joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549fb0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x549fc9
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x549fcd
xor al, al
jmp 0x54a034
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x549fe8
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x549fec
xor al, al
jmp 0x54a034
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x54a00b
mov eax, dword [ebp - 4]
and eax, 1
je 0x54a000
mov al, 1
jmp 0x54a034
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
jmp 0x54a020
mov eax, dword [ebp - 4]
and eax, 1
jne 0x54a017
mov al, 1
jmp 0x54a034
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x550310
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x550351
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x550351
mov edx, dword [ebp - 8]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
jmp 0x55035f
mov dword [ebp - 0x50], accept
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x552560
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x99]
test ecx, ecx
je 0x5525f5
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.00513770
movzx eax, al
test eax, eax
jne 0x5525f5
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.00507da0
push eax
call fcn.00549f60
add esp, 4
movzx eax, al
test eax, eax
je 0x5525f5
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.00507da0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.00507da0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x5525f5
mov eax, dword [ebp - 4]
mov byte [eax + 0x99], 0
mov eax, dword [ebp - 4]
add eax, 0x78
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.00514930
push 0x632dce
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.00512a40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5584c0
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1294
call fcn.005890e0
mov eax, dword [0x65ee20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.00588e50
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.ErrCode_:___lu__Host_:___s_
lea edx, [ebp - 0x1004]
push edx
call fcn.0058900d
add esp, 0x10
mov dword [ebp - 0x1250], 0x248
lea eax, [ebp - 0x1250]
push eax
lea ecx, [ebp - 0x124c]
push ecx
call sub.IPHLPAPI.DLL_GetNetworkParams
test eax, eax
jne 0x5585db
push 0x632dce
lea eax, [ebp - 0x113c]
push eax
call fcn.00589240
add esp, 8
test eax, eax
je 0x5585be
lea eax, [ebp - 0x113c]
push eax
lea ecx, [ebp - 0x1004]
push ecx
push str._s__DNS_:___s_
lea edx, [ebp - 0x1004]
push edx
call fcn.0058900d
add esp, 0x10
mov eax, dword [ebp - 0x1140]
mov dword [ebp - 0x1254], eax
cmp dword [ebp - 0x1254], 0
je 0x5585bc
mov eax, dword [ebp - 0x1254]
add eax, 4
push eax
lea ecx, [ebp - 0x1004]
push ecx
push str._s_
lea edx, [ebp - 0x1004]
push edx
call fcn.0058900d
add esp, 0x10
mov eax, dword [ebp - 0x1254]
mov ecx, dword [eax]
mov dword [ebp - 0x1254], ecx
jmp 0x55857e
jmp 0x5585d9
lea eax, [ebp - 0x1004]
push eax
push str._s__no_DNS
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0058900d
add esp, 0xc
jmp 0x5585f6
lea eax, [ebp - 0x1004]
push eax
push str._s__no_DNS
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0058900d
add esp, 0xc
push 0
lea eax, [ebp - 0x1004]
push eax
push str.11500106
call fcn.005077f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058845d
mov esp, ebp
pop ebp
ret
Function at 0x5696d0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b43c2
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x65ee20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00574fc0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0052d040
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0056c270
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00569900
push 0x10
call fcn.0044f931
add esp, 4
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x70], 0
je 0x569756
mov ecx, dword [ebp - 0x70]
call fcn.0050aaa0
mov dword [ebp - 0x78], eax
jmp 0x56975d
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x74]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.005751d0
push 0xac
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0056bf30
push 0x48
call fcn.0044f931
add esp, 4
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x64], 0
je 0x5697ae
mov ecx, dword [ebp - 0x64]
call fcn.00569880
mov dword [ebp - 0x78], eax
jmp 0x5697b5
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0056c110
push 0x68
call fcn.0044f931
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x5c], 0
je 0x5697f8
mov ecx, dword [ebp - 0x5c]
call fcn.00569930
mov dword [ebp - 0x78], eax
jmp 0x5697ff
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x60]
mov dword [ecx + 0x68], edx
push 0x68
call fcn.0044f931
add esp, 4
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x54], 0
je 0x569836
mov ecx, dword [ebp - 0x54]
call fcn.00569930
mov dword [ebp - 0x78], eax
jmp 0x56983d
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x58]
mov dword [ecx + 0x6c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x70], 0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.0056b880
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57e460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57f680
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x57f696
mov eax, 1
jmp 0x57f6fa
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + 0x1c], ax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58845d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65ee20]
jne 0x588467
repz ret
jmp fcn.00594fac

Function at 0x58a817
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x58a848
call fcn.0058da28
mov dword [eax], esi
call fcn.0058da15
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0058ab5c
add esp, 0x14
push 0x16
pop eax
jmp 0x58a89d
test dword [ebp + 0xc], 0xfffffff9
jne 0x58a824
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x58a875
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0058da3b
pop ecx
call fcn.0058da15
mov eax, dword [eax]
jmp 0x58a89d
test al, 0x10
jne 0x58a89b
test al, 1
je 0x58a89b
test byte [ebp + 0xc], 2
je 0x58a89b
call fcn.0058da28
mov dword [eax], 5
call fcn.0058da15
mov dword [eax], 0xd
jmp 0x58a86c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a32b7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005948ea
and dword [ebp - 4], 0
cmp dword [0x66818c], 0
mov ebx, eax
jne 0x5a3368
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a3419
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x630c50
push edi
call esi
test eax, eax
je 0x5a3419
push eax
call fcn.00594878
mov dword [esp], 0x630c40
push edi
mov dword [0x66818c], eax
call esi
push eax
call fcn.00594878
mov dword [esp], 0x630c2c
push edi
mov dword [0x668190], eax
call esi
push eax
call fcn.00594878
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x668194], eax
call esi
push eax
call fcn.00594878
pop ecx
mov dword [0x66819c], eax
test eax, eax
je 0x5a3368
push 0x630bf8
push edi
call esi
push eax
call fcn.00594878
pop ecx
mov dword [0x668198], eax
mov eax, dword [0x668198]
cmp eax, ebx
je 0x5a33c0
cmp dword [0x66819c], ebx
je 0x5a33c0
push eax
call fcn.005948f3
push dword [0x66819c]
mov esi, eax
call fcn.005948f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a33c0
test edi, edi
je 0x5a33c0
call esi
test eax, eax
je 0x5a33b7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a33b7
test byte [ebp - 0xc], 1
jne 0x5a33c0
or dword [ebp + 0x10], 0x200000
jmp 0x5a33f9
mov eax, dword [0x668190]
cmp eax, ebx
je 0x5a33f9
push eax
call fcn.005948f3
pop ecx
test eax, eax
je 0x5a33f9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a33f9
mov eax, dword [0x668194]
cmp eax, ebx
je 0x5a33f9
push eax
call fcn.005948f3
pop ecx
test eax, eax
je 0x5a33f9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x66818c]
call fcn.005948f3
pop ecx
test eax, eax
je 0x5a3419
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a341b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5aa418
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5aa449
call fcn.0058da28
mov dword [eax], esi
call fcn.0058da15
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0058ab5c
add esp, 0x14
push 0x16
pop eax
jmp 0x5aa49e
test dword [ebp + 0xc], 0xfffffff9
jne 0x5aa425
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5aa476
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0058da3b
pop ecx
call fcn.0058da15
mov eax, dword [eax]
jmp 0x5aa49e
test al, 0x10
jne 0x5aa49c
test al, 1
je 0x5aa49c
test byte [ebp + 0xc], 2
je 0x5aa49c
call fcn.0058da28
mov dword [eax], 5
call fcn.0058da15
mov dword [eax], 0xd
jmp 0x5aa46d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5abf13
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x5b550d
call fcn.0058d7f8
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x5ac025
cmp byte [esi + 0x42], bl
je 0x5ac025
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x5abf4f
xor al, al
jmp 0x5ac027
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0042c040
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ceb0
mov ecx, eax
call fcn.00526f90
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ceb0
mov ecx, eax
call fcn.00526f90
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x5abfbf
dec eax
je 0x5abfc3
dec eax
dec eax
je 0x5ac021
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004116f0
mov al, bl
jmp 0x5ac027
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ceb0
mov ecx, eax
call fcn.00526f90
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x5ac003
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ceb0
mov ecx, eax
call fcn.00526f90
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0058fa80
add esp, 0x10
cmp edi, eax
jne 0x5abfad
cmp byte [esi + 0x42], 0
je 0x5ac021
test edi, edi
jne 0x5abf5d
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00423070
jmp 0x5abf5d
mov bl, 1
jmp 0x5abfaf
mov al, 1
call fcn.0058d87b
ret
Function at 0x10001020
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x100242b5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1002e210]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x100769bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x20], 0
mov eax, dword [0x10076170]
test eax, eax
jne 0x1000106c
call fcn.10001650
mov dword [0x10076170], eax
mov ecx, dword [eax + 0x11c]
test ecx, ecx
je 0x1000107e
mov edx, dword [eax + 0xd8]
jmp 0x10001080
xor edx, edx
test ecx, ecx
je 0x1000108c
mov ebx, dword [eax + 0x110]
jmp 0x1000108e
xor ebx, ebx
test ecx, ecx
je 0x1000109a
mov edi, dword [eax + 0x114]
jmp 0x1000109c
xor edi, edi
test edx, edx
je 0x10001105
test ebx, ebx
je 0x10001105
test edi, edi
je 0x10001105
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call edx
mov esi, eax
test esi, esi
jne 0x10001128
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push edx
push eax
push 1
push esi
push str.MyDefend360
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call edi
jmp 0x10001128
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push 1
push str.MyDefend360
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
push 0x100769bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x100013c0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x10024255
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1002e210]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x100769bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x1c], 0
mov eax, dword [0x10076170]
test eax, eax
jne 0x1000140a
call fcn.10001650
mov dword [0x10076170], eax
mov ecx, dword [eax + 0x11c]
test ecx, ecx
je 0x1000141c
mov edx, dword [eax + 0xc8]
jmp 0x1000141e
xor edx, edx
test ecx, ecx
je 0x1000142a
mov ebx, dword [eax + 0x114]
jmp 0x1000142c
xor ebx, ebx
test ecx, ecx
je 0x10001438
mov edi, dword [eax + 0xe8]
jmp 0x1000143a
xor edi, edi
test edx, edx
je 0x10001480
test ebx, ebx
je 0x10001480
test edi, edi
je 0x10001480
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
mov dword [esp + 0x24], 0
call edx
mov esi, eax
test esi, esi
jne 0x10001497
mov ecx, dword [esp + 0x10]
push str.Defend360TrayFix
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebx
jmp 0x10001497
push str.Defend360TrayFix
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, eax
push 0x100769bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10001700
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
mov edi, eax
test edi, edi
je 0x100018a5
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100018a5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100018a5
cmp dword [esp + 0x20], 0
je 0x100018a5
push esi
xor esi, esi
cmp ebx, 2
jbe 0x100017dc
lea ebp, [esi + 4]
mov al, byte [edi]
mov cl, byte [edi + 1]
sub ebx, 3
mov dword [esp + 0x1c], ebx
mov bl, al
shr bl, 2
inc edi
mov dl, byte [edi + 1]
mov byte [esp + 0x14], bl
mov bl, cl
and al, 3
inc edi
shr bl, 4
and cl, 0xf
shl al, 4
add al, bl
add cl, cl
mov bl, dl
add cl, cl
shr bl, 6
and dl, 0x3f
inc edi
add cl, bl
mov byte [esp + 0x17], dl
cmp ebp, dword [esp + 0x24]
ja 0x1000188c
movzx edx, byte [esp + 0x14]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [esp + 0x20]
mov byte [esi + ebx], dl
movzx eax, al
