dword [ebp - 0x10], 1
jmp 0x10007c50
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x10008700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10008724
xor eax, eax
jmp 0x100087a4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000873b
xor eax, eax
jmp 0x100087a4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10008787
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10008787
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000875e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10008793
xor eax, eax
jmp 0x100087a4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x100087a1
xor eax, eax
jmp 0x100087a4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10013070
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009335c
mov eax, dword fs:[0]
push eax
sub esp, 0x504
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x454], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1006c6b0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp - 0x454]
add ecx, 8
call fcn.10005e60
push str.Minidump
mov ecx, dword [ebp - 0x454]
add ecx, 8
call fcn.10010860
mov ecx, dword [ebp - 0x454]
add ecx, 8
call fcn.10006150
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10013235
call fcn.1003eb30
mov dword [ebp - 0x458], eax
push 1
mov eax, dword [ebp - 0x458]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x458]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x460], al
cmp byte [ebp - 0x460], 1
je 0x10013142
jmp 0x1001322e
mov ecx, dword [ebp - 0x454]
add ecx, 8
call fcn.10006150
mov dword [ebp - 0x464], eax
push 0x1009c250
lea ecx, [ebp - 0x450]
call fcn.10004260
mov dword [ebp - 4], 0
push 0x1009c2ac
lea ecx, [ebp - 0x438]
call fcn.10004260
mov byte [ebp - 4], 1
call fcn.1003eb30
mov dword [ebp - 0x45c], eax
push str.___not_exist_
lea ecx, [ebp - 0x464]
push ecx
push str.dmp_file_path:
push 0xba
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x510]
call fcn.10004a60
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
mov dword [ebp - 0x46c], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x46c]
call fcn.10002a60
mov ecx, eax
call fcn.1000c8c0
mov ecx, eax
call fcn.10002a60
push eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x45c]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x510]
call fcn.10005a70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.10005680
xor eax, eax
jmp 0x100132d5
push str.hash.ini
mov eax, dword [ebp - 0x454]
add eax, 8
push eax
lea ecx, [ebp - 0x478]
push ecx
call fcn.10010610
add esp, 0xc
mov dword [ebp - 0x470], eax
mov edx, dword [ebp - 0x470]
mov dword [ebp - 0x474], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [ebp - 0x454]
add ecx, 0x2c
call fcn.1000fef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.100054b0
push 0x208
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.1006c6b0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x454]
add ecx, 0xc
call fcn.10005e60
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x100143e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1001449d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10014413
xor eax, eax
jmp 0x100144cb
push str.HttpInit
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push str.HttpUninit
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push str.zlib_uncompress
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push str.zlib_compress
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push str.zlib_compressBound
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x1001449d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
call ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x100144c1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x100144c1
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x100144c1
mov dword [ebp - 8], 1
jmp 0x100144c8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x10015320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.10006150
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001533e
xor eax, eax
jmp 0x1001535c
mov ecx, dword [ebp + 8]
call fcn.10006150
push eax
call fcn.10059240
add esp, 4
test eax, eax
jne 0x10015357
xor eax, eax
jmp 0x1001535c
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x10015dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10015dc9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10015e0c
mov eax, dword [ebp - 8]
jmp 0x10015e72
cmp dword [ebp - 0xc], 1
je 0x10015e1f
cmp dword [ebp - 0xc], 2
je 0x10015e1f
mov eax, 0xd
jmp 0x10015e72
cmp dword [ebp + 0xc], 0
je 0x10015e66
cmp dword [ebp - 4], 0
je 0x10015e55
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x10015e4c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x10015e53
mov eax, 0xd
jmp 0x10015e72
jmp 0x10015e66
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jne 0x10016947
xor eax, eax
jmp 0x10016974
mov ecx, dword [ebp - 4]
add ecx, 0x80
push ecx
push 0
mov edx, dword [ebp - 4]
sub edx, 4
push edx
push 0x100188d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x7c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001dae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x1001dafd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001db01
xor eax, eax
jmp 0x1001db63
mov ecx, dword [ebp + 8]
push ecx
call fcn.10059240
add esp, 4
test eax, eax
jne 0x1001db15
xor eax, eax
jmp 0x1001db63
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001db48
push str.GetLuaExplain
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001db48
call dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x1001db59
mov dword [ebp - 0x10], 1
jmp 0x1001db60
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x100221c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009494b
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax + 4], 0
jne 0x100221fe
xor eax, eax
jmp 0x100222f5
call fcn.1003eb30
mov dword [ebp - 0x48], eax
push 1
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x54], al
cmp byte [ebp - 0x54], 1
je 0x10022223
jmp 0x100222b7
push 0x1009da80
lea ecx, [ebp - 0x40]
call fcn.10004260
mov dword [ebp - 4], 0
push 0x1009dad0
lea ecx, [ebp - 0x28]
call fcn.10004260
mov byte [ebp - 4], 1
call fcn.1003eb30
mov dword [ebp - 0x4c], eax
push str.HotFix_Thread_Start
push 0x53
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xf4]
call fcn.10004a60
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5c]
call fcn.10002a60
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf4]
call fcn.10005a70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005680
mov ecx, dword [ebp - 0x44]
add ecx, 0x10
push ecx
push 0
mov edx, dword [ebp - 0x44]
push edx
push 0x100225f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x44]
cmp dword [edx + 0xc], 0
je 0x100222eb
mov dword [ebp - 0x50], 1
jmp 0x100222f2
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret

Function at 0x10022f50
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10022f69
mov eax, 1
jmp 0x10022fd8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10022f7e
mov eax, 1
jmp 0x10022fd8
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10022fa6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10022fa6
mov eax, 1
jmp 0x10022fd8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10022fd6
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x10022fd6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x10022fd6
mov eax, 1
jmp 0x10022fd8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10023c90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094bcd
mov eax, dword fs:[0]
push eax
mov eax, 0x204c
call fcn.1005e060
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2058], ecx
mov dword [ebp - 0x2038], 0
lea ecx, [ebp - 0x202c]
call fcn.1000f0b0
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x2040]
push eax
call fcn.1004d490
add esp, 8
mov byte [ebp - 4], 1
push 0x2000
push 0
lea ecx, [ebp - 0x2010]
push ecx
call fcn.1006c6b0
add esp, 0xc
mov dword [ebp - 0x2044], 0x2000
lea ecx, [ebp - 0x2040]
call fcn.10006150
push eax
mov edx, dword [ebp - 0x2044]
push edx
lea eax, [ebp - 0x2010]
push eax
push 0x1009ed64
push 0x1009ed68
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x2010]
push ecx
lea ecx, [ebp - 0x203c]
call fcn.10003d50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2054]
call fcn.1000f0b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x203c]
call fcn.10015240
movzx edx, al
test edx, edx
jne 0x10023e1c
push str.94396D3E_1EA9_42CB_849F_71521C40AAC4
lea ecx, [ebp - 0x2034]
call fcn.10003d50
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2030]
call fcn.10003d50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2034]
push ecx
lea edx, [ebp - 0x2030]
push edx
lea eax, [ebp - 0x2050]
push eax
call fcn.10057550
add esp, 0xc
mov dword [ebp - 0x2048], eax
mov ecx, dword [ebp - 0x2048]
mov dword [ebp - 0x204c], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x204c]
push edx
lea ecx, [ebp - 0x202c]
call fcn.1000fef0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2050]
call fcn.100054b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2030]
call fcn.100054b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2034]
call fcn.100054b0
push 0xfde9
lea ecx, [ebp - 0x202c]
call fcn.10006150
push eax
lea eax, [ebp - 0x2028]
push eax
call fcn.100572c0
add esp, 0xc
lea ecx, [ebp - 0x2028]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100040f0
mov edx, dword [ebp - 0x2038]
or edx, 1
mov dword [ebp - 0x2038], edx
lea ecx, [ebp - 0x2028]
call fcn.10005680
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2054]
call fcn.100054b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x203c]
call fcn.100054b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2040]
call fcn.100054b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x202c]
call fcn.100054b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x6c
push eax
push 0
mov ecx, dword [ebp - 4]
sub ecx, 0x24
push ecx
push 0x1002aeb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x68], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1002a570
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xffffffff
je 0x1002a677
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.1006c6b0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1002a66a
mov dword [ebp - 0x240], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
lea eax, [ebp - 0x20c]
push eax
call fcn.10003d50
mov ecx, dword [ebp - 0x234]
call fcn.10027190
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1002a644
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x234]
add edx, 0x80
push edx
mov eax, dword [ebp - 0x234]
add eax, 0x84
push eax
mov ecx, dword [ebp - 0x234]
call fcn.10029110
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1002a66a
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x88], 0
je 0x1002a5ea
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x1002db40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.1000f6f0
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10015a70
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x1002dbbf
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.1000fcd0
mov eax, dword [ebp - 0x220]
jmp 0x1002dc74
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1002dc43
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.1002db40
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x1002dc37
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.1000fcd0
mov eax, dword [ebp - 0x224]
jmp 0x1002dc74
mov dword [ebp - 0x210], 0x100
jmp 0x1002dbc9
lea ecx, [ebp - 0x21c]
call fcn.10010e20
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.1002ca90
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.1000fcd0
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret 4

Function at 0x1002dc90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1002dcef
push 0x1009ce0c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002dcbc
mov eax, 1
jmp 0x1002dd0d
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002dced
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x1002dd0d
jmp 0x1002dd08
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1002dd08
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1002dd0d
mov eax, 1
mov esp, ebp
pop ebp
ret 8