joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10073fc9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a04fc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov dword [esp + 4], 0
lea eax, [ecx - 0x28]
mov dword [esp + 0x28], 0x10088520
mov dword [esp + 0x30], vtable.boost::exception_detail::clone_base.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0
mov dword [esp + 8], 1
call fcn.1006daa0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.2.0
mov dword [esp + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.0
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
push 0x1008e8c8
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x44], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
int3
sub ecx, dword [ecx - 4]
jmp 0x1006e7e0

Function at 0x1006e880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10073fc9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a04fc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov dword [esp + 4], 0
lea eax, [ecx - 0x28]
mov dword [esp + 0x28], 0x10088520
mov dword [esp + 0x30], vtable.boost::exception_detail::clone_base.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0
mov dword [esp + 8], 1
call fcn.1006db70
mov eax, dword [esp + 0x28]
mov dword [esp + 8], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.2.0
mov dword [esp + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.0
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
push 0x1008e92c
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x44], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
int3
sub ecx, dword [ecx - 4]
jmp 0x1006e880
Function at 0x1006e920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10073fc9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a04fc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov dword [esp + 4], 0
lea eax, [ecx - 0x28]
mov dword [esp + 0x28], 0x10088520
mov dword [esp + 0x30], vtable.boost::exception_detail::clone_base.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0
mov dword [esp + 8], 1
call fcn.1006dc20
mov eax, dword [esp + 0x28]
mov dword [esp + 8], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.2.0
mov dword [esp + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.0
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
push 0x1008ea18
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x44], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
int3
sub ecx, dword [ecx - 4]
jmp 0x1006e920

Function at 0x1006f450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10073fc9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a04fc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov dword [esp + 4], 0
lea eax, [ecx - 0x28]
mov dword [esp + 0x28], 0x10088520
mov dword [esp + 0x30], vtable.boost::exception_detail::clone_base.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0
mov dword [esp + 8], 1
call fcn.1006e3a0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.2.0
mov dword [esp + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.0
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
push 0x1008eb9c
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x44], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
int3
sub ecx, dword [ecx - 4]
jmp 0x1006f450
Function at 0x10070650
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x10074438
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100a04fc]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
push edi
mov eax, dword [0x100a04fc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
lea ecx, [eax + 0x28]
push ecx
push 4
push eax
push 0x10070560
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov ebp, eax
add esp, 0x18
test ebp, ebp
jne 0x100706f4
call fcn.10071560
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov esi, eax
lea edi, [ebp + 0xb]
mov dword [esp + 0x14], str.boost::thread_resource_error
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebp
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x54], ebp
call fcn.1004e890
mov ecx, dword [esi]
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10070717
cmp eax, 0xffffffff
je 0x10070717
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebp
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1007236c
add esp, 0x44
ret
Function at 0x1007236c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a04fc]
jne 0x10072376
repz ret
jmp fcn.10072b55

Function at 0x10af5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10af51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10af507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10af506a
add dl, dl
jne 0x10af5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10af50dc
xor eax, eax
add dl, dl
jne 0x10af5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10af517d
add dl, dl
jne 0x10af50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10af50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10af50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10af50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10af50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10af5075
mov eax, 1
add dl, dl
jne 0x10af50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10af50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10af50e1
sub eax, ebx
mov ebx, 1
jne 0x10af5128
mov ecx, 1
add dl, dl
jne 0x10af510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10af5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10af5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10af5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10af513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10af514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10af5136
cmp eax, 0x7d00
jae 0x10af516d
cmp eax, 0x500
jb 0x10af5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10af5075
cmp eax, 0x7f
ja 0x10af5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10af5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10af519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10af5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401580
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4015ba
mov eax, 0
jmp 0x401695
mov dword [ebp - 0x13c], 0x128
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
je 0x401684
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x13c]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401661
mov dword [ebp - 0xc], 1
mov eax, dword [0x40e024]
cmp eax, 1
jne 0x401683
mov eax, dword [ebp - 0x134]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401683
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401683
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x4015e4
jmp 0x401684
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401697
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1828
call fcn.004024f0
sub esp, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._void__System.Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms____void__System.Reflection.Assembly_::LoadWithPartialName_System.Drawing____notification__New_Object_System.Windows.Forms.NotifyIcon___notification.Icon___System.Drawing.SystemIcons_::Information___notification.BalloonTipIcon___System.Windows.Forms.ToolTipIcon_::Info___notification.BalloonTipTitle___s___notification.BalloonTipText___s___notification.Visible___true___notification.ShowBalloonTip_3000___Start_Sleep__Seconds_3___notification.Visible___false_
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x808]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.powershell__WindowStyle_Hidden__Command___s_
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1808]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x1808]
mov dword [esp], eax
call sym._system
nop
leave
ret
Function at 0x40170b
Capabilities:
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], 0
jmp 0x401807
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x40a020]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401803
add dword [ebp - 0x14], 1
mov dword [esp + 4], str..exe
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Join
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x40a020]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._Join
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 1
jne 0x401792
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._EndProcess
cmp dword [ebp - 0x1c], 0
je 0x4017ed
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._stat
test eax, eax
jne 0x4017ed
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x40a020]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._Join
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4017e2
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._rename
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x401724
cmp dword [ebp + 0x10], 0
jne 0x401870
mov dword [esp], 0x3e8
call sym._Sleep_4
sub esp, 4
mov eax, dword [str.C:Program_Files__x86_RazerRazer_ServicesRazer_CentralRazer_Central]
mov dword [esp + 4], str..exe
mov dword [esp], eax
call sym._Join
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
nop
leave
ret
Function at 0x401fb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e04c
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e044]
sub esp, 4
test ebx, ebx
je 0x401ffb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401ff4
test esi, esi
je 0x401ff4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fd0
mov dword [esp], 0x40e04c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4021e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402308
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40226e
cmp eax, 4
jne 0x402290
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40227e
cmp edx, 4
je 0x40227e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004021e0
Function at 0x438c77
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
sub edx, eax
sub edx, eax
or eax, eax
call fcn.00438cae
mov edx, 0x8140a45f
add eax, edx
xor dword [esi], ebx
add edx, 0x5d7794c2
inc esi
mov eax, 0xb9e4fd92
dec edx
cmp esi, ecx
jne fcn.00438c77
add eax, 1
and eax, eax
mov edx, edx
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x10009f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ee630
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
push edi
mov eax, dword [0x1028dc74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10288004]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.100182e0
push 0x1026a088
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.10018710
mov byte [ebp - 4], 5
or edi, 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x10009f9e
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10009f9e
push ecx
call fcn.1002139c
add esp, 4
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.10001810
xor ecx, ecx
call fcn.100187d0
add esp, 4
test al, al
je 0x10009fcd
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.10001590
jmp 0x1000a058
mov eax, dword [0x10288004]
push ecx
mov esi, esp
push 0x44
mov dword [esi], eax
call fcn.100213a1
add esp, 4
test eax, eax
je 0x1000a014
mov dword [eax], 1
xor ecx, ecx
mov dword [eax + 4], 0x1b
mov dword [eax + 8], 0x1b
mov word [eax + 0x42], cx
add eax, 0xc
push 0x36
push str.C:WindowsSystem32cmd.exe
push eax
mov dword [esi], eax
call fcn.101a6860
add esp, 0xc
xor ecx, ecx
call fcn.100187d0
add esp, 4
test al, al
je 0x1000a029
push str.C:WindowsSystem32cmd.exe
jmp 0x1000a050
push ecx
mov ecx, esp
push str.C:WindowsSysWOW64cmd.exe
call fcn.10001380
xor ecx, ecx
call fcn.100187d0
add esp, 4
test al, al
je 0x1000a04b
push str.C:WindowsSysWOW64cmd.exe
jmp 0x1000a050
push str.cmd.exe
lea ecx, [ebp - 0x14]
call fcn.10001780
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
push eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x1000a0e2
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1000a0e2
push ecx
call fcn.1002139c
add esp, 4
add esi, 0xfffffff4
mov byte [ebp - 4], 7
cmp esi, dword [section..data]
je 0x1000a105
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x1000a105
push esi
call fcn.1002139c
add esp, 4
mov dword [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
cmp eax, dword [section..data]
je 0x1000a12c
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1000a12c
push eax
call fcn.1002139c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101eea70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1028dc74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x774]
lea edx, [ebp - 0x10]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea ecx, [edi + 0x7e0]
mov dword [ebp - 4], 0
call fcn.10001590
mov dword [ebp - 4], 1
or esi, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x1000d09a
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1000d09a
push ecx
call fcn.1002139c
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x14]
mov ecx, dword [edi + 0x774]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea ecx, [edi + 0x7e0]
mov dword [ebp - 4], 2
call fcn.10001590
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
cmp eax, dword [section..data]
je 0x1000d0ec
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1000d0ec
push eax
call fcn.1002139c
add esp, 4
lea eax, [edi + 0x3a4]
mov dword [ebp - 4], 0xffffffff
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [0x102aeb7c]
test ecx, ecx
je 0x1000d112
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x102aeb78]
test ecx, ecx
je 0x1000d122
push ecx
call fcn.1000d140
call dword [sym.imp.ole32.dll_OleUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]