joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d7e3
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov bh, 1
and dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
add eax, 0x3a98
mov dword [ebp - 8], eax
jmp 0x1005d862
mov eax, dword [ebp + 0xc]
cmp dword [esi + 4], eax
je 0x1005d888
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 8], eax
jb 0x1005d87b
test bh, bh
je 0x1005d823
mov edi, dword [esi + 4]
xor bh, bh
jmp 0x1005d835
cmp edi, dword [esi + 4]
je 0x1005d82d
mov edi, dword [esi + 4]
jmp 0x1005d835
mov eax, dword [ebp - 4]
cmp dword [esi + 0x14], eax
jb 0x1005d877
mov eax, dword [esi + 0x14]
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x18]
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x1005d850
mov eax, ecx
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1005d85b
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne bl
test bl, bl
jne 0x1005d805
jmp 0x1005d888
xor bl, bl
jmp 0x1005d888
push 0x5b4
xor bl, bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100609af
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af0a5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x100c5014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ebx, [esi + 8]
mov dword [esi], 0x1001f514
push dword [ebx]
lea ecx, [ebp - 0x1c]
call fcn.1006f372
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x1002152c
test eax, eax
je 0x10060a19
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.1008dd1a
push eax
push edi
mov ecx, ebx
call fcn.1008dc8f
lea ebx, [esi + 0xc]
push dword [ebx]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], ebx
call fcn.1006f372
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10060b04
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10060b04
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [eax - 0xc]
lea eax, [esi + 1]
push eax
call fcn.1008dea9
mov edx, eax
lea edi, [ebp - 0x3c]
xor eax, eax
push 6
pop ecx
mov word [edx + esi*2 + 2], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x414
and dword [ebp - 0x40], 0
and dword [ebp - 0x34], 0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.1008db88
test esi, esi
je 0x10060aec
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008df96
push esi
push dword [ebx]
lea eax, [ebp - 0x14]
push 0x10015448
push eax
call fcn.1008dbf3
mov ebx, dword [ebp - 0x18]
add esp, 0x10
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebx + 4]
push esi
push 1
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x100cf608]
mov ecx, ebx
call edi
lea ecx, [esi - 0x10]
call fcn.1008e3f5
mov ebx, dword [ebp - 0x20]
mov esi, 0x1002152c
mov ecx, esi
call fcn.1008dd1a
push eax
push esi
mov ecx, ebx
call fcn.1008dc8f
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.1008e3f5
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.1008e3f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10060b70
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x100af0d8
call fcn.100a4ea8
push dword [ecx + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1006f372
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
and dword [ebp - 4], 0
push dword [eax]
call fcn.1006f372
xor ebx, ebx
lea ecx, [ebp - 0x14]
inc ebx
mov byte [ebp - 4], bl
call fcn.1006e6e0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.1006e80f
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10060be9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e35d
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.1006f1e0
lea ecx, [esi - 0x10]
call fcn.1008e3f5
jmp 0x10060bf3
mov ecx, dword [ebp + 0xc]
call fcn.1008dc07
xor bl, bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.1008e3f5
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1008e3f5
mov al, bl
call fcn.100a4e71
ret 8
Function at 0x10061388
Capabilities:
Initialize winhttp library
Prepare http request
Read http header
Receive http response

Disassembly:
push 0x18
mov eax, 0x100af234
call fcn.100a4ea8
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10015810
mov bh, al
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
test eax, eax
je 0x10061529
push 0
push 0x50
lea ecx, [ebp + 0x4a]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, eax
lea ecx, [ebp - 0x24]
lea eax, [ebp + 0x1452]
push eax
call fcn.1006f372
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp + 0x450]
push eax
lea ecx, [ebp - 0x20]
call fcn.1006f372
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1006e9ea
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
test edi, edi
je 0x1006151e
push 0x100
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x1c]
push 0x10015850
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x1006151e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
setne bh
test bh, bh
je 0x1006151e
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne bh
test bh, bh
je 0x1006151e
push 0x32
xor bh, bh
call fcn.10090eed
pop ecx
push 0
mov edi, eax
mov dword [ebp - 0x10], 0x32
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push edi
push 0
push 0x13
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
lea ecx, [ebp - 0x18]
push edi
setne bl
call fcn.1006f372
mov byte [ebp - 4], 5
test bl, bl
je 0x10061513
push 0
push 0x10015858
lea ecx, [ebp - 0x18]
call fcn.1006ed77
cmp eax, 0xffffffff
je 0x10061513
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x10], 0x32
rep stosd dword es:[edi], eax
push 0
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push eax
push edi
push 0
push 1
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
lea ecx, [ebp - 0x14]
push edi
setne bl
call fcn.1006f372
test bl, bl
je 0x10061508
push 0
push 0x10015860
lea ecx, [ebp - 0x14]
call fcn.1006ed77
cmp eax, 0xffffffff
je 0x10061508
inc bh
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.1008e3f5
mov al, bh
call fcn.100a4e71
ret 0x246c
Function at 0x1006397d
Capabilities:
Read file on windows

Disassembly:
push 0x34
mov eax, 0x100af72d
call fcn.100a4ea8
mov edi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
call fcn.1006f372
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.1003090c
push ecx
push 0
push 0x80
push 3
push 1
push SysReAllocStringLen
push dword [eax]
lea ecx, [ebp - 0x28]
call fcn.10032b45
mov ecx, dword [ebp - 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.1008e3f5
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.1008e3f5
test esi, esi
jns 0x10063a69
lea ecx, [ebp - 0x14]
call fcn.1008e2b0
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.1006f372
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push 0x10015ed8
push eax
call fcn.1008dbf3
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.1002dff0
mov edx, dword [edi]
lea ecx, [ebp - 0x14]
call fcn.1006e348
mov esi, dword [edx + 4]
mov ecx, esi
push eax
push 0
call dword [0x100cf608]
mov ecx, edi
call esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.100330f2
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.100416c0
push 0x100c4c08
lea eax, [ebp - 0x1c]
push eax
call fcn.1009378c
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push 0
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10063a8c
call fcn.1008da58
cmp byte [ebp - 0x10], 0xff
jne 0x10063aa9
cmp byte [ebp - 0xf], 0xfe
jne 0x10063aa9
test esi, esi
je 0x10063aa3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100a4e71
ret
lea ecx, [ebp - 0x14]
call fcn.1008e2b0
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push 0x10015f28
push eax
call fcn.1008dbf3
mov edx, dword [edi]
lea ecx, [ebp - 0x14]
add esp, 0xc
call fcn.1006e348
mov esi, dword [edx + 4]
mov ecx, esi
push eax
push 0
call dword [0x100cf608]
mov ecx, edi
call esi
push 0x100093a4
lea ecx, [ebp - 0x18]
call fcn.1006f372
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x34]
call fcn.10032eb6
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.1002dff0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x40]
call fcn.10035100
push 0x100c4d74
lea eax, [ebp - 0x40]
jmp 0x10063a63
Function at 0x10063ef8
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x100af846
call fcn.100a4ea8
mov esi, edx
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.1003071d
and dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push 0x100162a0
lea ecx, [ebp - 0x1c]
call fcn.1006e98e
push 0x10016250
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.1006e98e
push 0x100161e0
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.1006e98e
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov eax, dword [edi]
push dword [ebp - 0x10]
push esi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x34]
call fcn.1002e64e
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.1002e9f4
test al, al
jne 0x10063fbb
push 0
push 0x10007088
lea ecx, [ebp - 0x30]
call fcn.1002e1ff
test al, al
jne 0x10063fbb
push 0x10
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x34]
call fcn.1002e9d0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
call fcn.100a4e71
ret
Function at 0x10064152
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x100af891
call fcn.100a4ea8
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov dword [ebp - 0x24], esi
xor eax, eax
mov edi, 0x100c82c0
push eax
push 0x100c81a0
push edi
push eax
push esi
mov dword [ebp - 0x14], eax
call fcn.100a617b
