joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013acf
Capabilities:
Find taskbar

Disassembly:
mov eax, 0x101e383c
call fcn.10042430
sub esp, 0x24
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x10013b6b
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x10013b6b
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x10], ebx
je 0x10013b6b
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.100aa190
push str.Explorer.exe
mov dword [ebp - 4], ebx
push dword [eax]
call fcn.10042e8c
add esp, 0x10
cmp eax, ebx
sete byte [ebp + 0xb]
or dword [ebp - 4], edi
lea ecx, [ebp - 0x1c]
call fcn.101d3c0b
cmp byte [ebp + 0xb], bl
je 0x10013b6b
push dword [ebp - 0x10]
call fcn.100a4a20
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
je 0x10013b6b
push eax
call fcn.100a4410
cmp eax, ebx
pop ecx
je 0x10013bec
mov dword [0x10277d04], eax
jmp 0x10013bec
cmp edi, 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x10013b82
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100aa010
pop ecx
mov edi, eax
push str.explorer.exe
lea ecx, [ebp - 0x18]
call fcn.101d3c7f
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.101d25a2
push edi
lea eax, [ebp - 0x30]
push dword [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.100aa370
add esp, 0xc
cmp dword [ebp - 0x28], ebx
je 0x10013bc8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x10], eax
call fcn.100a4a20
pop ecx
jmp 0x10013bd1
mov eax, dword [0x10277d04]
cmp eax, ebx
je 0x10013bd4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.101d25d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.101d3c0b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10014776
Capabilities:
Check if file exists
Get disk size
Get file attributes

Disassembly:
mov eax, 0x101e38d0
call fcn.10042430
sub esp, 0x410
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 8], esi
je 0x10014859
cmp dword [ebp + 0xc], esi
jne 0x100147a8
cmp dword [ebp + 0x10], esi
jne 0x100147a8
cmp dword [ebp + 0x14], esi
je 0x10014859
push edi
mov ecx, 0x103
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x41a]
mov word [ebp - 0x41c], si
rep stosd dword es:[edi], eax
lea ecx, [ebp + 8]
stosw word es:[edi], ax
call fcn.1005ae80
mov dword [ebp - 4], esi
pop edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100147fa
test al, 0x10
je 0x100147fa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
cmp ebx, esi
jne 0x1001484d
push 0x410
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.10042530
lea eax, [ebp - 0x41c]
push 0x207
push eax
push dword [ebp + 8]
call fcn.10073c80
add esp, 0x18
test eax, eax
je 0x1001484d
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 8]
call fcn.10042e8c
pop ecx
cmp eax, esi
pop ecx
je 0x1001484d
lea eax, [ebp - 0x41c]
lea ecx, [ebp + 8]
push eax
call fcn.1005b9d0
jmp 0x100147d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1005b6f0
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1001b27a
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [esi], edi
je 0x1001b32d
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push edi
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
push edi
call ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], edi
jne 0x1001b2cc
cmp eax, 0x7a
jne 0x1001b336
push dword [ebp - 0x10]
call fcn.101d42d4
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
call fcn.101d42d4
mov dword [ebp + 0xc], eax
mov eax, dword [esi]
pop ecx
cmp eax, edi
pop ecx
je 0x1001b348
cmp dword [ebp + 0xc], edi
je 0x1001b348
push dword [ebp - 0x10]
push edi
push eax
call fcn.10042530
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push edi
push dword [ebp + 0xc]
call fcn.10042530
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push eax
push dword [esi]
push dword [ebp + 8]
push edi
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
je 0x1001b33f
jmp 0x1001b34f
mov dword [ebp - 8], 1
jmp 0x1001b363
mov dword [ebp - 8], 2
jmp 0x1001b35d
mov dword [ebp - 8], 4
jmp 0x1001b34f
mov dword [ebp - 8], 3
cmp dword [ebp + 0xc], edi
je 0x1001b35d
push dword [ebp + 0xc]
call fcn.101d42fd
pop ecx
cmp dword [ebp - 4], edi
pop ebx
jne 0x1001b372
mov eax, dword [esi]
cmp eax, edi
je 0x1001b372
push eax
call fcn.101d42fd
pop ecx
mov dword [esi], edi
cmp dword [0x1027b8c0], edi
je 0x1001b3a8
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x1001b386
mov eax, str.NULL
push dword [esi]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push str.CKSecurity::GetSid_____ret:__d___myerror:__d___Name:__s___Sid:__08x_
push str.Security
push 0xffffffffffffffff
push 0x1027b02c
call fcn.10085230
add esp, 0x20
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x1001bcb6
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x1001bd8d
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
lea eax, [ebp - 0x18]
pop edi
mov dword [ebp - 0x18], ebx
push edi
push 0xc
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 8
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x1001bd96
cmp dword [ebp - 0x18], ebx
jbe 0x1001bd99
cmp dword [ebp - 0x18], ebx
jbe 0x1001bd99
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1001bd4a
mov eax, dword [ebp - 0xc]
test byte [eax + 1], 0x10
jne 0x1001bd53
add eax, 8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1001bd5c
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x1001bd13
jmp 0x1001bd99
mov dword [ebp - 4], 3
jmp 0x1001bd99
mov dword [ebp - 4], 4
jmp 0x1001bd99
cmp dword [ebp + 0x10], 0x10000000
mov dword [ebp - 8], 1
jne 0x1001bd99
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
jne 0x1001bd81
mov ecx, dword [eax + 4]
mov eax, 0x1f0000
and ecx, eax
cmp ecx, eax
je 0x1001bd99
mov dword [ebp - 4], 5
mov dword [ebp - 8], ebx
jmp 0x1001bd99
mov dword [ebp - 4], 1
jmp 0x1001bd99
mov dword [ebp - 4], edi
cmp dword [0x1027b8c0], ebx
je 0x1001bdca
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push str.CKSecurity::IsInAcl_____Inner___ret:__d___myerror:__d___Acl:__08x___Sid:__08x___Mask:__08x___Index:__d_
push str.Security
push 0xffffffffffffffff
push 0x1027b02c
call fcn.10085230
add esp, 0x28
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d04f
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 4], edi
jle 0x1001d071
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1001d078
inc edi
cmp edi, dword [esi + 4]
jl 0x1001d05c
xor eax, eax
pop edi
pop esi
ret 4
push 1
pop eax
jmp 0x1001d073

Function at 0x1001f17f
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x1001f1c7
mov eax, dword [esi + 8]
cmp dword [eax - 8], edi
je 0x1001f1c7
call fcn.100e9d60
push dword [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x1001f1c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001f1bb
push 1
pop edi
jmp 0x1001f1c7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x1001fd2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
push edi
push esi
call fcn.1001fcf4
pop ecx
push 2
push esi
push 0xffffffffffffffe0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
push esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x24]
push 0x20
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001fd7d
push 0xe3
jmp 0x1001fd88
cmp dword [ebp - 4], 0x20
jae 0x1001fd8c
push 0xe8
push 7
jmp 0x1001fdc9
cmp dword [ebp - 0x24], 0x4f504554
jne 0x1001fdd0
lea eax, [ebp - 0x1c]
push 0x18
push eax
call fcn.1001fdd6
cmp dword [ebp - 0x20], eax
pop ecx
pop ecx
jne 0x1001fdc2
cmp dword [ebp + 0xc], esi
je 0x1001fdbd
lea eax, [ebp - 0x24]
push 0x20
push eax
push dword [ebp + 0xc]
call fcn.10042590
add esp, 0xc
push 1
pop eax
jmp 0x1001fdd2
push 0xf7
push 0xc
call fcn.1001fcd6
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10020c1f
Capabilities:
Create directory
Get file attributes

Disassembly:
mov eax, 0x101e4974
call fcn.10042430
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x10020ced
push edi
call fcn.10041fde
test eax, eax
pop ecx
je 0x10020ced
push edi
lea ecx, [ebp + 8]
call fcn.1005ae80
push 3
push 0x5c
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.1005c890
push 2
push 0x10240a48
push edi
mov esi, eax
call fcn.10042f6b
add esp, 0xc
test eax, eax
jne 0x10020c85
inc esi
lea ecx, [ebp + 8]
push esi
push 0x5c
call fcn.1005c890
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x10020cfe
lea eax, [ebp - 0x10]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.1005dec0
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x10020cb8
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x10020cba
test al, 0x10
je 0x10020cd7
inc esi
lea ecx, [ebp + 8]
push esi
push 0x5c
call fcn.1005c890
lea ecx, [ebp - 0x10]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.1005b6f0
jmp 0x10020c88
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.1005b6f0
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.1005b6f0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [ebp + 8]
call fcn.100e9cf0
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.1005b6f0
push 1
pop eax
jmp 0x10020cef

Function at 0x10024ded
Capabilities:
Set registry value

Disassembly:
mov eax, 0x101e4f90
call fcn.10042430
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x10024e7a
mov dword [ebp - 0x10], edi
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.1002562a
cmp eax, edi
jne 0x10024e4f
push esi
mov esi, str.OCULAR_SafeDoc_extension
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push edi
push str.A8A5D364_5D3F_4DF0_9B4E_CD8DD8B09E09
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
pop esi
je 0x10024e68
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x10024e61
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x10024e86
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x10024e7a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x10277f70
call fcn.10026af7
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x10024e93
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x101e4fa4
call fcn.10042430
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor esi, esi
test eax, 0x80000000
jne 0x10024eec
mov dword [ebp - 0x10], esi
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.1002562a
cmp eax, esi
jne 0x10024eda
push str.A8A5D364_5D3F_4DF0_9B4E_CD8DD8B09E09
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x10024eec
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 0x10277f70
call fcn.10026c82
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10025980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
and dword [ebp - 8], 0
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x100259cd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x100259c6
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10025a92
xor esi, esi
jmp 0x10025a92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100259f3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x10025a03
xor esi, esi
jmp 0x10025a89
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x10025a15
jmp 0x100259e0
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10025a89
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x10025a48
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10042a40
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.10042590
add esp, 0xc
and byte [edi + esi], 0
test edi, edi
jne 0x10025a50
xor ebx, ebx
jmp 0x10025a7b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10042a40
mov ebx, esp
push esi
push ebx
xor eax, eax
push 0xffffffffffffffff
push edi
push eax
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ebx
call fcn.10025a9e
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100263e8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x101e5208
call fcn.10042430
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.1002562a
mov edi, eax
cmp edi, esi
je 0x10026436
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x1002642f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x100264db
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x100264ab
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.100263e8
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x10026494
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x10026459
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x100264a6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x100264db
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100264be
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x100264d9
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100264ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.10042a40
push ebx
push esi
push edi
lea eax, [ebp - 0x4018]
mov edi, ecx
push eax
mov dword [ebp - 0x18], edi
call fcn.10025bfa
xor esi, esi
cmp eax, esi
jl 0x1002666f
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.1002667c
pop ecx
test eax, eax
pop ecx
jne 0x10026537
mov eax, 0x80020009
jmp 0x1002666f
mov ecx, edi
call fcn.10025bd1
lea eax, [ebp - 0x2018]
mov ecx, edi
push eax
call fcn.10025bfa
cmp eax, esi
jl 0x1002666f
movzx eax, word [ebp - 0xe]
sub eax, 8
je 0x10026634
sub eax, 9
je 0x10026594
dec eax
dec eax
jne 0x1002665e
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x2018]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x1002664f
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
jne 0x100265cc
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10042a40
mov edi, esp
push ebx
push esi
push edi
call fcn.10042530
add esp, 0xc
cmp edi, esi
jne 0x100265d6
mov eax, 0x80004005
jmp 0x1002666f
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jle 0x10026624
lea eax, [ebp - 0x2018]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + edi]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
call fcn.10026703
pop ecx
add dword [ebp - 0xc], 2
mov ecx, dword [ebp - 4]
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x100265e7
xor esi, esi
mov eax, dword [ebp + 8]
push ebx
push edi
push 3
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
jmp 0x10026658
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2018]
push eax
push 1
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.10025bfa
cmp eax, esi
jl 0x1002666f
xor eax, eax
lea esp, [ebp - 0x4024]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10034dbc
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x101e628c
call fcn.10042430
sub esp, 0xe18
xor edx, edx
push ebx
cmp dword [0x1027825c], edx
push esi
push edi
jne 0x10034fc3
and byte [ebp - 0x41c], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xe22]
mov word [ebp - 0xe24], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], dx
rep stosd dword es:[edi], eax
push str.OAgent.ini
mov dword [0x1027825c], 1
mov dword [ebp - 0x10], edx
stosw word es:[edi], ax
call fcn.100019f9
push eax
lea eax, [ebp - 0x624]
push 0x10239350
push eax
call fcn.1004244f
add esp, 0x10
lea eax, [ebp - 0x624]
mov esi, 0x400
mov ebx, 0x10277134
push eax
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push 0x101fb790
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edi, edi
cmp eax, edi
jbe 0x10034ea4
cmp word [ebp - 0x626], di
jne 0x10034ea4
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.100a7780
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jne 0x10034f86
lea ecx, [ebp - 0x18]
call fcn.100714b0
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.10071620
test eax, eax
mov edi, 0x101fb798
je 0x10034f13
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push edi
call fcn.10071a40
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x10034f13
cmp dword [ebp - 0x10], esi
jae 0x10034f06
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10042590
add esp, 0xc
jmp 0x10034f0a
and dword [ebp - 0x10], 0
push dword [ebp - 0x1c]
call fcn.101d42fd
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10071670
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.100715a0
cmp dword [ebp - 0x10], 0
jne 0x10034f86
push 0x800
lea eax, [ebp - 0xe24]
push 0
push eax
call fcn.10042530
add esp, 0xc
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push edi
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x10034f80
cmp word [ebp - 0x626], 0
jne 0x10034f80
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.100a7780
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10034fc3
cmp dword [ebp - 0x10], 4
jbe 0x10034fc3
lea eax, [ebp - 0x41c]
test eax, eax
je 0x10034fc3
cmp dword [ebp - 0x41c], 1
je 0x10034fc3
movzx eax, word [ebp - 0x400]
lea eax, [eax + eax + 0x22]
test eax, eax
je 0x10034fc3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffffc
cmp eax, ecx
ja 0x10034fc3
mov eax, dword [ebp - 0x414]
mov dword [0x10278258], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1003732f
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
call fcn.10070120
test eax, eax
je 0x1003734f
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x10037356
mov dword [0x10278298], 0x57
xor eax, eax
jmp 0x100373e8
push esi
push edi
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10037393
push 0x10
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x10037393
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov dword [0x10278298], ebx
jne 0x100373cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1027b8c0], ebx
mov dword [0x10278298], eax
je 0x100373cc
push eax
push eax
push str.CTSDEncryptDrv:_StartService___failed__error_ld_0x_08x__n
push str.TSDEncryptDrv
push 4
push 0x1027b02c
call fcn.10085230
add esp, 0x18
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, ebx
je 0x100373d9
push edi
call esi
cmp dword [ebp - 8], ebx
je 0x100373e3
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret