joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426374
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul ecx, eax, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
push esi
mov esi, dword [esp + 8]
and esi, 0xf
cmp esi, 4
jb 0x4263a4
push edi
mov edi, esi
shr edi, 2
mov eax, dword [edx]
sub esi, 4
imul eax, eax, 0x3d4d51c3
add edx, 4
sub ecx, eax
rol ecx, 0x11
imul ecx, ecx, 0x27d4eb2f
dec edi
jne 0x426387
pop edi
test esi, esi
je 0x4263c0
movzx eax, byte [edx]
imul eax, eax, 0x165667b1
add ecx, eax
inc edx
rol ecx, 0xb
imul ecx, ecx, 0x9e3779b1
dec esi
jne 0x4263a8
pop esi
jmp 0x426352

Function at 0x4265f6
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, edx
mov ebp, ecx
and esi, 0x1f
push edi
mov edi, dword [esp + 0x20]
cmp esi, 8
jb 0x42666a
mov eax, esi
shr eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ebp, 8
push eax
push ecx
push 0
push 0
call fcn.00426532
add esp, 0x10
mov ecx, eax
xor ecx, ebx
xor edx, edi
mov eax, ecx
shld eax, edx, 0x1b
push 0x9e3779b1
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00401ac0
mov ebx, eax
mov edi, edx
add ebx, 0xc2b2ae63
adc edi, 0x85ebca77
sub esi, 8
dec dword [esp + 0x14]
jne 0x426619
cmp esi, 4
jb 0x4266bb
mov eax, dword [ebp]
add ebp, 4
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
call fcn.00401ac0
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.00401ac0
mov ebx, eax
mov edi, edx
add ebx, 0x9e3779f9
adc edi, 0x165667b1
sub esi, 4
test esi, esi
je 0x4266fc
movzx eax, byte [ebp]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00401ac0
xor ebx, eax
xor edi, edx
push 0x9e3779b1
mov eax, ebx
inc ebp
shld eax, edi, 0xb
push 0x85ebca87
shld edi, ebx, 0xb
push edi
push eax
call fcn.00401ac0
mov ebx, eax
mov edi, edx
dec esi
jne 0x4266bf
push edi
push ebx
call fcn.004265aa
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x426ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push 0x9e3779b1
push 0x85ebca87
mov esi, edx
mov ebp, ecx
push 0
push esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
call fcn.00401ac0
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, esi
shr eax, 4
mov dword [esp + 0x24], ebp
sub ebp, ebx
lea edi, [ebx + 8]
mov dword [esp + 0x14], edx
mov ebx, ebp
mov dword [esp + 0x30], eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x1c], 8
mov edx, dword [edi]
sub edx, dword [esp + 0x40]
mov eax, dword [edi + 4]
sbb eax, dword [esp + 0x44]
xor edx, dword [ebx + edi]
xor eax, dword [ebx + edi + 4]
mov esi, dword [edi - 8]
add esi, dword [esp + 0x40]
mov ecx, dword [edi - 4]
adc ecx, dword [esp + 0x44]
xor ecx, dword [ebp + 4]
xor esi, dword [ebp]
push eax
push edx
push ecx
push esi
call fcn.004269db
add esp, 0x10
lea ebp, [ebp + 0x10]
add dword [esp + 0x18], eax
lea edi, [edi + 0x10]
adc dword [esp + 0x14], edx
dec dword [esp + 0x1c]
jne 0x426b01
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x28]
mov ecx, dword [ebx + 0x7f]
sub ecx, dword [esp + 0x40]
mov eax, dword [ebx + 0x83]
sbb eax, dword [esp + 0x44]
mov esi, dword [ebx + 0x77]
mov edx, dword [ebx + 0x7b]
mov ebx, dword [esp + 0x2c]
xor ecx, dword [ebx + ebp - 8]
xor eax, dword [ebx + ebp - 4]
add esi, dword [esp + 0x40]
push eax
adc edx, dword [esp + 0x48]
xor edx, dword [ebx + ebp - 0xc]
xor esi, dword [ebx + ebp - 0x10]
push ecx
push edx
push esi
call fcn.004269db
mov ebx, edx
mov edi, eax
mov edx, dword [esp + 0x24]
push edx
push dword [esp + 0x2c]
call fcn.00426a16
mov esi, dword [esp + 0x48]
add esp, 0x18
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x28], ecx
cmp esi, 8
jbe 0x426c1d
mov edx, dword [esp + 0x38]
sub ebp, 0xffffff80
add edx, 3
add esi, 0xfffffff8
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], esi
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
sub ecx, dword [esp + 0x40]
mov esi, dword [edx]
sbb eax, dword [esp + 0x44]
xor ecx, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
mov edx, dword [edx + 4]
add esi, dword [esp + 0x40]
push eax
adc edx, dword [esp + 0x48]
xor edx, dword [ebp + 4]
xor esi, dword [ebp]
push ecx
push edx
push esi
call fcn.004269db
add esp, 0x10
lea ebp, [ebp + 0x10]
add edi, eax
adc ebx, edx
mov edx, dword [esp + 0x1c]
add edx, 0x10
dec dword [esp + 0x18]
mov dword [esp + 0x1c], edx
jne 0x426bca
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add edi, eax
adc ebx, ecx
push ebx
push edi
call fcn.00426a16
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x426c32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov esi, ebx
push edi
mov dword [esp + 0x10], eax
lea edi, [ecx + 8]
sub esi, ecx
mov dword [esp + 0x14], 4
mov eax, dword [edi + 4]
xor eax, dword [esi + edi + 4]
mov ecx, dword [edi]
xor ecx, dword [esi + edi]
push eax
mov eax, dword [edi - 4]
xor eax, dword [ebx + 4]
push ecx
mov ecx, dword [edi - 8]
xor ecx, dword [ebx]
push eax
push ecx
call fcn.004269db
mov ecx, dword [esp + 0x1c]
lea ebx, [ebx + 0x10]
add esp, 0x10
lea edi, [edi + 0x10]
add ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
adc eax, edx
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x426c5d
push eax
push ecx
call fcn.00426a16
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18006609
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1800665f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1800665f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x18006651
cmp esi, ecx
jae 0x1800665f
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1800663f
cmp esi, ecx
jae 0x1800665f
cmp word [esi], 0
je 0x1800665f
mov eax, esi
jmp 0x18006661
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x180081dd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call fcn.18008ea9
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], edi
cmp dword [esi - 0xc], 0
je 0x180082c9
push esi
push 1
push str.EnableLogging
push str.LoggingSettings
call edi
push esi
push 1
test eax, eax
push str.ShowTime
setne al
push str.LoggingSettings
mov byte [ebx + 0x74], al
call edi
push esi
push 1
test eax, eax
push str.LogToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x76], al
call edi
push esi
push 0
test eax, eax
push str.LogToOutputDebug
setne al
push str.LoggingSettings
mov byte [ebx + 0x77], al
call edi
push esi
push 1
test eax, eax
push str.AppendToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x7c], al
call edi
test eax, eax
lea edi, [ebx + 0x78]
setne al
xor ecx, ecx
mov byte [ebx + 0x7d], al
inc ecx
mov edx, dword [edi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x180082a2
push 0x104
mov ecx, edi
call fcn.18006f9e
mov edx, dword [edi]
push esi
push 0x104
push edx
push str.MicrosoftEdgeUpdate.log
push str.LogFilePath
push str.LoggingSettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.18009cb5
jmp 0x180082f4
push str.MicrosoftEdgeUpdate.log
mov byte [ebx + 0x74], 1
mov byte [ebx + 0x76], 1
mov word [ebx + 0x7c], 0x100
call fcn.18165959
pop ecx
push eax
push str.MicrosoftEdgeUpdate.log
lea ecx, [ebx + 0x78]
call fcn.18006e93
mov byte [ebx + 0x77], 1
cmp byte [ebx + 0x75], 0
je 0x180082fe
mov byte [ebx + 0x76], 1
mov esi, dword [ebp - 8]
xor eax, eax
mov byte [ebx], 1
mov dword [ebx + 4], 7
mov dword [ebp - 4], eax
mov ecx, dword [eax + 0x1820fff0]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x18008372
mov ecx, dword [eax + 0x1820fff4]
mov dword [ebp - 0x14], ecx
cmp ecx, 9
ja 0x18008372
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 3
push eax
mov ecx, ebx
call fcn.18008ea9
mov edi, dword [ebp - 8]
cmp dword [edi - 0xc], 0
je 0x18008355
push edi
push 3
push dword [ebp - 0xc]
push str.LoggingLevel
call esi
jmp 0x18008358
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
test eax, eax
setne cl
mov byte [ebx + edx*8], cl
lea ecx, [edi - 0x10]
mov dword [ebx + edx*8 + 4], eax
call fcn.1800687d
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
cmp eax, 0x48
jb 0x18008310
call fcn.1800fb26
mov ecx, dword [ebp - 0x18]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], edx
lea ecx, [ecx - 0x10]
call fcn.1800687d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1800839e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea ecx, [ebp - 4]
call fcn.18009c8e
mov edi, dword [ebp - 4]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or ecx, eax
jge 0x180083d1
push edx
lea ecx, [ebp - 4]
call fcn.18006f9e
mov edi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.18009c8e
call fcn.18014160
test al, al
jne 0x180083f4
call fcn.180126a9
test al, al
jne 0x180083f4
push 0x1c
mov esi, 0x181db830
jmp 0x180083fb
push 0x23
mov esi, str.MicrosoftEdgeUpdateLog
pop ebx
push esi
call fcn.18165959
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.18006e93
push edi
xor eax, eax
push eax
push eax
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x18008450
mov ecx, dword [ebp + 8]
push 0x181b72bc
call fcn.18006d98
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800687d
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.18009cb5
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800687d
mov eax, dword [ebp + 8]
jmp 0x180084a3
mov esi, dword [ebp - 8]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x18008471
mov ecx, dword [ebp + 8]
push 0x181b72bc
call fcn.18006d98
lea ecx, [esi - 0x10]
jmp 0x18008431
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18009e91
mov edi, dword [ebp + 8]
lea ecx, [esi - 0x10]
add eax, 0x10
mov dword [edi], eax
call fcn.1800687d
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.18009cb5
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800687d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x180085c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp byte [ebx + 0x77], 0
je 0x1800868d
mov eax, dword [ebx + 0xd8]
push esi
push edi
test eax, eax
jne 0x18008683
lea eax, [ebp - 4]
push eax
call fcn.180084aa
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
je 0x18008624
lea edx, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.1801396f
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.1800e6f7
test al, al
jne 0x1800862e
mov ecx, edi
call fcn.1800bb9e
test eax, eax
jns 0x1800862e
lea ecx, [edi - 0x10]
call fcn.1800687d
lea ecx, [esi - 0x10]
call fcn.1800687d
jmp 0x1800868b
mov al, byte [ebx + 0x7d]
push 0x20
mov byte [ebp - 8], al
call fcn.1814d7d1
pop ecx
push dword [ebp - 8]
mov ecx, eax
push esi
call fcn.18009037
mov dword [ebx + 0xd8], eax
test eax, eax
jne 0x18008669
push esi
push dword [ebx + 0x54]
push str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
call fcn.1800f20c
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi - 0x10]
call fcn.1800687d
lea ecx, [esi - 0x10]
call fcn.1800687d
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x1800868b
push eax
mov ecx, ebx
call fcn.18008e1a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18008b24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
test esi, esi
je 0x18008c38
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x18008b4a
cmp dword [ebp + 0x10], 2
jg 0x18008c38
cmp dword [edi + 0xf8], 3
jg 0x18008c38
lea ecx, [ebp + 8]
call fcn.18009c8e
lea ecx, [ebp + 0x14]
call fcn.18009c8e
mov dword [ebp - 4], 1
lea ecx, [edi + 0x58]
mov eax, dword [ecx]
add dword [edi + 0xe8], 1
push 0
adc dword [edi + 0xec], 0
mov eax, dword [eax + 0xc]
call eax
test al, al
jne 0x18008bf9
add dword [edi + 0xf0], 1
push 0x32
adc dword [edi + 0xf4], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
lea ecx, [edi + 0x58]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x14
jle 0x18008b71
push str.LOG_SYSTEM:_Couldnt_acquire_lock__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x181dbad0
call esi
inc dword [edi + 0xf8]
cmp dword [edi + 0xf8], 3
jle 0x18008c22
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
mov ecx, edi
push str.LOG_SYSTEM:_Couldnt_acquire_lock_after_max_retries__this_process_will_no_longer_log_
push eax
lea eax, [ebp + 8]
push eax
push 0xfffffffffffffffe
push 0
push ebx
call fcn.18008a50
jmp 0x18008c22
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
mov ecx, edi
push esi
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.18008a50
lea ecx, [edi + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
and dword [edi + 0xf8], 0
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1800687d
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x18009037
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
push edi
lea ecx, [ebx + 0xc]
mov dword [ebx], fcn.180091e3
mov dword [ebx + 4], 0x989680
mov word [ebx + 8], 0
mov byte [ebx + 0xa], al
mov byte [ebx + 0xb], 1
call fcn.18009c8e
push dword [ebp + 8]
xor edi, edi
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x10], edi
call fcn.18006d98
lea ecx, [ebx + 0x1c]
mov dword [ebx + 0x18], edi
call fcn.18009c8e
movzx eax, byte [0x18217983]
neg eax
sbb eax, eax
and eax, 0x18217880
mov dword [ebp + 8], eax
je 0x180090ff
push esi
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.18008ea9
mov esi, dword [ebp + 0xc]
cmp dword [esi - 0xc], edi
je 0x180090da
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x989680
push str.MaxLogFileSize
push str.LoggingSettings
call edi
mov dword [ebx + 4], eax
xor eax, eax
push esi
inc eax
push eax
push str.LogFileWide
push str.LoggingSettings
call edi
test eax, eax
setne al
jmp 0x180090e4
xor eax, eax
mov dword [ebx + 4], 0x989680
inc eax
mov byte [ebx + 0xb], al
lea ecx, [ebx + 0x1c]
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.18009c40
lea ecx, [esi - 0x10]
call fcn.1800687d
pop esi
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x18009160
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x180091e1
mov byte [esi + 8], 1
call fcn.1800920f
cmp dword [esi + 0x10], 0
je 0x180091e1
test al, al
je 0x18009180
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.180098d6
test al, al
jne 0x180091a7
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800f20c
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.18009438
cmp dword [esi + 0x18], 0
jne 0x180091ce
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800f20c
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x180091e1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
ret

Function at 0x18009438
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea edx, [ebp - 0x6c]
push edi
xor edi, edi
mov dword [ebp - 0x6c], edi
mov ecx, dword [esi + 0x14]
call fcn.1800ed7e
mov eax, dword [ebp - 0x6c]
cmp eax, dword [esi + 4]
jbe 0x1800946f
mov ecx, esi
call fcn.180095a5
xor eax, eax
cmp byte [esi + 0xa], al
push edi
setne al
push 0x80
lea eax, [eax*2 + 2]
push eax
push edi
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x180094a8
mov dword [esi + 0x18], edi
xor al, al
jmp 0x1800953d
lea ecx, [ebp - 0x8c]
call fcn.18007747
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x68]
push 0x181db50c
push eax
call fcn.180073cc
add esp, 0x14
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x8c]
push edi
push 0xc0010000
push eax
call fcn.180077b4
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.1800749d
test bl, bl
je 0x18009505
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x8c]
xor edx, edx
push eax
inc edx
call fcn.18007cd2
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18009530
cmp byte [esi + 0xb], 0
je 0x18009530
push edi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push ecx
push 2
push 0x181b8648
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x8c]
call fcn.1800778d
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret

Function at 0x1800954c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x1800957c
xor al, al
jmp 0x180095a0
cmp byte [esi + 0xb], bl
je 0x18009597
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x181b8648
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18009610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x70], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800973b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x74]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x1800973b
cmp dword [ebp - 0x78], esi
jne 0x1800973b
push dword [ebp - 0x6c]
call fcn.1814d801
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
mov dword [ebp - 0x7c], esi
call fcn.181620e0
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x18009730
mov edi, dword [ebp - 0x6c]
shr edi, 1
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x18009730
cmp word [esi + edi*2 - 4], bx
jne 0x18009730
cmp word [esi + edi*2 - 2], bx
jne 0x18009730
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x70]
add eax, 0x14
mov edx, 0x181dbedc
push eax
call fcn.180099f2
mov esi, dword [ebp - 0x70]
pop ecx
test edi, edi
je 0x1800971c
mov eax, dword [ebp - 0x7c]
push esi
lea eax, [eax + ebx*2]
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800971f
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc ebx
add ebx, eax
cmp ebx, edi
jb 0x180096f7
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [esi - 0x10]
setne bl
call fcn.1800687d
mov esi, dword [ebp - 0x7c]
push esi
call fcn.1814d7cc
pop ecx
mov al, bl
jmp 0x1800973d
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret

Function at 0x180098d6
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180098e3
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1800991c
cmp eax, 0x80
je 0x1800991c
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800f20c
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x180098df
mov al, 1
pop esi
ret
Function at 0x1800a418
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x1800a44e
lea esi, [edi + 4]
test esi, esi
je 0x1800a44e
call fcn.1800756f
test al, al
je 0x1800a44e
mov ecx, edi
call fcn.1800756f
test al, al
je 0x1800a44e
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x1800a450
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x1800bb9e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
call fcn.18009c8e
mov eax, dword [ebp - 4]
xor esi, esi
inc esi
mov ecx, 0x104
mov edx, dword [eax - 8]
sub esi, dword [eax - 4]
sub edx, ecx
or esi, edx
jge 0x1800bbd2
push ecx
lea ecx, [ebp - 4]
call fcn.18006f9e
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov esi, eax
call fcn.18009cb5
test esi, esi
jne 0x1800bbf4
mov edi, 0x80004005
jmp 0x1800bc98
push ebx
push ecx
push ecx
lea ecx, [ebp - 4]
call fcn.1800dd9f
push 0
push 0x5c
lea ecx, [ebp - 4]
call fcn.1800dc02
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1800bc1a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx - 0xc]
jmp 0x1800bc1c
mov eax, ebx
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.1800db06
mov esi, dword [ebp - 8]
mov ecx, esi
call fcn.1800e733
test al, al
jne 0x1800bc57
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800bc57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.1800e733
test al, al
je 0x1800bc76
cmp ebx, 0xffffffff
je 0x1800bc8d
lea eax, [ebx + 1]
push eax
push 0x5c
lea ecx, [ebp - 4]
call fcn.1800dc02
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.1800687d
jmp 0x1800bc0d
test edi, edi
jle 0x1800bc83
movzx edi, di
or edi, 0x80070000
lea ecx, [esi - 0x10]
call fcn.1800687d
jmp 0x1800bc97
lea ecx, [esi - 0x10]
call fcn.1800687d
xor edi, edi
pop ebx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800687d
mov eax, edi
pop edi
pop esi
leave
ret