xor ebx, ebx
add esp, 0x14
inc ebx
test eax, eax
je 0x100641a2
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.1003ea12
mov ecx, ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x100641a5
mov byte [ebp - 0xd], bl
jmp 0x100641a9
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0xd], 0
test bl, cl
je 0x100641b8
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
cmp byte [ebp - 0xd], 0
je 0x100642f4
push 0
push 0x100c82a0
push edi
push 0
push esi
call fcn.100a617b
mov edi, eax
add esp, 0x14
test edi, edi
je 0x100642fc
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008df96
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.100426e0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
mov ecx, dword [ebp - 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.1008e3f5
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.100426e0
test esi, esi
je 0x1006424a
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.10030691
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push dword [esi]
push dword [eax]
call fcn.1006e7cf
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
jmp 0x10064257
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.1006f1e0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100642ec
push eax
push 0x100c8140
push 0x100c82c0
push eax
push dword [ebp - 0x24]
call fcn.100a617b
add esp, 0x14
test eax, eax
je 0x10064298
cmp dword [eax + 0x134], 5
je 0x100642ec
push 0x100163a0
lea ecx, [ebp - 0x18]
call fcn.1006f372
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.1006e9ea
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 4], 5
push dword [eax]
mov ecx, dword [ebx]
push 0
mov edi, dword [ecx + 4]
mov ecx, edi
call dword [0x100cf608]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x18]
xor bl, bl
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
lea ecx, [esi - 0x10]
call fcn.1008e3f5
mov al, bl
call fcn.100a4e71
ret
mov ebx, dword [ebp - 0x1c]
push 0x1001646c
push 0
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, ebx
call esi
xor al, al
jmp 0x100642f6
Function at 0x1006431b
Capabilities:
Check mutex on windows

Disassembly:
push 8
mov eax, 0x100af8c7
call fcn.100a4ea8
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
lea edi, [esi + 4]
mov dword [esi], ebx
call fcn.1008e1f3
push eax
mov ecx, edi
call fcn.1008df96
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 8], edx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
mov al, byte [ecx + 8]
test al, al
je 0x100643d8
add ecx, 4
mov eax, dword [ecx]
cmp dword [eax - 0xc], ebx
je 0x10064386
push ecx
mov edx, 0x100164a0
lea ecx, [ebp - 0x10]
call fcn.1006e932
mov byte [ebp - 4], 1
jmp 0x10064398
push edx
mov edx, 0x100164a0
lea ecx, [ebp - 0x10]
call fcn.1006e932
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.1006f1e0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
push dword [edi]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
test eax, eax
jne 0x100643dc
push dword [edi]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100643dc
mov byte [esi + 0x14], 1
mov eax, esi
call fcn.100a4e71
ret 0x14

Function at 0x10064860
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x10064948
push 0x10016560
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
jne 0x10064886
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016570
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
test eax, eax
jne 0x100648a0
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016580
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x100648bc
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001659c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x100648d8
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100165b8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x100648f4
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100165f0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x10064910
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016608
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1006492c
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001663c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10064948
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
ret
Function at 0x10064ba8
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x1001a804
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 4]
sub ecx, 0x10
pop esi
jmp fcn.1008e3f5
Function at 0x100655c6
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x100afaa6
call fcn.100a4ea8
mov edi, ecx
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008df96
and dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [ebp - 0x14]
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x10065609
push edx
lea ecx, [ebp - 0x14]
call fcn.1008de52
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.10032337
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008df96
mov ebx, 0x10006fe0
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.1008dd1a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073b09
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.10073b09
mov ecx, ebx
call fcn.1008dd1a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073b09
mov ebx, 0x10016940
mov ecx, ebx
call fcn.1008dd1a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073b09
mov ecx, dword [edi + 4]
call fcn.1008dd1a
push eax
push dword [edi + 4]
lea ecx, [ebp - 0x10]
call fcn.10073b09
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.100935b0
mov edi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x70], 0x44
cmp dword [edi - 4], 1
jle 0x100656b7
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.1008dd7b
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10065702
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 7
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.1008e3f5
lea ecx, [esi - 0x10]
call fcn.1008e3f5
call fcn.100a4e71
ret
Function at 0x1006615e
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x100afd2c
call fcn.100a4ea8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0x1001a55c
xor ebx, ebx
mov dword [edi + 4], 0x100212b4
mov dword [edi + 8], ebx
mov byte [edi + 0xc], bl
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x24], ebx
mov byte [edi + 0x28], bl
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x20], 0x10021264
mov byte [ebp - 4], 1
push 0xc00
mov dword [edi + 0x3c], ebx
call fcn.10090efb
pop ecx
mov dword [ebp - 0x10], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1003274b
mov byte [ebp - 4], 1
mov dword [0x100cee78], eax
call fcn.1003226a
push 4
call fcn.10090efb
mov dword [ebp - 0x10], eax
mov dword [esp], 0x10021504
mov dword [eax], 0x1001a23c
mov dword [0x100ced74], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10066227
push 0x10018c04
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x10], 0x20000
test esi, esi
je 0x10066227
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call dword [0x100cf608]
call esi
push 0x10073c90
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1002e64e
mov byte [ebp - 4], 3
call fcn.1007a8e1
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.1002ea25
mov ecx, dword [0x100cee78]
neg al
push ebx
sbb al, al
inc al
mov byte [ecx], al
lea ecx, [ebp - 0x28]
mov eax, dword [0x100cee78]
push 0x10007088
mov dword [eax + 0x990], esi
call fcn.1002e1ff
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.1002e9f4
mov ecx, dword [0x100cee78]
mov dword [ecx + 0xbf0], 1
test bl, bl
je 0x100662a3
mov dword [ecx + 0xbf0], 3
test al, al
je 0x100662b1
mov dword [ecx + 0xbf0], 2
lea ecx, [ebp - 0x2c]
call fcn.1002e9d0
mov eax, edi
call fcn.100a4e71
ret
Function at 0x10066663
Capabilities:
Accept command line arguments

Disassembly:
push 0xc4
mov eax, 0x100afdab
call fcn.100a4edc
mov ebx, ecx
mov esi, 0x10006fc4
lea ecx, [ebp - 0xc4]
push esi
call fcn.1006f372
and dword [ebp - 4], 0
lea eax, [ebp - 0xc4]
push eax
push esi
push 0x10016d6c
push ebx
lea ecx, [ebp - 0xd0]
call fcn.1002e0ce
mov byte [ebp - 4], 1
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0xc0]
call fcn.1008df96
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0xc0]
push 0x10016d94
push eax
call fcn.1008dbf3
mov eax, dword [ebx]
add esp, 0xc
mov esi, dword [ebp - 0xc0]
mov edi, dword [eax + 4]
mov ecx, edi
push esi
push 7
call dword [0x100cf608]
mov ecx, ebx
call edi
push 0xac
lea eax, [ebp - 0xbc]
push 0
push eax
call fcn.100935b0
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 1
jne 0x10066720
lea eax, [ebp - 0xb8]
jmp 0x10066728
cmp eax, 2
jne 0x1006678b
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xc0]
push 0x10016db8
push eax
call fcn.1008dbf3
mov eax, dword [ebx]
add esp, 0xc
push dword [ebp - 0xc0]
mov esi, dword [eax + 4]
mov ecx, esi
push 7
call dword [0x100cf608]
mov ecx, ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
lea eax, [ebp - 0xc0]
push 0x10016dd4
push eax
call fcn.1008dbf3
mov eax, dword [ebx]
add esp, 0xc
mov esi, dword [ebp - 0xc0]
mov edi, dword [eax + 4]
mov ecx, edi
push esi
push 7
call dword [0x100cf608]
mov ecx, ebx
call edi
lea ecx, [esi - 0x10]
call fcn.1008e3f5
lea ecx, [ebp - 0xd0]
call fcn.1002e118
mov ecx, dword [ebp - 0xc4]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
call fcn.100a4e86
ret