joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b6bb7a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x88], eax
push ebx
lea eax, [ebp - 8]
push 0x7fff
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], eax
call fcn.75a5e139
test al, al
jne 0x75b6bbdb
push 8
pop esi
lea ecx, [ebp - 0x14]
call fcn.759b1681
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x80], ebx
call fcn.75bc156f
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x84], ebx
jmp 0x75b6bc18
cmp dword [ebp - 0x80], ebx
je 0x75b6bc2b
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push dword [ebp - 0x14]
push eax
call fcn.75bc15a9
push ebx
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
call esi
cmp eax, 1
je 0x75b6bc04
cmp eax, ebx
jne 0x75b6bc3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.75bc16c2
mov edi, dword [ebp - 0x88]
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x84]
jmp 0x75b6bbc2

Function at 0x75b6bc61
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x10], esi
je 0x75b6bc75
call fcn.759d82c4
push esi
push 0x100000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x75b6bce6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x75b6bca9
cmp eax, 2
jne 0x75b6bce6
cmp dword [0x75bc8ca8], esi
je 0x75b6bcd1
push esi
push esi
mov eax, 0x759b7ff8
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push 0x759fe368
push esi
push esi
push 9
call fcn.759c26bf
add esp, 0x30
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.75acb2de
push 0x6e
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
je 0x75b6bcf3
push 1
call fcn.759d07de
pop ecx
cmp edi, 0xffffffff
jne 0x75b6bd07
push 0x65b
call fcn.75b65cd5
pop ecx
pop edi
pop esi
leave
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x75b6bd2c
push 0x65b
call fcn.75b65cd5
mov esi, eax
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x75b6bd03
mov ecx, dword [ebp + 0x14]
cmp ecx, esi
je 0x75b6bd3b
cmp dword [ecx], eax
je 0x75b6bd3b
mov dword [ecx], eax
jmp 0x75b6bd21
cmp eax, esi
jne 0x75b6bd4f
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
jmp 0x75b6bd21
push dword [ebp + 0xc]
push edi
call fcn.75b6bb7a
pop ecx
jmp 0x75b6bd1e
Function at 0x75b7aa83
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push 0
push 0x13d620
push dword [ebp + 8]
push 0x75b73005
push dword [0x75bc8c6c]
call fcn.75b775fd
add esp, 0x18
pop ebp
ret
Function at 0x75ba71b1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
push edi
je 0x75ba72ed
mov edx, dword [esi + 8]
xor ebx, ebx
cmp edx, ebx
je 0x75ba72ed
mov dword [ebp - 0xc], 0x75a0ad14
cmp dword [ebp + 0x10], ebx
jne 0x75ba71e7
mov dword [ebp - 0xc], 0x75ba72f8
xor eax, eax
cmp dword [ebp + 0x10], ebx
setne al
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], ebx
je 0x75ba72bd
mov ecx, dword [esi + 4]
cmp ecx, 0xfde8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], 0x75a0dd38
mov dword [ebp - 4], eax
jge 0x75ba721f
cmp ecx, 0xfde9
jl 0x75ba7225
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
mov eax, dword [esi + 0xc]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ecx
call edi
cmp eax, ebx
jne 0x75ba727f
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 8]
call fcn.759da1df
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x75ba72ed
push dword [ebp - 4]
mov ecx, dword [esi + 0xc]
push dword [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esi + 4]
call edi
cmp dword [ebp + 0x10], 0xffffffff
mov ecx, dword [esi + 8]
je 0x75ba72ac
mov edi, ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x75ba72ac
mov dl, byte [edi]
cmp dl, 0x10
jae 0x75ba72a3
movzx edx, dl
mov dl, byte [edx + 0x75bce4cc]
mov byte [edi], dl
dec dword [ebp + 0xc]
inc edi
cmp dword [ebp + 0xc], ebx
jne 0x75ba7291
push ebx
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x75ba72c0
xor eax, eax
inc eax
cmp eax, ebx
je 0x75ba72e6
cmp dword [ebp + 0x10], 0xffffffff
je 0x75ba72dd
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x75ba72e6
xor eax, eax
inc eax
jmp 0x75ba72ef
mov ecx, esi
call fcn.75ba56d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x75ba751a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [eax], 0x75bc8bfc
cmp dword [esi], 0xffffffff
push edi
je 0x75ba769f
xor ebx, ebx
cmp dword [esi + 0x20], ebx
je 0x75ba769f
mov dword [ebp - 8], ebx
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jne 0x75ba75a9
mov byte [ebp - 1], bl
cmp eax, 0x200
jne 0x75ba762c
add eax, 2
cmp dword [esi + 0x14], eax
jge 0x75ba7578
lea edi, [esi + 0x10]
push eax
mov ecx, edi
call fcn.75a1d617
cmp dword [edi], ebx
je 0x75ba769f
mov eax, dword [esi + 0x10]
push ebx
lea edi, [esi + 4]
push edi
push 0x200
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x75ba7637
mov edi, dword [edi]
cmp edi, ebx
je 0x75ba7637
mov eax, dword [esi + 0x10]
mov dword [esi + 8], ebx
mov byte [edi + eax], bl
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov cl, byte [edx + eax]
mov byte [ebp - 1], cl
cmp cl, 0x20
jae 0x75ba75f5
cmp cl, bl
jne 0x75ba75c4
mov byte [ebp - 1], 0xa
jmp 0x75ba75f2
cmp cl, 0xd
jne 0x75ba75d7
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
mov byte [edx + eax], bl
jmp 0x75ba7547
cmp cl, 0xa
je 0x75ba7644
cmp cl, 9
je 0x75ba7644
cmp cl, 0x10
jb 0x75ba75f5
movzx eax, cl
mov al, byte [eax + 0x75bce4cc]
mov byte [ebp - 1], al
mov cl, byte [ebp - 1]
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x24]
jl 0x75ba7618
add eax, 0x400
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.75b31e3f
cmp dword [edi], ebx
je 0x75ba769f
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x20]
inc dword [ebp - 8]
mov byte [eax + edx], cl
inc dword [esi + 8]
jmp 0x75ba7547
cmp dword [ebp - 8], ebx
je 0x75ba768f
mov byte [ebp - 1], 0xa
jmp 0x75ba764f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x75ba762c
jmp 0x75ba764f
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
mov ecx, edx
mov byte [eax + ecx], bl
cmp dword [ebp - 8], ebx
je 0x75ba768f
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push dword [ebp - 8]
push eax
push ebx
push dword [esi + 0xc]
call edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ebx
push eax
call fcn.759c7851
add esp, 0xc
cmp eax, ebx
je 0x75ba7698
push dword [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [esi + 0x20]
push ebx
push dword [esi + 0xc]
call edi
jmp 0x75ba7698
mov eax, dword [ebp + 8]
mov dword [eax], 0x75bc8bfc
movzx ax, byte [ebp - 1]
jmp 0x75ba76a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x75ba801e
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.759b3eb3
or ebx, 0xffffffff
cmp eax, ebx
jne 0x75ba8041
push 0x5dd
call fcn.75a203dc
pop ecx
jmp 0x75ba8179
push esi
xor esi, esi
push edi
inc esi
xor edi, edi
cmp eax, esi
jne 0x75ba8077
push dword [ebp + 8]
call fcn.75b675cc
pop ecx
cmp al, 1
jne 0x75ba8077
mov dword [ebp - 4], esi
call fcn.759d82c4
push edi
push 0x100080
cmp dword [ebp + 0xc], edi
je 0x75ba807c
push 2
push edi
push esi
push 0x40000000
jmp 0x75ba8086
mov dword [ebp - 4], edi
jmp 0x75ba8061
push 3
push edi
push 5
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x75ba80df
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x75ba80a6
cmp eax, 2
jne 0x75ba80df
cmp dword [0x75bc8ca8], edi
je 0x75ba80ce
push edi
push edi
mov eax, 0x759b7ff8
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push 0x759fe368
push edi
push edi
push 9
call fcn.759c26bf
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6e
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp dword [ebp - 4], edi
je 0x75ba80f4
push 1
call fcn.759d07de
pop ecx
cmp esi, 0xffffffff
jne 0x75ba810c
push ebx
push dword [ebp + 8]
push 0x44d
call fcn.75a2084a
add esp, 0xc
jmp 0x75ba8177
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x18
mov ebx, eax
call fcn.759c6f57
pop ecx
cmp eax, edi
je 0x75ba8132
push dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
call fcn.75ba585e
mov ebx, eax
jmp 0x75ba8134
xor ebx, ebx
cmp ebx, edi
jne 0x75ba8141
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x75ba816e
push 0x424
call fcn.759c6f57
pop ecx
cmp eax, edi
je 0x75ba815a
push ebx
mov ecx, eax
call fcn.75ba7f48
