joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102aeb50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x104df0b0]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x102aeb94
mov eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x102aebb6
mov eax, 0xa
jmp 0x102aec9d
cmp dword [ebp + 0xc], 0
je 0x102aec02
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 8]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x102aec00
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x14]
mov byte [edx + 1], 0xf9
jmp 0x102aec3e
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x102aec29
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x102aec3e
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x102af3f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x102af439
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x102af439
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x102af439
xor eax, eax
jmp 0x102af47a
mov dword [ebp - 4], 1
jmp 0x102af44b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x102af475
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x102af473
xor eax, eax
jmp 0x102af47a
jmp 0x102af442
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x102ce080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x102ce0a0
jl 0x102ce097
cmp dword [ebp + 0xc], 0
ja 0x102ce0a0
xor eax, eax
xor edx, edx
jmp 0x102ce1e7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x102ce0c3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x102ce1e7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x102ce135
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10179d30
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.1017af20
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x102ce1d8
mov ecx, dword [ebp - 8]
call fcn.102ccf40
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x102ce1a6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x102ce1a4
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x102ce1e7
jmp 0x102ce151
cmp dword [ebp - 4], 0
jbe 0x102ce1d8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x102ce1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x102ce21c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x102ce302
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x102ce2b3
jg 0x102ce245
cmp dword [ebp + 0xc], 0
jbe 0x102ce2b3
cmp dword [ebp - 8], 0
jl 0x102ce2b3
jg 0x102ce253
cmp dword [ebp - 0xc], 0
jbe 0x102ce2b3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x102ce271
jl 0x102ce265
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x102ce271
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.1017af20
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x102ce2f6
jg 0x102ce2c1
cmp dword [ebp + 0xc], 0
jbe 0x102ce2f6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x102ce2f6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x102d08b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x104d5404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xf4], ecx
lea ecx, [ebp - 0x34]
call fcn.10182150
lea ecx, [ebp - 0x1c]
call fcn.10182150
push 0x104dd0d0
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x102d09fa
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xdd]
call fcn.102d0c10
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0xe4], eax
push 0x104dd0d0
lea ecx, [ebp - 0x64]
call fcn.1018e0a0
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0xe8]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.10192db0
add esp, 0xc
push eax
lea ecx, [ebp - 0x34]
call fcn.101870f0
lea ecx, [ebp - 0x4c]
call fcn.1017a170
lea ecx, [ebp - 0x64]
call fcn.1017a170
lea ecx, [ebp - 0x7c]
call fcn.1017a170
lea ecx, [ebp - 0xdc]
push ecx
lea ecx, [ebp - 0xde]
call fcn.102d0c30
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0xec], eax
push 0x104dd0d0
lea ecx, [ebp - 0xc4]
call fcn.1018e0a0
mov dword [ebp - 0xf0], eax
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
lea edx, [ebp - 0xac]
push edx
call fcn.10192db0
add esp, 0xc
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.102d1240
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
call fcn.101870f0
lea ecx, [ebp - 0x94]
call fcn.1017a170
lea ecx, [ebp - 0xac]
call fcn.1017a170
lea ecx, [ebp - 0xc4]
call fcn.1017a170
lea ecx, [ebp - 0xdc]
call fcn.1017a170
sub esp, 0x18
mov esi, esp
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
mov ecx, esi
call fcn.1018e0a0
mov ecx, dword [ebp - 0xf4]
call fcn.102d08b0
lea ecx, [ebp - 0x1c]
call fcn.1017a170
lea ecx, [ebp - 0x34]
call fcn.1017a170
lea ecx, [ebp + 8]
call fcn.1017a170
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10353876
mov esp, ebp
pop ebp
ret 0x18
Function at 0x102d0a50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x104d5404]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xb4], ecx
lea ecx, [ebp - 0xac]
call fcn.10182150
lea ecx, [ebp - 0x94]
call fcn.10182150
push 0x104dd2f8
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x102d0b65
mov ecx, dword [ebp - 0xb4]
call fcn.102d2920
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xad]
call fcn.102d0f00
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0xb8], eax
push 0x104dd2f8
lea ecx, [ebp - 0x34]
call fcn.1018e0a0
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.10192db0
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.1017a170
lea ecx, [ebp - 0x4c]
call fcn.1017a170
push 0
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x102d0b90
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0xae]
call fcn.102d0f20
mov ecx, eax
call fcn.1017aed0
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.102cf6e0
add esp, 0xc
mov ecx, eax
call fcn.1017aed0
push eax
call fcn.102f15e0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.1017a170
lea ecx, [ebp - 0x7c]
call fcn.1017a170
lea ecx, [ebp - 0x1c]
call fcn.1017a170
lea ecx, [ebp - 0x94]
call fcn.1017a170
lea ecx, [ebp - 0xac]
call fcn.1017a170
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10353876
mov esp, ebp
pop ebp
ret
Function at 0x102f1a20
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x104d5404]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xac]
call fcn.10182150
lea ecx, [ebp - 0x94]
call fcn.10182150
push 0x104dd658
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x102f1b2e
mov ecx, 0x104dd64c
call fcn.102d2920
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xad]
call fcn.102f1b60
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0xb4], eax
push 0x104dd658
lea ecx, [ebp - 0x34]
call fcn.1018e0a0
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.10192db0
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.1017a170
lea ecx, [ebp - 0x4c]
call fcn.1017a170
push 0
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x102f19e0
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0xae]
call fcn.102f1b80
mov ecx, eax
call fcn.1017aed0
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.102cf6e0
add esp, 0xc
mov ecx, eax
call fcn.1017aed0
push eax
call fcn.102f15e0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.1017a170
lea ecx, [ebp - 0x7c]
call fcn.1017a170
lea ecx, [ebp - 0x1c]
call fcn.1017a170
lea ecx, [ebp - 0x94]
call fcn.1017a170
lea ecx, [ebp - 0xac]
call fcn.1017a170
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10353876
mov esp, ebp
pop ebp
ret
Function at 0x10311ad0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x104d5404]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x1c]
call fcn.10182150
push 0x104dd778
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x10311b5d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x65]
call fcn.10311ba0
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0x6c], eax
push 0x104dd778
lea ecx, [ebp - 0x4c]
call fcn.1018e0a0
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.10192db0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
call fcn.101870f0
lea ecx, [ebp - 0x34]
call fcn.1017a170
lea ecx, [ebp - 0x4c]
call fcn.1017a170
lea ecx, [ebp - 0x64]
call fcn.1017a170
push 1
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
call fcn.1017a170
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10353876
mov esp, ebp
pop ebp
ret

Function at 0x103126f0
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x104d5404]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x1c]
call fcn.10182150
push 0x104dd880
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x1031277d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x65]
call fcn.103127d0
mov ecx, eax
call fcn.1017aed0
mov dword [ebp - 0x6c], eax
push 0x104dd880
lea ecx, [ebp - 0x4c]
call fcn.1018e0a0
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.10192db0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
call fcn.101870f0
lea ecx, [ebp - 0x34]
call fcn.1017a170
lea ecx, [ebp - 0x4c]
call fcn.1017a170
lea ecx, [ebp - 0x64]
call fcn.1017a170
push 0
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.1017aed0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
call fcn.1017a170
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10353876
mov esp, ebp
pop ebp
ret
Function at 0x10003343
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov edi, dword [esi + 0x4c]
cmp edi, ebx
mov dword [ebp - 0xc], edi
je 0x100033e1
mov eax, dword [esi + 0x54]
cmp eax, ebx
je 0x100033e1
cmp dword [esi + 0x60], ebx
je 0x100033e1
cmp dword [esi + 0x64], ebx
je 0x100033e1
cmp dword [edi + 0x40c], ebx
jne 0x1000337c
mov ebx, dword [esi + 0x78]
shl ebx, 1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x100033b5
mov eax, dword [edi + 0xc]
sub eax, ebx
mov dword [edi + 8], eax
push dword [esi + 0x54]
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x1f5
push dword [esi + 0x58]
push 1
push 1
call fcn.1001fa18
add esp, 0x10
xor ebx, ebx
cmp dword [edi + 0x40c], ebx
je 0x100033ed
lea eax, [edi + 0x10]
push ebx
push eax
push dword [esi + 0x64]
push str.bardownloaded
call fcn.100200bc
add esp, 0x10
neg eax
sbb eax, eax
and al, 0x9e
add eax, 0xffffff35
mov dword [edi], eax
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
leave
ret
cmp byte [edi + 0x424], 0
mov ebx, dword [esi + 0x60]
lea eax, [edi + 0x424]
mov dword [ebp - 8], eax
je 0x1000346a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.1001ad44
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100034e3
mov eax, dword [esi + 0x60]
cmp byte [eax], 0x22
jne 0x10003440
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
jmp 0x1000345a
mov byte [ebx], 0x22
push dword [esi + 0x60]
lea eax, [ebx + 1]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
mov byte [eax + ebx + 1], 0x22
inc eax
inc eax
push dword [ebp - 8]
add eax, ebx
mov byte [eax], 0x20
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
push 0x40
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.10013fcd
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100034f0
cmp dword [ebp - 0x18], edi
je 0x100034b5
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
push 0x1d4c0
push 0x258
push eax
lea ecx, [esi + 0x8c]
mov dword [esi + 0x88], eax
call fcn.100211f6
test eax, eax
jne 0x10003507
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xffffff2d
jmp 0x10003500
mov dword [edi], 0xffffff38
push 0
jmp 0x100033e2
mov ecx, esi
call fcn.1000351c
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xffffff2e
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp ebx, dword [esi + 0x60]
je 0x100033e8
push ebx
call fcn.1001ad4f
pop ecx
jmp 0x100033e8
Function at 0x1000351c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x60], ecx
je 0x10003546
mov eax, dword [esi + 0x64]
cmp eax, ecx
je 0x1000353d
push ecx
push ecx
push eax
push str.bardownloaded
call fcn.100200bc
add esp, 0x10
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x1000a893
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0xc]
mov dword [esi + 0x70], 0x10040d70
mov dword [0x10043994], esi
push dword [ebp + 8]
mov dword [esi], 0x84
mov dword [esi + 0x64], 0x300
push esi
call fcn.1000cc52
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x1000a8e0
push 0x10
push dword [ebp + 0x10]
push 0x10043e18
call fcn.10013c5e
add esp, 0xc
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov edi, 0x94
mov dword [esi + 0x18], eax
push edi
lea eax, [ebp - 0xb8]
push ebx
push eax
call fcn.10013fcd
add esp, 0xc
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xa8], 2
jne 0x1000a931
cmp dword [ebp - 0xb4], 5
jae 0x1000a987
mov eax, dword [ebp - 0x10]
cmp eax, 1
jbe 0x1000a987
or dword [esi + 0x74], 0xffffffff
add eax, eax
xor ecx, ecx
test eax, 0x80000000
jne 0x1000a953
shr dword [esi + 0x74], 1
shl eax, 1
inc ecx
cmp ecx, 0x20
jl 0x1000a941
shr dword [esi + 0x74], 1
mov eax, dword [esi + 0x74]
lea eax, [eax*4 + 4]
push eax
push ebx
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x78], eax
xor edi, edi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [esi + 0x78]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [esi + 0x74]
jbe 0x1000a970
jmp 0x1000a98d
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
Function at 0x1000a9e5
Capabilities:
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
call fcn.10023092
xor ebx, ebx
test eax, eax
jne 0x1000aa15
push 1
call fcn.100230bc
push 1
call fcn.100230d9
push 1
push ebx
call fcn.1001219c
add esp, 0x10
push ebx
mov esi, 0x10043d88
push ebx
push esi
call fcn.1000ce58
mov dword [ebp - 4], eax
call fcn.100231a5
test eax, eax
je 0x1000aa37
push ebx
push ebx
call fcn.1001219c
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
jl 0x1000ab80
push ebx
push esi
call fcn.1000d243
push 0xcb
push ebx
push ebx
push 1
call fcn.1001fa18
add esp, 0x10
test eax, eax
jne 0x1000aa66
mov eax, 0x8000ffff
jmp 0x1000ab83
call fcn.1000abc5
cmp dword [0x10044ee8], ebx
jne 0x1000aa7b
push 1
call fcn.1001247d
pop ecx
call fcn.10017db6
push 1
call fcn.10017723
push 0x40
call fcn.10023360
push eax
call fcn.10017b31
add esp, 0xc
cmp dword [0x10044ee8], ebx
je 0x1000aadc
push ebx
push ebx
call fcn.1001795a
push 0x40
call fcn.10023360
add esp, 0xc
mov esi, 0x1000
test eax, eax
jne 0x1000aac4
push esi
call fcn.10023360
test eax, eax
pop ecx
je 0x1000aadc
push 0x40
call fcn.10023360
pop ecx
push eax
push esi
call fcn.10023360
pop ecx
push eax
call fcn.1001795a
pop ecx
pop ecx
call fcn.100120b2
test eax, eax
jne 0x1000aaf8
call fcn.100120a3
test eax, eax
jne 0x1000aaf8
mov eax, 0x80040201
jmp 0x1000ab83
lea eax, [ebp - 0x130]
push 0x12c
push eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push str.MyWebSearch_bar_Uninstall
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push esi
call fcn.10020037
add esp, 0x14
test eax, eax
je 0x1000ab80
push ebx
push ebx
push str.MyWebSearch_bar_Uninstall
push edi
push esi
call fcn.10020145
push 9
lea eax, [ebp - 0x130]
push str.rundll32
push eax
call fcn.1001416f
add esp, 0x20
test eax, eax
jne 0x1000ab80
lea eax, [ebp - 0x127]
push 0x2c
push eax
call fcn.10013bf5
pop ecx
cmp eax, ebx
pop ecx
je 0x1000ab80
mov byte [eax], bl
lea eax, [ebp - 0x127]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1000ab80
lea eax, [ebp - 0x127]
push 1
push eax
call fcn.1001cbf4
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret