joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001930
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x64
push esi
lea eax, [esp + 0xc]
push eax
call fcn.100016e0
test eax, eax
je 0x100019cd
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.10013d00
mov edx, dword [esp + 0x18]
add esp, 0xc
push 1
push edx
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x34], str.winsta0default
mov dword [esp + 0x14], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x100019cd
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push 0
push eax
push 0x420
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
test esi, esi
je 0x100019cd
push str.CreateProcessAsUser_ok__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
pop esi
add esp, 0x64
ret 4
xor eax, eax
pop esi
add esp, 0x64
ret 4
Function at 0x10003490
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x3f4
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x3f0], eax
mov dword [esp + 4], 0
mov dword [esp], 0
xor eax, eax
jmp 0x100034c0
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServices_]
mov word [esp + eax + 8], cx
add eax, 2
test cx, cx
jne 0x100034c0
push esi
push edi
lea edi, [esp + 0x10]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100034e0
lea eax, [esp + 8]
push eax
push 0xf003f
mov ecx, 0xb
mov esi, str.PeopleCalendarService
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop edi
pop esi
jne 0x1000358c
mov edx, dword [esp]
push str.Parameters
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp]
lea eax, [esp + 4]
push eax
push str.Parameters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [0x10039e00]
push 0x3e8
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003560
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push 2
push 0
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.10010273
add esp, 0x3f4
ret

Function at 0x100035b0
Capabilities:
Start service

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push edi
push eax
call sym.Hao123SP.dll_InstallService
add esp, 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x10003601
push esi
push 0xf003f
push str.PeopleCalendarService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10003600
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call ebx
pop esi
push edi
call ebx
pop edi
pop ebx
ret

Function at 0x10003610
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1000362e
pop edi
add esp, 0x1c
ret
push esi
push 0x10020
push str.PeopleCalendarService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x10003655
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
push ebx
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
pop ebx
pop esi
setne al
pop edi
add esp, 0x1c
ret
Function at 0x100049b0
Capabilities:
Check for time delay via queryperformancecounter
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push ebx
push edi
call fcn.10007400
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
call ebx
mov ecx, dword [esp + 0x14]
mov dword [esi + 8], ecx
call fcn.10007360
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x30
mov dword [esi + 0xc], eax
call ebx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x20]
push ecx
push eax
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x30]
push edx
push eax
call edi
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x34]
push edx
push 0
push 0x30
mov dword [esi + 0x10], ecx
call ebx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x10]
push ecx
push eax
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push eax
call edi
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x34]
push edx
push 0
push 0x30
mov dword [esi + 0x14], ecx
call ebx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x10]
push ecx
push eax
call edi
lea edx, [esp + 0x20]
push edx
push ebx
call edi
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edx, [esi + 0x110]
push edx
mov dword [esi + 0x18], eax
mov dword [esi + 4], ecx
call edi
lea eax, [esi + 0x128]
push eax
call edi
lea ecx, [esi + 0x118]
push ecx
call edi
lea edx, [esi + 0x158]
push edx
call edi
lea eax, [esi + 0x138]
push eax
call edi
lea ecx, [esi + 0x148]
push ecx
call edi
mov edx, dword [0x10039e04]
pop edi
mov dword [esi + 0x100], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004b00
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x54], 8
jb 0x10004b22
mov eax, dword [esi + 0x40]
jmp 0x10004b25
lea eax, [esi + 0x40]
push str.Config
push eax
lea eax, [esp + 0xc]
push str._s_s_
push eax
call fcn.1000fe42
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004b55
lea eax, [esp + 4]
call fcn.10006630
lea eax, [esp + 4]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10004b60
mov edx, dword [str.Config.ini]
mov ecx, dword [0x1002ca48]
mov dword [eax], edx
mov edx, dword [0x1002ca4c]
mov dword [eax + 4], ecx
mov ecx, dword [0x1002ca50]
mov dword [eax + 8], edx
mov edx, dword [0x1002ca54]
mov dword [eax + 0xc], ecx
mov cx, word [0x1002ca58]
mov dword [eax + 0x10], edx
mov word [eax + 0x14], cx
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004bb0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
add esi, 0x58
call fcn.10002300
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.10010273
add esp, 0x20c
ret

Function at 0x10004bf0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x54], 8
jb 0x10004c12
mov eax, dword [esi + 0x40]
jmp 0x10004c15
lea eax, [esi + 0x40]
push str.Config
push eax
lea eax, [esp + 0xc]
push str._s_s_
push eax
call fcn.1000fe42
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004c45
lea eax, [esp + 4]
call fcn.10006630
lea eax, [esp + 4]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10004c50
mov edx, dword [str.Related.ini]
mov ecx, dword [0x1002ca60]
mov dword [eax], edx
mov edx, dword [0x1002ca64]
mov dword [eax + 4], ecx
mov ecx, dword [0x1002ca68]
mov dword [eax + 8], edx
mov edx, dword [0x1002ca6c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x1002ca70]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
lea eax, [esp + 4]
lea edx, [eax + 2]
jmp 0x10004ca0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004ca0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
add esi, 0xac
call fcn.10002300
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.10010273
add esp, 0x20c
ret
Function at 0x100058e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x11c
lea eax, [esp + 4]
push 0
push eax
call fcn.10013d00
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x10005952
mov eax, dword [esp + 8]
test eax, eax
je 0x1000592e
cmp eax, 1
jne 0x10005952
cmp byte [esp + 0x11a], 1
jne 0x10005952
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.10010273
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
xor eax, eax
call fcn.10010273
add esp, 0x120
ret

Function at 0x10005970
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x18
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push esi
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x100059a9
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10010273
add esp, 0x18
ret 4
lea eax, [esp + 8]
push eax
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea ecx, [esp + 4]
push ecx
push 0
push 0x400
lea edx, [esp + 0x14]
push edx
call esi
test eax, eax
jl 0x10005995
mov eax, dword [esp + 4]
mov edx, edi
sub edx, eax
jmp 0x100059e0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100059e0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x18]
test eax, eax
setne al
pop esi
xor ecx, esp
call fcn.10010273
add esp, 0x18
ret 4

Function at 0x10005a10
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push edi
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10005a30
push eax
mov edi, ebx
call fcn.10005970
test al, al
je 0x10005a30
mov al, 1
pop edi
ret
push 0x104
push ebx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x10005a75
mov edi, ebx
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005a50
push esi
mov ecx, 9
mov esi, str.AppDataLocalLow
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
jne 0x10005a2c
xor al, al
pop edi
ret
Function at 0x10005a80
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.10013d00
add esp, 0xc
lea ebx, [esp + 0xc]
call fcn.10005a10
test al, al
jne 0x10005af5
push 0
push 0x1a
mov ecx, ebx
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005ae0
sub eax, edx
sar eax, 1
je 0x10005b8f
push esi
push edi
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005b00
mov edx, dword [0x1002c9dc]
mov dword [edi], edx
lea edi, [esp + 0x14]
add edi, 0xfffffffe
jmp 0x10005b20
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005b20
mov ecx, 7
mov esi, str.PeopleCalendar
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005b41
mov dword [edi], edx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005b67
lea eax, [esp + 0x14]
call fcn.10006630
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005b70
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
push eax
lea esi, [ebp + 0x3c]
call fcn.10002300
pop edi
pop esi
mov ecx, dword [esp + 0x214]
pop ebp
pop ebx
xor ecx, esp
call fcn.10010273
add esp, 0x210
ret 4
Function at 0x10005bb0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.10013d00
add esp, 0xc
lea ebx, [esp + 0xc]
call fcn.10005a10
test al, al
jne 0x10005c25
push 0
push 0x1a
mov ecx, ebx
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005c10
sub eax, edx
sar eax, 1
je 0x10005cbf
push esi
push edi
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005c30
mov edx, dword [0x1002c9dc]
mov dword [edi], edx
lea edi, [esp + 0x14]
add edi, 0xfffffffe
jmp 0x10005c50
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005c50
mov ecx, 0xa
mov esi, str.PeopleCalendar.users
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005c71
mov dword [edi], edx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005c97
lea eax, [esp + 0x14]
call fcn.10006630
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005ca0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
push eax
lea esi, [ebp + 0x20]
call fcn.10002300
pop edi
pop esi
mov ecx, dword [esp + 0x214]
pop ebp
pop ebx
xor ecx, esp
call fcn.10010273
add esp, 0x210
ret 4
Function at 0x10005ce0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x620
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x61c], eax
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.10013d00
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.SOFTWARE_]
mov word [esp + eax + 4], cx
add eax, 2
test cx, cx
jne 0x10005d11
push esi
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005d30
mov ecx, 7
mov esi, str.PeopleCalendar
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 8
cmp dword [ebx + 0x54], esi
jb 0x10005d59
mov ecx, dword [ebx + 0x40]
jmp 0x10005d5c
lea ecx, [ebx + 0x40]
lea edx, [esp + 0x214]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10005d63
cmp dword [ebx + 0x38], esi
jb 0x10005d7e
mov ecx, dword [ebx + 0x24]
jmp 0x10005d81
lea ecx, [ebx + 0x24]
lea edx, [esp + 0x41c]
jmp 0x10005d90
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10005d90
lea ecx, [esp + 8]
push ecx
push 2
push 0
lea edx, [esp + 0x18]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005dfe
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, [esp + 0x218]
push eax
push 1
push 0
push str.CfgRootPath
push ecx
call esi
mov eax, dword [esp + 8]
push 0x104
lea edx, [esp + 0x420]
push edx
push 1
push 0
push str.CfgUserPath
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x624]
pop edi
pop esi
xor ecx, esp
call fcn.10010273
add esp, 0x620
ret

Function at 0x100063c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100063d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10006414
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10006410
lea ebx, [ebx]
cmp esi, eax
jae 0x10006414
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10006400
cmp esi, eax
jb 0x1000641a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x10006630
Capabilities:
Check if file exists
Create directory

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006640
sub eax, edx
sar eax, 1
mov ebp, eax
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100074c1
mov esi, eax
mov edx, esi
add esp, 4
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10006675
xor edi, edi
test ebp, ebp
mov byte [esp + 0xf], 1
jl 0x100066dd
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x100066bc
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x100066b6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100066d7
mov word [esi + edi*2], 0x5c
add edi, 1
cmp edi, ebp
jle 0x10006696
pop ebx
push esi
call fcn.100074bc
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
mov byte [esp + 0x13], 0
pop ebx
push esi
call fcn.100074bc
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x10006770
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x640
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x63c], eax
push esi
mov esi, ecx
test esi, esi
jne 0x100067a3
xor eax, eax
pop esi
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.10010273
add esp, 0x640
ret
push 0x206
lea eax, [esp + 0x43e]
push 0
push eax
mov word [esp + 0x444], 0
call fcn.10013d00
push 0x206
lea ecx, [esp + 0x242]
push 0
push ecx
mov word [esp + 0x248], 0
call fcn.10013d00
lea edx, [esp + 0x450]
add esp, 0x18
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100067f0
lea edx, [esp + 0x438]
push ebx
push edx
call fcn.1001162f
push 0x228
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.10013d00
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100068dc
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100068d5
lea ebx, [ebx]
xor eax, eax
jmp 0x10006870
movzx ecx, word [esp + eax + 0x2c]
mov word [esp + eax + 0x234], cx
add eax, 2
test cx, cx
jne 0x10006870
lea edx, [esp + 0x234]
push edx
call fcn.1001162f
add esp, 4
mov ecx, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100068bd
test dx, dx
je 0x100068b9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100068bd
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006897
xor eax, eax
jmp 0x100068c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100068f5
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10006860
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.10010273
add esp, 0x640
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x644]
mov eax, dword [esp + 0x10]
pop ebx
pop esi
xor ecx, esp
call fcn.10010273
add esp, 0x640
ret
Function at 0x10006920
Capabilities:
Check if file exists
Write file on windows

Disassembly:
sub esp, 0xc14
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0xc10], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x21e]
push ebx
push eax
mov word [esp + 0x224], bx
call fcn.10013d00
add esp, 0xc
xor eax, eax
jmp 0x10006960
movzx ecx, word [eax + str.C:log_]
mov word [esp + eax + 0x218], cx
add eax, 2
cmp cx, bx
jne 0x10006960
push 0x3e6
lea ecx, [esp + 0x836]
push ebx
push ecx
mov word [esp + 0x83c], bx
call fcn.10013d00
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x430]
push 0x1002c334
push eax
call fcn.1000fe42
push 0x206
lea ecx, [esp + 0x646]
push ebx
push ecx
mov word [esp + 0x64c], bx
call fcn.10013d00
push 0x206
lea edx, [esp + 0x3a]
push ebx
push edx
mov word [esp + 0x40], bx
call fcn.10013d00
add esp, 0x30
push 0x104
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.10010682
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 8
lea edx, [esp + 0x420]
push edx
mov word [eax], bx
call esi
test eax, eax
je 0x10006b5a
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10006a21
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x12]
lea edx, [esp + 0x628]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x10006a40
push edi
lea eax, [esp + 0x62c]
push eax
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x42c]
push str._s_s.txt
push edx
call fcn.1000fe42
mov ecx, dword [esp + 0xc34]
lea eax, [esp + 0xc38]
push eax
push ecx
lea edx, [esp + 0x84c]
push 0x1f3
push edx
call fcn.10010e7f
add esp, 0x20
lea eax, [esp + 0x424]
push eax
mov word [esp + 0xc1e], bx
xor edi, edi
call esi
test eax, eax
je 0x10006ab4
mov edi, 1
lea ecx, [esp + 0x424]
push 0x1002e32c
push ecx
call fcn.10010f60
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x10006b59
cmp edi, ebx
jne 0x10006af1
push esi
push 2
lea edx, [esp + 0x18]
push 1
push edx
mov dword [esp + 0x20], 0xfeff
call fcn.100110d2
add esp, 0x10
lea eax, [esp + 0x834]
lea edx, [eax + 2]
jmp 0x10006b00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10006b00
sub eax, edx
sar eax, 1
push esi
add eax, eax
push eax
lea ecx, [esp + 0x83c]
push 1
push ecx
call fcn.100110d2
push esi
push 2
lea edx, [esp + 0x24]
push 1
push edx
mov dword [esp + 0x2c], 0xd
call fcn.100110d2
push esi
push 2
lea eax, [esp + 0x34]
push 1
push eax
mov dword [esp + 0x3c], 0xa
call fcn.100110d2
push esi
call fcn.10010606
add esp, 0x34
pop edi
mov ecx, dword [esp + 0xc18]
pop esi
pop ebx
xor ecx, esp
call fcn.10010273
add esp, 0xc14
ret