jmp 0x75ba815c
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp eax, edi
jne 0x75ba8175
push 1
mov ecx, ebx
call fcn.75ba7768
mov eax, dword [0x75bc82c8]
jmp 0x75ba8177
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75bb6919
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [ebp + 0x10], 0
lea ecx, [ebp - 0x18]
setne al
movzx eax, al
push eax
call fcn.759b3e6f
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x75bb6950
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
jmp 0x75bb6958
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x75bb698a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x18]
call fcn.759b4003
mov eax, esi
pop esi
leave
ret
xor esi, esi
jmp 0x75bb697d
Function at 0x75bb7add
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x75bb7b10
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x75bb7b08
xor eax, eax
jmp 0x75bb7b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x75bb7b46
cmp byte [esi + 0x41], 0
jne 0x75bb7b2b
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
lea edx, [ebp + 0xc]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x10]
jmp 0x75bb7b3d
mov ecx, dword [esi + 0x44]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.75b13681
test eax, eax
jge 0x75bb7b04
and eax, 0xffff
mov esi, dword [esi + 0x24]
cmp eax, 0x70
mov eax, dword [esi]
push esi
jne 0x75bb7b5c
call dword [eax + 0x20]
push eax
push 0x51b
jmp 0x75bb7b65
call dword [eax + 0x20]
push eax
push 0x518
call fcn.75a20602
pop ecx
pop ecx
pop esi
pop ebp
ret 8
Function at 0x75bbf598
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor esi, esi
push esi
push esi
push esi
push esi
mov ebx, ecx
call edi
mov dword [0x75bcf31c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x75bcf31c]
cmp eax, esi
je 0x75bbf747
push eax
call fcn.759d8a66
pop ecx
test eax, eax
je 0x75bbf741
push esi
push esi
push esi
push esi
call edi
mov dword [0x75bcf318], eax
cmp eax, esi
je 0x75bbf735
push eax
call fcn.759d8a66
pop ecx
test eax, eax
jne 0x75bbf60d
push dword [0x75bcf31c]
call fcn.759d0be3
mov dword [0x75bcf318], esi
jmp 0x75bbf740
lea esi, [ebx + 0xa50]
or dword [esi], 0xffffffff
lea edi, [ebx + 0xa54]
or dword [edi], 0xffffffff
cmp dword [0x75bcc8ec], 2
jne 0x75bbf6c6
call fcn.759d82c4
push esi
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x75bbf662
push edi
push 2
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x75bbf662
mov dword [ebp - 4], 1
jmp 0x75bbf666
and dword [ebp - 4], 0
push 1
call fcn.759d07de
cmp dword [ebp - 4], 0
pop ecx
jne 0x75bbf699
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x75bbf682
push esi
call fcn.75af13eb
pop ecx
mov edi, dword [edi]
cmp edi, 0xffffffff
je 0x75bbf747
push edi
call fcn.75af13eb
pop ecx
jmp 0x75bbf747
push dword [esi]
call fcn.759d8a66
pop ecx
push dword [edi]
test eax, eax
jne 0x75bbf6b8
call fcn.759d0be3
or dword [esi], 0xffffffff
or dword [edi], 0xffffffff
pop ecx
jmp 0x75bbf747
call fcn.759d8a66
pop ecx
test eax, eax
jne 0x75bbf6c6
push dword [esi]
jmp 0x75bbf6a7
push 1
call fcn.75b314f1
pop ecx
mov byte [ebx + 0xa74], al
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push ebx
push 0x75bbfdd1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x75bbf70b
push dword [0x75bcf31c]
call fcn.759d0be3
push dword [0x75bcf318]
call fcn.759d0be3
pop ecx
jmp 0x75bbf602
push 0xffffffffffffffff
push dword [0x75bcf31c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
jne 0x75bbf6ef
mov eax, dword [ebx + 4]
cmp eax, 0x17
je 0x75bbf6ef
xor eax, eax
inc eax
jmp 0x75bbf749
push dword [0x75bcf31c]
call fcn.759d0be3
pop ecx
mov dword [0x75bcf31c], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75bc0964
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x14]
lea ecx, [eax - 1]
cmp ecx, 9
ja 0x75bc0a0a
mov edx, dword [eax*4 + 0x75bcf338]
mov esi, dword [eax*4 + 0x75bcf364]
xor ebx, ebx
push ebx
push ebx
call fcn.75bbfe9d
sub edx, 3
pop ecx
pop ecx
je 0x75bc0a11
dec edx
jne 0x75bc0a0a
cmp esi, ebx
je 0x75bc0a0a
mov eax, dword [0x75bcf330]
cmp dword [eax + 0xa58], ebx
je 0x75bc09bc
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x20]
jmp 0x75bc09cf
cmp byte [eax + 0xa60], bl
je 0x75bc09d3
mov ecx, dword [eax + 0xa5c]
call fcn.75b13747
mov edi, eax
jmp 0x75bc09d8
mov edi, 0x8000ffff
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp edi, ebx
jge 0x75bc0a72
mov eax, 0x759b1758
push eax
push 0x759fb3f8
push 0x75a19364
push edi
push eax
call fcn.75a3ad87
add esp, 0x14
cmp eax, ebx
je 0x75bc0a0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp esi, 0xffffffff
je 0x75bc0a0a
lea eax, [ebp - 0x10]
push eax
movzx eax, word [edi + 0x1a]
push eax
movzx eax, word [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
and edi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
and edi, eax
call fcn.759d0be3
pop ecx
test edi, eax
jne 0x75bc0a72
mov dword [0x75bcf320], 0x13
jmp 0x75bc0a0a
mov eax, dword [0x75bcf330]
mov dword [eax], 4
mov eax, dword [0x75bcf330]
mov dword [eax + 0xa4c], ebx
xor eax, eax
inc eax
jmp 0x75bc0a0c

Function at 0x75bc156f
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x75bc1891
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x75bc18e5
push 3
lea eax, [ebp - 0x44]
push 0x75bc18f8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.759b1748
leave
ret
Function at 0x75bc1903
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x75bcf3ac]
jne 0x75bc199e
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x75bc1a90
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x75bc199d
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x75bc1b48
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x75bc199d
push 3
push dword [esi*8 + 0x75bc19b0]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x75bc198f
inc esi
cmp esi, 0x1c
jae 0x75bc199d
jmp 0x75bc196e
mov ax, word [esi*8 + 0x75bc19b4]
mov word [0x75bcf3ac], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x75bcf3ac]
xor ecx, ebp
call fcn.759b1748
leave
ret

Function at 0x75bc20b2
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x75bc20df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x75bc2173
push edi
push 0x14
push 0x75bc217c
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x75bc20fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x75bc2155
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x75bc211b
call esi
mov ebx, eax
cmp ebx, 0x420
jne 0x75bc2160
mov ebx, 0x5b4
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x75bc2153
cmp dword [ebp - 0x20], 4
je 0x75bc2159
cmp dword [ebp - 0x20], 1
je 0x75bc215d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
ja 0x75bc2160
jmp 0x75bc2120
call esi
mov ebx, eax
jmp 0x75bc2160
xor ebx, ebx
jmp 0x75bc2160
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x75bc216d
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x75bc34f9
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x43e010
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x53c11b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0052bfcc
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x43e092
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00528917
mov eax, dword [eax]
push 0x6c6db4
push eax
call fcn.00507094
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0052c257
test bl, bl
je 0x43e092
push 0x6c6db4
lea ecx, [esp + 0xc]
call fcn.0052c5e7
push 0x6c6dc0
lea ecx, [esp + 0xc]
call fcn.0052c5e7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43e0ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0052c257
jmp 0x43e199
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x43e152
lea edx, [esp + 0x7c]
push 0x6c6dbc
push edx
call fcn.00507094
add esp, 8
test eax, eax
je 0x43e152
lea eax, [esp + 0x7c]
push 0x6c6db8
push eax
call fcn.00507094
add esp, 8
test eax, eax
je 0x43e152
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43e0e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0052c257
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x43e9b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x43ea12
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc