joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d596020
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1870
call fcn.6d5ca7f0
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x186c], eax
push 0x400
lea eax, [esp + 0x1070]
push eax
push 1
push 0x6d5cec6c
call fcn.6d594030
add esp, 0x10
test eax, eax
je 0x6d596149
lea ecx, [esp + 0x106c]
push ecx
push str._s_ssvagent.exe
lea edx, [esp + 0x874]
push 0x400
push edx
call dword [sym.imp.MSVCR100.dll_swprintf_s]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x880]
push ecx
call dword [sym.imp.MSVCR100.dll__wstat64i32]
add esp, 0x18
test eax, eax
jne 0x6d596149
xor edx, edx
mov word [esp + 0x6c], dx
cmp byte [esp + 0x187c], dl
je 0x6d5960bb
push str.__enablesponsorofferings
push 0x104
lea eax, [esp + 0x74]
push eax
jmp 0x6d5960ca
push str.__disablesponsorofferings
push 0x104
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
push 0x3c
lea edx, [esp + 4]
push 0
push edx
call sub.MSVCR100.dll_memset
lea eax, [esp + 0x78]
add esp, 0xc
mov dword [esp], 0x3c
mov dword [esp + 0x14], eax
call fcn.6d5934e0
test eax, eax
je 0x6d596104
mov dword [esp + 0xc], str.runas
lea edx, [esp]
lea ecx, [esp + 0x86c]
push edx
mov dword [esp + 8], 0x40
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x6d596149
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6d596149
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x186c]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x1870
ret 0xc
Function at 0x6d596160
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1870
call fcn.6d5ca7f0
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x186c], eax
push 0x400
lea eax, [esp + 0x1070]
push eax
push 1
push 0x6d5cec6c
call fcn.6d594030
add esp, 0x10
test eax, eax
je 0x6d596289
lea ecx, [esp + 0x106c]
push ecx
push str._s_ssvagent.exe
lea edx, [esp + 0x874]
push 0x400
push edx
call dword [sym.imp.MSVCR100.dll_swprintf_s]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x880]
push ecx
call dword [sym.imp.MSVCR100.dll__wstat64i32]
add esp, 0x18
test eax, eax
jne 0x6d596289
xor edx, edx
mov word [esp + 0x6c], dx
cmp byte [esp + 0x187c], dl
je 0x6d5961fb
push str.__forceinstall__register__new__high
push 0x104
lea eax, [esp + 0x74]
push eax
jmp 0x6d59620a
push str.__disablewebjava
push 0x104
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
push 0x3c
lea edx, [esp + 4]
push 0
push edx
call sub.MSVCR100.dll_memset
lea eax, [esp + 0x78]
add esp, 0xc
mov dword [esp], 0x3c
mov dword [esp + 0x14], eax
call fcn.6d5934e0
test eax, eax
je 0x6d596244
mov dword [esp + 0xc], str.runas
lea edx, [esp]
lea ecx, [esp + 0x86c]
push edx
mov dword [esp + 8], 0x40
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x6d596289
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6d596289
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x186c]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x1870
ret 0xc

Function at 0x6d5962a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0
call fcn.6d5934e0
test eax, eax
jne 0x6d5962b8
add esp, 0x10
ret
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d59631d
mov eax, 4
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push str.EnableLUA
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 4], 1
sete al
add esp, 0x10
ret
mov eax, 1
add esp, 0x10
ret
Function at 0x6d596350
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x6d5e2df4], 0
je 0x6d596387
mov eax, dword [0x6d5e2df0]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x118
ret
push 0x114
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [esp + 4], 5
mov ecx, 1
jne 0x6d5963c3
cmp dword [esp + 8], ecx
jb 0x6d5963c3
mov eax, ecx
jmp 0x6d5963c5
xor eax, eax
mov dword [0x6d5e2df4], ecx
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov dword [0x6d5e2df0], eax
call fcn.6d5ca6ac
add esp, 0x118
ret

Function at 0x6d5963f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [str.Control_PanelDesktopWindowMetrics]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d59648b
lea edx, [esp + 8]
push edx
mov edx, dword [0x6d5e2198]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6d59647d
mov eax, dword [esp + 8]
cmp eax, 8
jae 0x6d59646b
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
mov esi, eax
jmp 0x6d596480
or esi, 0xffffffff
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x20
ret 8

Function at 0x6d5964a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x6d5e2dfc], 0
je 0x6d5964d7
mov eax, dword [0x6d5e2df8]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x118
ret
push 0x114
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x6d596517
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x6d59653d
cmp dword [esp + 8], ecx
jae 0x6d59653f
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov dword [0x6d5e2df8], eax
mov dword [0x6d5e2dfc], 1
call fcn.6d5ca6ac
add esp, 0x118
ret
jbe 0x6d596517
mov eax, 1
jmp 0x6d596519
Function at 0x6d596d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d5cc820
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6d5e2a5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x6d596dfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_LOCAL_APPDATA__NULL__0__szLocalPath_
call fcn.6d595ce0
add esp, 8
push 0
push esi
call fcn.6d5ca1c9
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x6d596e50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6d5ca6ac
mov esp, ebp
pop ebp
ret 8

Function at 0x6d596e70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d5cc850
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6d5e2a5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x6d596efa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_APPDATA__NULL__0__szLocalPath_
call fcn.6d595ce0
add esp, 8
push 0
push esi
call fcn.6d5ca1c9
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x6d596f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6d5ca6ac
mov esp, ebp
pop ebp
ret 8
Function at 0x6d596f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d5cc880
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6d5e2a5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x6d596ffa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_COMMON_APPDATA__NULL__0__szPath_
call fcn.6d595ce0
add esp, 8
push 0
push esi
call fcn.6d5ca1c9
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x6d597050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6d5ca6ac
mov esp, ebp
pop ebp
ret 8
Function at 0x6d598490
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1024
call fcn.6d5ca7f0
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x1020], eax
mov eax, dword [esp + 0x1030]
mov ecx, dword [esp + 0x1028]
push ebx
mov bl, byte [esp + 0x1038]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x6d598622
push esi
push edi
push eax
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.6d592e60
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall]
add esp, 0xc
xor edx, edx
cmp bl, 1
sete dl
push 0x2001f
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
add edx, 0x80000001
push edx
call fcn.6d593190
test eax, eax
jne 0x6d5985d1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
cmp eax, ebp
je 0x6d59852a
mov eax, dword [eax]
jmp 0x6d59852c
xor eax, eax
mov esi, dword [esp + 0x14]
push ebp
push ebp
push 0x2001f
push ebp
push ebp
push eax
push esi
lea ecx, [esp + 0x3c]
call fcn.6d595db0
mov edi, dword [esp + 0x20]
test eax, eax
jne 0x6d5985b7
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebp
push ebp
push str.UninstallString
push edi
mov dword [esp + 0x44], 0x800
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x30]
push 0x6d5cf53c
push edx
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
test eax, eax
je 0x6d59858a
mov ebx, 1
cmp edi, ebp
je 0x6d598597
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp ebx, ebp
je 0x6d5985b7
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x6d5985a7
mov eax, dword [eax]
jmp 0x6d5985a9
xor eax, eax
push eax
lea ecx, [esp + 0x18]
call fcn.6d593d00
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x6d5985c4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp edi, ebp
je 0x6d5985d5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d5985d5
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x6d5985e0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x6d598620
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jne 0x6d598620
cmp esi, ebp
je 0x6d598620
mov eax, dword [esi]
cmp eax, ebp
je 0x6d598607
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x6d598617
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1028]
pop ebp
pop ebx
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x1024
ret 0x10
Function at 0x6d598aa0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x620], eax
test byte [0x6d5e2e04], 1
jne 0x6d598adb
or dword [0x6d5e2e04], 1
push 0x6d5ccdd0
mov dword [0x6d5e2e00], 0
call fcn.6d5ca1c9
add esp, 4
mov eax, dword [0x6d5e2e00]
test eax, eax
je 0x6d598af9
mov eax, dword [eax]
test eax, eax
je 0x6d598af9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x6d598c46
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x6d598c46
push esi
push edi
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0xc]
call fcn.6d592e00
push str.jawshtml.html
lea ecx, [esp + 0x10]
call fcn.6d596c20
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.6d594760
lea ecx, [esp + 0xc]
call fcn.6d592330
mov edi, dword [esp + 8]
test edi, edi
je 0x6d598b5c
mov eax, dword [edi]
jmp 0x6d598b5e
xor eax, eax
push 0x6d5cf5dc
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
push esi
push str._HTML___HTML_
call dword [sym.imp.MSVCR100.dll_fputws]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
xor ecx, ecx
add esp, 0x14
mov word [esp + 0x10], ax
mov word [esp + 0x420], cx
test edi, edi
je 0x6d598b9b
mov edi, dword [edi]
jmp 0x6d598b9d
xor edi, edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x424]
push eax
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x6d598c2a
lea eax, [esp + 0x10]
xor ecx, ecx
lea esi, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x6d598bc0
sub eax, esi
sar eax, 1
cmp word [esp + 0x10], cx
je 0x6d598bf3
lea edx, [esp + 0x10]
lea ebx, [ebx]
cmp word [edx], 0x20
jne 0x6d598bf3
inc ecx
cmp word [esp + ecx*2 + 0x10], 0
lea edx, [esp + ecx*2 + 0x10]
jne 0x6d598be0
cmp eax, ecx
jle 0x6d598c2a
lea edx, [esp + eax*2 + 0xe]
jmp 0x6d598c00
cmp word [edx], 0x20
jne 0x6d598c10
dec eax
sub edx, 2
cmp eax, ecx
jg 0x6d598c00
jmp 0x6d598c2a
cmp eax, ecx
jle 0x6d598c2a
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
lea eax, [esp + ecx*2 + 0x10]
push eax
mov ecx, 0x6d5e2e00
call fcn.6d597280
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
lea ecx, [esp + 8]
call fcn.6d592330
pop edi
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
mov eax, 0x6d5e2e00
call fcn.6d5ca6ac
add esp, 0x624
ret
Function at 0x6d598f30
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x254
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push esi
push str.msvcrt.dll
mov dword [esp + 0xc], eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x6d598f79
pop esi
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x254
ret 8
push ebx
push ebp
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str._wopen
push esi
call edi
push 0x6d5cf658
push esi
mov ebx, eax
call edi
push 0x6d5cf650
push esi
mov dword [esp + 0x24], eax
call edi
push 0x6d5cf648
push esi
mov ebp, eax
call edi
push str._fstat
push esi
mov dword [esp + 0x20], eax
call edi
push 0x6d5cf638
push esi
mov dword [esp + 0x28], eax
call edi
push 0x6d5cf630
push esi
mov dword [esp + 0x18], eax
call edi
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x6d5990de
cmp dword [esp + 0x1c], 0
je 0x6d5990de
test ebp, ebp
je 0x6d5990de
cmp dword [esp + 0x18], 0
je 0x6d5990de
cmp dword [esp + 0x20], 0
je 0x6d5990de
cmp dword [esp + 0x10], 0
je 0x6d5990de
test eax, eax
je 0x6d5990de
lea ecx, [esp + 0x58]
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea edx, [esp + 0x58]
push 0
push edx
call dword [sym.imp.MSVCR100.dll__wtempnam]
push 0x1b6
push 0x102
push eax
call ebx
push 1
mov esi, eax
call dword [esp + 0x34]
push 1
push esi
mov ebx, eax
call ebp
add esp, 0x20
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x6d599076
push str._JVM_DumpAllStacks_8
push eax
call edi
test eax, eax
je 0x6d599076
mov ecx, dword [esp + 0x14]
push 0
push ecx
call eax
push 1
push ebx
call ebp
push 0
push 0
push esi
call dword [esp + 0x2c]
lea edx, [esp + 0x3c]
push edx
push esi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x58]
add esp, 0x1c
xor edi, edi
test ebp, ebp
jle 0x6d5990b3
lea eax, [ebp + 1]
push 1
push eax
call dword [sym.imp.MSVCR100.dll_calloc]
mov edi, eax
push ebp
push edi
push esi
call dword [esp + 0x24]
add esp, 0x14
xor ebx, ebx
test edi, edi
je 0x6d5990cb
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x29c]
push edi
push eax
call edx
mov ebx, eax
push edi
call dword [sym.imp.MSVCR100.dll_free]
push esi
call dword [esp + 0x2c]
add esp, 8
mov eax, ebx
jmp 0x6d5990e0
xor eax, eax
mov ecx, dword [esp + 0x260]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x254
ret 8
Function at 0x6d599100
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x24c]
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x4c]
push ecx
xor ebx, ebx
push 0x104
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea edx, [esp + 0x4c]
push ebx
push edx
call dword [sym.imp.MSVCR100.dll__wtempnam]
push 0x1b6
push 0x102
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__wopen_wchar_t_const___int__int_]
push 1
mov esi, eax
call dword [sym.imp.MSVCR100.dll__dup]
push 1
push esi
mov dword [esp + 0x38], eax
call dword [sym.imp.MSVCR100.dll__dup2]
add esp, 0x20
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebp, dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
push str._JVM_DumpAllStacks_8
push edi
call ebp
test eax, eax
jne 0x6d59919b
push str.JVM_DumpAllStacks
push edi
call ebp
test eax, eax
je 0x6d5991a6
mov ebp, dword [esp + 0x10]
push 0
push ebp
call eax
jmp 0x6d5991aa
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCR100.dll__dup2]
push 0
push 0
push esi
call dword [sym.imp.MSVCR100.dll__lseek]
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.MSVCR100.dll__fstat64i32]
mov edi, dword [esp + 0x4c]
add esp, 0x1c
test edi, edi
jle 0x6d599208
lea edx, [edi + 1]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_calloc]
mov ebx, eax
push edi
push ebx
push esi
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0x14
test ebx, ebx
je 0x6d599208
mov eax, dword [ebp]
mov ecx, dword [eax + 0x29c]
push ebx
push ebp
call ecx
mov edi, eax
jmp 0x6d59920c
mov edi, dword [esp + 0x14]
push ebx
call dword [sym.imp.MSVCR100.dll_free]
push esi
call dword [sym.imp.MSVCR100.dll__close]
mov ecx, dword [esp + 0x25c]
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x248
ret 8

Function at 0x6d5999d0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x6d5999e4
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc
Function at 0x6d59b470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x410
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x420]
push edi
push 2
push 0
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call fcn.6d5ca1c9
mov edi, eax
test edi, edi
jne 0x6d59b4cc
call fcn.6d5998a0
mov esi, eax
jmp 0x6d59b56a
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x6d59b4e2
call fcn.6d5998a0
jmp 0x6d59b561
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x6d59b4f7
call fcn.6d5998a0
jmp 0x6d59b561
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x6d59b50f
mov esi, 0x8007000e
jmp 0x6d59b563
push eax
lea ecx, [esp + 0x18]
call fcn.6d59a710
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x6d59b528
mov esi, 0x8007000e
jmp 0x6d59b563
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x6d59b541
call fcn.6d5998a0
jmp 0x6d59b561
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.6d59b2e0
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea edx, [esp + 0x18]
cmp dword [esp + 0x14], edx
je 0x6d59b580
lea ecx, [esp + 0x14]
call fcn.6d59a000
lea ecx, [ecx]
mov ecx, dword [esp + 0x418]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x410
ret 0x10

Function at 0x6d59c400
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x6d59c45a
lea ecx, [esp + 4]
push ecx
push esi
call fcn.6d592b30
add esp, 8
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x20c
ret 8
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.6d5ca6ac
add esp, 0x20c
ret 8
Function at 0x6d59c480
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x20
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0x20
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x6d59c4c3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
je 0x6d59c515
xor al, al
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x20
ret 8
lea ecx, [esp + 4]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x6d59c4a5
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x10]
push 0
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x6d59c4a5
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0x1c]
test eax, eax
setns al
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x20
ret 8