joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003c72
Capabilities:
Accept command line arguments
Get hostname
Get user security identifier

Disassembly:
lea eax, [ebp - 0x10]
push eax
push 0x810
push edi
call fcn.10005f14
cmp eax, edi
jne 0x10003d1d
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100031e0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_LsaLookupNames
cmp eax, edi
jne 0x10003d1d
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x100
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x10003d1d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push dword [eax + 4]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
pop ecx
test eax, eax
pop ecx
je 0x10003d1d
lea eax, [ebp - 0xc]
push eax
push 1
push edi
call fcn.10003228
cmp eax, edi
jne 0x10003d1d
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
je 0x10003d1d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
call fcn.100017d0
cmp eax, edi
jne 0x10003d1d
push dword [ebp - 4]
call fcn.10003624
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xc], edi
je 0x10003d2a
push dword [ebp - 0xc]
call fcn.10002b57
cmp dword [ebp - 4], edi
je 0x10003d37
push dword [ebp - 4]
call fcn.10002b57
cmp dword [ebp - 8], edi
je 0x10003d44
push dword [ebp - 8]
call sub.ADVAPI32.dll_LsaFreeMemory
cmp dword [ebp - 0x14], edi
je 0x10003d51
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_LsaFreeMemory
cmp dword [ebp - 0x10], edi
je 0x10003d5e
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10003e0c
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push esi
push edi
mov esi, 0x10020610
lea edi, [esi - 0x20c]
call ebx
push eax
push 0x40
push edi
push dword [esi - 0x210]
push dword [0x10020748]
call fcn.10001a38
call ebx
push eax
push 0x40
push esi
push dword [esi - 4]
push dword [0x10020748]
call fcn.10001a38
push 0
push esi
push edi
push 0x17
call dword [0x1001775c]
add esi, 0xc58
cmp esi, 0x10017428
jb 0x10003e1a
mov eax, dword [0x10017288]
and eax, 1
push eax
push 0x100171e0
call dword [0x10017760]
pop edi
pop esi
pop ebx
ret

Function at 0x10005308
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push esi
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10005358
push dword [ebp - 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x10005358
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x10005360
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 0xf003f
push ebx
push 0x10003afc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10005407
push dword [ebp - 4]
call fcn.100070f5
mov esi, eax
cmp esi, ebx
je 0x10005407
push 0x10006516
call dword [0x10007a18]
pop ecx
lea eax, [eax + esi + 0x24]
push eax
call fcn.10002ff8
mov edi, eax
cmp edi, ebx
je 0x10005407
mov dword [ebp - 8], ebx
add esi, 2
mov eax, dword [ebp - 8]
push ebx
push ebx
inc dword [ebp - 8]
push ebx
lea ecx, [ebp - 0xc]
push ebx
push ecx
push edi
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x100053fe
mov eax, dword [ebp - 0xc]
push 0x10006516
push 0x100019ec
lea eax, [edi + eax*2]
push eax
call dword [pe_dos_header]
add esp, 0xc
push edi
push dword [ebp - 4]
call fcn.10001720
jmp 0x100053b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005454
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000548c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1000548c
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10005488
push 1
pop eax
mov dword [0x10017a60], eax
jmp 0x1000548f
xor eax, eax
jmp 0x1000548f
push 1
pop eax
pop esi
ret 4

Function at 0x100055f8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], 0x8000
jae 0x10005616
push 1
pop eax
jmp 0x100056c0
test byte [esi + 0xc], 2
je 0x1000567d
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x10]
call fcn.10006f30
test eax, eax
je 0x100056c0
cmp dword [esi + 4], 0x101d1
jne 0x10005663
push 0x273
call fcn.10002c7c
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push dword [esi + 8]
push eax
call dword [0x10017680]
add esp, 0x10
jmp 0x1000567d
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push dword [esi + 8]
push eax
call dword [0x10017680]
add esp, 0xc
test byte [esi + 0xc], 1
je 0x10005698
lea eax, [ebp - 0x618]
push 0x208
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
call fcn.1000223c
lea eax, [ebp - 0x618]
push eax
push dword [esi + 4]
push dword [ebp + 8]
call dword [fcn.100076d0]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
pop esi
leave
ret 8
Function at 0x10005714
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x10017a68], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], edi
jne 0x10005767
push 0x10017a68
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 1
push 0x1001737c
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je fcn.10005973
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push 4
push dword [ebp + 8]
call esi
test eax, eax
jne fcn.10005973
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp eax, 0x7a
jne fcn.10005973
push dword [ebp - 0x1c]
call fcn.10002ff8
cmp eax, edi
mov dword [ebp - 0x10], eax
je fcn.10005973
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x1c]
push eax
push 4
push dword [ebp + 8]
call esi
test eax, eax
je fcn.10005973
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je fcn.10005973
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je fcn.10005973
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 8
mov dword [ebp - 4], edi
cmp word [eax + 4], di
pop ebx
jbe 0x10005853
Function at 0x10005801
Capabilities:
Compare security identifiers

Disassembly:
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x10005844
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
push dword [0x10017a68]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1000583a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], 1
or dword [eax + 4], ecx
push dword [ebp - 0xc]
call esi
add eax, 8
add ebx, eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 4]
movzx ecx, word [eax + 4]
cmp dword [ebp - 4], ecx
jb fcn.10005801
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call fcn.10002e48
test eax, eax
je fcn.10005973
cmp dword [ebp - 0x20], edi
jne 0x1000594d
push dword [0x10017a68]
call esi
add eax, 8
add ebx, eax
mov esi, ebx
shl esi, 2
push esi
call fcn.10002ff8
cmp eax, edi
mov dword [ebp - 8], eax
je fcn.10005973
push 2
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je fcn.10005973
push dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_IsValidAcl]
call ebx
test eax, eax
je fcn.10005973
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov dword [ebp - 4], edi
cmp word [eax + 4], di
jbe 0x1000590d
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je fcn.10005973
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 8]
push ecx
push dword [eax + 4]
push 2
push dword [ebp - 8]
call esi
test eax, eax
je fcn.10005973
push dword [ebp - 8]
call ebx
test eax, eax
je fcn.10005973
mov eax, dword [ebp - 0x18]
inc dword [ebp - 4]
movzx ecx, word [eax + 4]
cmp dword [ebp - 4], ecx
jb 0x100058ca
mov eax, dword [ebp + 0xc]
push dword [0x10017a68]
or al, 4
push eax
push 2
push dword [ebp - 8]
call esi
test eax, eax
je fcn.10005973
push dword [ebp - 8]
call ebx
test eax, eax
je fcn.10005973
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je fcn.10005973
push edi
push dword [ebp - 8]
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je fcn.10005973
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je fcn.10005973
push dword [ebp - 0x14]
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je fcn.10005973
mov dword [ebp - 0x24], 1

Function at 0x100059c4
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [ebp + 0xc], 1
jne 0x10005b08
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], 0
Function at 0x10005a91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 1
test eax, eax
je 0x10005a96
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
mov byte [ebp - 0x20c], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
test ecx, ecx
jne 0x10005a1d
jmp 0x10005a96
mov edx, dword [ebp - 0x208]
xor edx, 0x39171
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x208]
shr eax, 0xf
mov ecx, dword [ebp - 0x208]
shl ecx, 0x11
or eax, ecx
mov dword [ebp - 0x208], eax
mov edx, dword [ebp - 0x20c]
and edx, 0xff
mov eax, dword [ebp - 0x208]
sub eax, edx
mov dword [ebp - 0x208], eax
mov word [ebp - 0x210], 0x9c2f
mov word [ebp - 0x214], 0xa32d
movsx ecx, word [ebp - 0x210]
mov edx, dword [ebp - 0x214]
and edx, 0xffff
cmp ecx, edx
jne fcn.10005a91
call fcn.10002bb8
jmp 0x100059ea
cmp dword [ebp - 0x208], 0xeb432ce8
je 0x10005af1
cmp dword [ebp - 0x208], 0xd9ea21f7
je 0x10005af1
cmp dword [ebp - 0x208], 0xd72cf3cf
je 0x10005af1
cmp dword [ebp - 0x208], 0x6a3a31e1
je 0x10005af1
cmp dword [ebp - 0x208], 0x6b1941eb
je 0x10005af1
cmp dword [ebp - 0x208], 0xd234c2e7