movzx edx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], dl
movzx edx, byte [esp + 0x17]
inc esi
movzx eax, cl
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
inc ebp
mov byte [esi + ebx], cl
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ebp
inc esi
inc ebp
mov byte [esi + ebx], al
mov ebx, dword [esp + 0x1c]
inc esi
inc ebp
cmp ebx, 2
ja 0x10001742
mov ebp, dword [esp + 0x20]
test ebx, ebx
je 0x10001886
xor al, al
xor cl, cl
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], al
mov byte [esp + 0x10], cl
test ebx, ebx
jbe 0x10001810
push ebx
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.1001a4c0
mov al, byte [esp + 0x1d]
mov cl, byte [esp + 0x1c]
add esp, 0xc
mov dl, cl
shr dl, 2
mov byte [esp + 0x14], dl
mov dl, al
and cl, 3
shr dl, 4
and al, 0xf
shl cl, 4
add cl, dl
mov dl, byte [esp + 0x12]
add al, al
shr dl, 6
add al, al
add al, dl
lea edx, [esi + 4]
cmp edx, dword [esp + 0x24]
jbe 0x1000184b
pop esi
pop edi
pop ebp
mov eax, 0xffffffff
pop ebx
add esp, 8
ret
movzx edx, byte [esp + 0x14]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebp], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebp], dl
inc esi
cmp ebx, 1
jne 0x10001874
mov byte [esi + ebp], 0x3d
jmp 0x10001880
movzx eax, al
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebp], cl
inc esi
mov byte [esi + ebp], 0x3d
inc esi
cmp esi, dword [esp + 0x24]
jb 0x10001897
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov byte [esi + ebp], 0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x10002dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10024911
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1002e210]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor edi, edi
mov dword [esp + 0x20], edi
push esi
mov dword [esp + 0x18], edi
call fcn.10007330
mov dword [esp + 0x20], edi
mov eax, dword [0x10075568]
mov edx, dword [eax + 0xc]
mov ebx, 1
mov ecx, 0x10075568
mov dword [esp + 0x14], ebx
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
push str.logService
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x30]
push 0x10029008
push ecx
call fcn.100036f0
test eax, eax
je 0x10002ecd
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x14]
call fcn.10002530
lea edi, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.100079b0
mov byte [esp + 0x20], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002e82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, 0x10029528
call fcn.1000a1c0
push esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x2c], 3
call fcn.10002040
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002ecd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002ef2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x10002f10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100248b9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1002e210]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 0x38], ebx
push esi
mov dword [esp + 0x20], ebx
call fcn.10007330
mov dword [esp + 0x38], ebx
mov eax, dword [0x10075568]
mov edx, dword [eax + 0xc]
mov edi, 1
mov ecx, 0x10075568
mov dword [esp + 0x1c], edi
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
push str.DelayedService
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x48]
push 0x10029008
push ecx
call fcn.100036f0
test eax, eax
je 0x10003041
lea edx, [esp + 0x40]
push edx
mov ecx, 0x10029528
call fcn.1000a1c0
push esi
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x44], 2
call fcn.10002040
mov byte [esp + 0x44], 1
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002fdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x40], eax
cmp dword [esi + 0xc], eax
jbe 0x10002ff0
call fcn.1001516c
mov ebx, dword [esi + 0x10]
mov ecx, dword [esi]
mov dword [esp + 0x20], ecx
cmp dword [esi + 0xc], ebx
jbe 0x10003003
call fcn.1001516c
mov edi, dword [esi + 0xc]
mov ebp, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x10003012
call fcn.1001516c
mov eax, dword [esi]
push ebx
push ebp
push edi
push eax
lea ebx, [esp + 0x38]
call fcn.10008590
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x30]
add esp, 0x10
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
push esi
lea ebx, [esp + 0x34]
call fcn.10007440
xor ebx, ebx
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003065
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8