joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417485
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426fa0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00413f4c
and dword [ebp - 0x14], 0
cmp dword [0x429000], 0
mov dword [ebp - 0x18], eax
jne 0x417538
push 0x405d80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4175e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x405d74
push ebx
call edi
test eax, eax
je 0x4175e0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x405d64
push ebx
mov dword [0x429000], eax
call edi
push eax
call esi
push 0x405d50
push ebx
mov dword [0x429004], eax
call edi
push eax
call esi
push 0x405d34
push ebx
mov dword [0x429008], eax
call edi
push eax
call esi
mov dword [0x429010], eax
test eax, eax
je 0x417538
push 0x405d1c
push ebx
call edi
push eax
call esi
mov dword [0x42900c], eax
mov eax, dword [0x42900c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417591
cmp dword [0x429010], ecx
je 0x417591
push eax
call esi
push dword [0x429010]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417591
test ebx, ebx
je 0x417591
call edi
test eax, eax
je 0x417588
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417588
test byte [ebp - 8], 1
jne 0x417591
or dword [ebp + 0x10], 0x200000
jmp 0x4175c4
mov eax, dword [0x429004]
cmp eax, dword [ebp - 0x18]
je 0x4175c4
push eax
call esi
test eax, eax
je 0x4175c4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4175c4
mov eax, dword [0x429008]
cmp eax, dword [ebp - 0x18]
je 0x4175c4
push eax
call esi
test eax, eax
je 0x4175c4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x429000]
call esi
test eax, eax
je 0x4175e0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4175e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004122f2
leave
ret

Function at 0x41c848
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040b41d
test al, al
je 0x41c8af
cmp dword [edi + 0x14], 8
jb 0x41c868
mov eax, dword [edi]
jmp 0x41c86a
mov eax, edi
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x41c87f
xor al, al
jmp 0x41c8ae
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ecx, esi
call fcn.0041b484
mov eax, dword [esi + 4]
sub eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [esi]
cmp dword [edi + 0x14], 8
pop esi
jb 0x41c89f
mov edi, dword [edi]
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
setne al
pop ebx
pop edi
leave
ret 8
Function at 0x41d692
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push 0x4072c8
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x41d6b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41d6c5
mov bl, 1
test esi, esi
je 0x41d6c5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x10002cd9
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push 3
pop ecx
xor edx, edx
lea eax, [esi + 3]
div ecx
lea eax, [eax + esi + 7]
push eax
push dword [ebp + 0x10]
call fcn.10002c9a
pop ecx
pop ecx
test eax, eax
je 0x10002dda
push dword [ebp + 0x10]
call fcn.10002c93
and dword [ebp - 0xc], 0
add esp, 4
mov ecx, eax
test esi, esi
jbe 0x10002dbc
push ebx
push edi
xor edx, edx
push 3
pop edi
lea eax, [esi - 1]
div edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 2
inc eax
mov edx, eax
imul edx, edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 8]
dec edx
cmp edx, esi
jae 0x10002d49
mov dl, byte [edi + 1]
jmp 0x10002d4b
xor dl, dl
cmp dword [ebp - 8], esi
jae 0x10002d58
mov bl, byte [edi + 2]
mov byte [ebp - 1], bl
jmp 0x10002d5c
mov byte [ebp - 1], 0
movzx esi, byte [edi]
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
movzx esi, dl
movzx edx, byte [edi]
and edx, 3
add dword [ebp - 8], 3
shl edx, 4
mov ebx, esi
shr ebx, 4
or edx, ebx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], dl
movzx edx, byte [ebp - 1]
and esi, 0xf
mov ebx, edx
shr ebx, 6
shl esi, 2
or ebx, esi
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebp + 0xc]
inc ecx
mov byte [ecx], bl
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], dl
inc ecx
add edi, 3
dec eax
jne 0x10002d3c
pop edi
pop ebx
lea eax, [esi + 1]
cmp dword [ebp - 0xc], eax
je 0x10002dd0
add esi, 2
cmp dword [ebp - 0xc], esi
jne 0x10002dd4
mov byte [ecx - 2], 0x3d
mov byte [ecx - 1], 0x3d
xor eax, eax
mov byte [ecx], 0
inc eax
pop esi
leave
ret
Function at 0x100067ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x4a4
lea ebp, [esp - 4]
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x4a4], eax
push 0xc
mov eax, 0x1004ff97
call fcn.10037f36
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000682d
cmp dword [ebp + 0x10], 2
jb 0x10006944
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp dword [0x1006a458], ebx
je 0x100068cc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push 4
push ebx
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x100068b5
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x100068b5
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jne 0x100068b5
cmp dword [ebp - 0x18], ebx
je 0x100068b5
push dword [ebp - 0x18]
call fcn.1003893a
pop ecx
cmp eax, 0xf3
jae 0x100068ac
push dword [ebp - 0x18]
lea eax, [ebp + 0x29c]
push eax
call fcn.1003af3a
pop ecx
pop ecx
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp byte [ebp - 0xd], bl
jne 0x1000691a
mov eax, dword [0x10069bc4]
cmp eax, ebx
je 0x100069b2
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x29c]
push ecx
push ebx
push ebx
push str.ExePath
push eax
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100069b2
lea eax, [ebp + 0x29c]
push 0x5c
push eax
call fcn.10039560
pop ecx
pop ecx
cmp eax, ebx
je 0x1000691a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x29c]
push eax
lea eax, [ebp + 0x94]
push str._sidmbrbtn.dll
push eax
call fcn.100047e3
add esp, 0xc
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100069ad
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x198]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x10055cd4
push dword [0x10069bc4]
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100069b2
lea eax, [ebp + 0x198]
push 0x5c
push eax
call fcn.100394f0
pop ecx
pop ecx
cmp eax, ebx
je 0x100069b2
mov byte [eax], bl
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp + 0x3a0]
push 0x10055dd4
push eax
call fcn.1003b332
add esp, 0xc
lea eax, [ebp + 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100698e8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4a4]
xor ecx, ebp
call fcn.10037f27
add ebp, 0x4a8
leave
ret
Function at 0x10007cd6
Capabilities:
Get geographical location

Disassembly:
push 0x14
mov eax, 0x10050206
call fcn.10037f69
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
mov esi, 0x400
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003b6d0
mov dword [ebp - 0x18], eax
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp + 8]
sub ecx, eax
mov eax, dword [ebp + 0xc]
sbb eax, edx
push ebx
push esi
push eax
push ecx
call fcn.1003b620
mov edi, eax
and edi, 0x800003ff
jns 0x10007d28
dec edi
or edi, 0xfffffc00
inc edi
mov eax, edi
shl eax, 0xa
cdq
mov ecx, dword [ebp + 8]
sub ecx, eax
mov eax, dword [ebp + 0xc]
sbb eax, edx
sub ecx, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x1c]
push ebx
push 0x100000
push eax
push ecx
call fcn.1003b620
mov ebx, eax
and ebx, 0x800003ff
jns 0x10007d5d
dec ebx
or ebx, 0xfffffc00
inc ebx
push 0
push 0x40000000
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003b620
mov dword [ebp - 0x1c], eax
push 3
lea eax, [ebp - 0x14]
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10007d95
push 0x10055e4c
lea eax, [ebp - 0x14]
push eax
call fcn.100380a0
pop ecx
pop ecx
cmp dword [ebp - 0x1c], 0
jne 0x10007e36
mov eax, 0x3e7
cmp ebx, eax
jg 0x10007e36
test ebx, ebx
jne 0x10007e05
cmp edi, eax
jg 0x10007e05
mov ecx, 0x1006a488
test edi, edi
je 0x10007dea
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
call fcn.10007658
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push edi
jmp 0x10007e67
call fcn.10007684
push eax
push dword [ebp - 0x18]
push str._d___s
push dword [ebp + 0x10]
call fcn.1003b332
add esp, 0x10
jmp 0x10007e77
mov eax, edi
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
mov ecx, 0x1006a488
call fcn.1000762c
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
jmp 0x10007e67
mov eax, ebx
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
mov ecx, 0x1006a488
call fcn.10007600
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push str._d_s_02d___s
push dword [ebp + 0x10]
call fcn.1003b332
add esp, 0x18
or dword [ebp - 4], 0xffffffff
call fcn.1003800e
ret
Function at 0x1001163b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10011343
or al, 0xfe
mov ch, 0x10
lea eax, [ebp - 0x40]
push eax
call fcn.10011353
push eax
push esi
push dword [ebp + 8]
call fcn.10011308
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10011343
cmp ah, byte [edx + ebx*4 - 0x17ba7208]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10011353
push eax
push esi
push dword [ebp + 8]
call fcn.10011308
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10011353
push eax
push esi
push dword [ebp + 8]
call fcn.10011308
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10011353
push eax
push esi
push dword [ebp + 8]
call fcn.10011308
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10011343
ret
Function at 0x100119ac
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x100119f7
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100119f2
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x100119dc
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100119e4
cmp edx, ebx
jne 0x10011b32
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100119b3
add eax, dword [eax + 4]
jmp 0x100119a0
mov dword [ebp + 0xc], ebx
jmp 0x10011a02

Function at 0x10011a90
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10011a1a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10011a38
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10011a96
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10011a7d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10011a86
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je fcn.10011a90
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10011a72
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100119fc
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10011ae3
dec eax
je 0x10011ada
sub eax, 3
je 0x10011ad1
mov dword [ebp - 4], 0x40
jmp 0x10011b00
mov dword [ebp - 4], 4
jmp 0x10011ae6
mov dword [ebp - 4], 0x20
jmp 0x10011ae6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10011b32
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10011ab2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10011343
mov edi, dword [ebx + 0x4d]
jp 0x10011b26
push dword [ebp + 0x14]
jne 0x10011b3d
push 1
push esi
call edi
mov eax, esi
jmp 0x10011b3e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011fe6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x33c], eax
call fcn.10011343
insd dword es:[edi], dx
xchg esp, eax
xor al, 3
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10012037
cmp dword [ebp - 0x398], 0
je 0x10012201
cmp dword [ebp + 0xc], 1
je 0x10012201
cmp dword [ebp + 0xc], 8
jne 0x100121c9
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.10011353
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10011308
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
invalid
test dword [eax - 7], ebp

Function at 0x100161e2
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10016230
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10016241
push 0xd
pop eax
jmp 0x1001626b
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10016244
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1001811a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xc
mov eax, 0x10051c97
call fcn.10037f69
and dword [ebp - 4], 0
mov eax, dword [0x10067420]
cmp eax, 0xffffffff
je 0x100181e1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x10018196
push 0x20
call fcn.10038e4f
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10018166
call fcn.10017023
mov esi, eax
jmp 0x10018168
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x100181e1
push esi
push dword [0x10067420]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10018192
push 1
mov ecx, esi
call fcn.10016d6f
xor esi, esi
mov dword [ebp - 0x14], esi
test esi, esi
je 0x100181e1
mov dword [esi], 1
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x100181cb
push dword [ebp + 0x10]
lea ecx, [esi + 0x18]
call fcn.10001f52
jmp 0x100181e1
add esi, 0x18
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x100181e1
mov ecx, esi
call fcn.1000f899
or dword [ebp - 4], 0xffffffff
call fcn.1003800e
ret
Function at 0x1001b07d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push 0
push 1
mov ecx, 0x10069b48
call fcn.1001aedd
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001b0ed
cmp dword [ebp - 0x10], 2
jne 0x1001b0ed
cmp dword [ebp - 0x1c], 6
jb 0x1001b0ed
cmp dword [ebp - 0x18], 0
ja 0x1001b0d2
cmp dword [ebp - 0x1c], 6
jbe 0x1001b0ed
sub esp, 0x10
mov edi, esp
mov esi, 0x10056888
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x10056818
movsd dword es:[edi], dword [esi]
call fcn.1001682e
add esp, 0x14
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10037f27
add ebp, 0x78
leave
ret
Function at 0x1001ded4
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x364]
sub esp, 0x3e4
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x360], eax
cmp dword [0x10069bc4], 0
je 0x1001defc
mov al, 1
jmp 0x1001df60
push ebx
push esi
push edi
mov ebx, 0x10069bc4
push ebx
push 0xf003f
push 0
mov edi, str.SoftwareDownloadManager_
push edi
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x74], eax
test eax, eax
je 0x1001df75
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x74], eax
test eax, eax
je 0x1001df75
xor eax, eax
push eax
push ebx
push eax
push 0xf003f
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001e0b8
call fcn.1001d375
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x360]
xor ecx, ebp
call fcn.10037f27
add ebp, 0x364
leave
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x2a0]
push eax
push 0
push 0
push str.idmvers
push dword [0x10069bc4]
mov dword [ebp - 0x80], 0x40
call esi
mov dword [ebp - 0x78], eax
cmp eax, 2
jne 0x1001dfb2
call fcn.1001d375
xor ebx, ebx
jmp 0x1001e0af
xor ebx, ebx
cmp eax, ebx
je 0x1001e0af
cmp dword [0x1006a458], ebx
jne 0x1001e0af
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001e0af
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 0x104
call esi
test eax, eax
jne 0x1001e00c
inc edi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x1001e0af
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x98]
push str._sInternet_Download_Manager
push eax
call fcn.1003b332
add esp, 0xc
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001e0af
lea eax, [ebp + 0x98]
push str.GlobalErrors.log
push eax
call fcn.100380b0
lea eax, [ebp + 0x98]
push 0x100577c8
push eax
call fcn.1003b31b
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x1001e0af
push dword [ebp - 0x78]
lea eax, [ebp + 0x2e0]
push 0x10057790
push eax
call fcn.1003b332
add esp, 0xc
lea eax, [ebp + 0x2e0]
push esi
push eax
call fcn.100381a0
pop ecx
push eax
lea eax, [ebp + 0x2e0]
push 1
push eax
call fcn.1003cdb0
push esi
call fcn.1003b093
add esp, 0x14
cmp dword [ebp - 0x74], ebx
je 0x1001df5b
xor al, al
jmp 0x1001df5d