je 0x10005af1
cmp dword [ebp - 0x208], 0xcdee4a8e
je 0x10005af1
mov byte [0x10020588], 0x17
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10005f50
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10005cdc
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [esp + 8], 0
je 0x10005d00
mov eax, dword [0x10020770]
push dword [esp + 8]
test eax, eax
je 0x10005cf4
call eax
jmp 0x10005d00
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
ret 8
Function at 0x10006380
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x164
push ebx
push ebp
push esi
push edi
mov edi, 0xf003f
mov ebp, 0x80000002
push edi
push 1
push 0x100072f6
push ebp
call fcn.10001b28
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x1000688a
cmp dword [0x1002066c], ebx
jne 0x10006516
push esi
call section..text
test eax, eax
je 0x1000688a
cmp dword [0x1002066c], ebx
jne 0x10006516
push 3
push 0x100027d0
push esi
call fcn.10002ca0
push 0xa
push 0x100070ad
push esi
call fcn.10002ca0
push 0x1e
push 0x10005109
push esi
call fcn.10002ca0
push ebx
push fcn.10006719
push esi
call fcn.10002ca0
push 1
push fcn.10006380
push esi
call fcn.10002ca0
push 1
push fcn.10002d84
push esi
call fcn.10002ca0
push 1
push fcn.100031e0
push esi
call fcn.10002ca0
push fcn.10003bb0
push fcn.10006248
push esi
call fcn.10002d6c
push ebx
push 0x100010f4
push esi
call fcn.10002ca0
push 0x14
push 0x10006c9e
push esi
call fcn.10002ca0
push 7
push fcn.10003b58
push esi
call fcn.10002ca0
cmp dword [0x10020694], ebx
je 0x10006489
push 1
push fcn.10006380
push esi
call fcn.10002ca0
push 0x100179a4
push 0x10001d6b
push esi
call fcn.10002d6c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1002066c], ebx
jne 0x10006516
push edi
push 1
push 0x10003afc
push ebp
call fcn.10001b28
xor ecx, ecx
cmp dword [0x1002075c], ebx
mov dword [esp + 0x18], eax
jbe 0x1000650c
mov dword [esp + 0x14], ebx
mov eax, dword [0x10017b44]
mov edx, dword [esp + 0x14]
push 0x100206d8
push 0x100206b8
push 0x10020698
add eax, edx
push dword [0x1002068c]
lea esi, [ecx + 1]
push 0x10017964
push 0x100178b4
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 0x14]
push esi
push dword [eax + 0x10]
push dword [eax]
push dword [esp + 0x48]
call fcn.10006b7d
mov ecx, esi
add dword [esp + 0x14], 0x18
cmp ecx, dword [0x1002075c]
jb 0x100064b8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
push fcn.10007274
push ebp
call fcn.10001b28
mov esi, eax
cmp esi, ebx
je 0x1000688a
push 0x217
call fcn.10002c7c
push eax
mov eax, fcn.10005ec4
push 0x100073f0
push eax
push eax
push esi
call fcn.10001ebb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
push fcn.100070f5
push ebp
call fcn.10001b28
mov esi, eax
cmp esi, ebx
je 0x1000688a
mov eax, fcn.10006248
push fcn.10006fec
push eax
push eax
push esi
call fcn.10006380
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push edi
push 1
push fcn.10003c72
push ebp
call fcn.10001b28
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x100066c1
lea ecx, [esp + 0x14]
push ecx
push fcn.10003bb0
push fcn.10006ff4
push eax
call fcn.10002ebe
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x100066bb
mov esi, eax
mov dword [esp + 0x10], ebx
mov ebp, fcn.10002d6c
cmp word [esi], bx
je fcn.100065f8
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
pop ecx
test eax, eax
pop ecx
je 0x100065f0
push esi
call dword [0x10007a18]
lea esi, [esi + eax*2 + 2]
pop ecx
cmp esi, ebx
jne 0x100065cb
jmp fcn.100065f8
mov dword [esp + 0x10], 1
Function at 0x100065f8
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [esp + 0x10], ebx
jne 0x100066a7
push dword [esp + 0x18]
mov esi, dword [0x10007a18]
call esi
lea eax, [eax + eax + 2]
pop ecx
mov dword [esp + 0x10], eax
mov eax, ebp
test eax, eax
je 0x10006627
push ebp
call esi
pop ecx
lea eax, [eax + eax + 2]
jmp 0x10006629
xor eax, eax
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx + 0x10]
push eax
call fcn.10002ff8
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x100066a7
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
lea eax, [eax + ecx - 2]
push eax
call dword [fcn.100076d0]
mov eax, ebp
pop ecx
test eax, eax
pop ecx
je 0x1000667d
push ebp
call dword [0x10007a18]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x1000667f
xor eax, eax
add dword [esp + 0x14], eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push fcn.10006ff4
push dword [esp + 0x28]
call fcn.10006719
push dword [esp + 0x10]
call fcn.100052f4
mov edi, 0xf003f
push dword [esp + 0x18]
call fcn.100052f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 0x80000002
push dword [esp + 0x1c]
call esi
cmp dword [0x1002066c], ebx
jne fcn.10006719
push edi
push 1
push 0x10006c9e
push 0x80000001
call fcn.10001b28
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x1000688a
push 0x22f
call fcn.10002c7c
push eax
push 0x10020600
push dword [esp + 0x24]
call fcn.10001b28
push section..text
push 0x100065cb
push dword [esp + 0x24]
call fcn.10002d6c
push dword [esp + 0x1c]
call esi
xor eax, eax
jmp 0x100068d9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret 4
Function at 0x10006719
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push edi
push 1
push fcn.1000540c
push ebp
call fcn.10001b28
mov edi, eax
cmp edi, ebx
je 0x1000688a
push 0x10006c9e
push 0x10002769
push edi
call fcn.10001b28
push 0x10001e03
push fcn.10003a80
push edi
call fcn.10001b28
push fcn.10004f90
push 0x100011bf
push edi
call fcn.10001b28
push 0x10001e9b
push 0x10007320
push edi
call fcn.10001b28
push edi
call esi
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push 0x10006629
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10006884
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [esp + 0x74]
push 0x10001b0f
push eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x64], 0x101
mov word [esp + 0x68], bx
call dword [fcn.100076d0]
pop ecx
lea eax, [esp + 0x24]
pop ecx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 8
push 1
push ebx
lea eax, [esp + 0x90]
push ebx
push eax
push ebx
call ebp
cmp eax, ebx
je 0x10006884
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
cmp dword [0x10020664], ebx
je 0x1000682c
push fcn.10002ff8
call fcn.1000540c
cmp eax, ebx
jne 0x10006846
jmp 0x1000688a
push 0x10007079
mov dword [esp + 0x14], 0x10002f20
call fcn.1000540c
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x78]
push eax
call dword [fcn.100076d0]
pop ecx
lea eax, [esp + 0x24]
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [0x10020664]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x20]
push eax
push ebx
push 8
push 1
push ebx
lea eax, [esp + 0x90]
push ebx
push eax
push ebx
call ebp
cmp eax, ebx
jne 0x1000688e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
push esi
call edi
push ebx
push ebx
push ebx
push 0x10017598
push fcn.10002607
push 0x26e
call fcn.10002c7c
push eax
push 0x26d
call fcn.10002c7c
push eax
push fcn.10003c72
call fcn.10001e69
push 1
pop eax
Function at 0x1000682c
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push edi
push 1
push fcn.1000540c
push ebp
call fcn.10001b28
mov edi, eax
cmp edi, ebx
je 0x1000688a
push 0x10006c9e
push 0x10002769
push edi
call fcn.10001b28
push 0x10001e03
push fcn.10003a80
push edi
call fcn.10001b28
push fcn.10004f90
push 0x100011bf
push edi
call fcn.10001b28
push 0x10001e9b
push 0x10007320
push edi
call fcn.10001b28
push edi
call esi
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push 0x10006629
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10006884
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [esp + 0x74]
push 0x10001b0f
push eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x64], 0x101
mov word [esp + 0x68], bx
call dword [fcn.100076d0]
pop ecx
lea eax, [esp + 0x24]
pop ecx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 8
push 1
push ebx
lea eax, [esp + 0x90]
push ebx
push eax
push ebx
call ebp
cmp eax, ebx
je 0x10006884
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
cmp dword [0x10020664], ebx
je 0x1000682c
push fcn.10002ff8
call fcn.1000540c
cmp eax, ebx
jne 0x10006846
jmp 0x1000688a
push 0x10007079
mov dword [esp + 0x14], 0x10002f20
call fcn.1000540c
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x78]
push eax
call dword [fcn.100076d0]
pop ecx
lea eax, [esp + 0x24]
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [0x10020664]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x20]
push eax
push ebx
push 8
push 1
push ebx
lea eax, [esp + 0x90]
push ebx
push eax
push ebx
call ebp
cmp eax, ebx
jne 0x1000688e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
push esi
call edi
push ebx
push ebx
push ebx
push 0x10017598
push fcn.10002607
push 0x26e
call fcn.10002c7c
push eax
push 0x26d
call fcn.10002c7c
push eax
push fcn.10003c72
call fcn.10001e69
push 1
pop eax
Function at 0x100068e8
Capabilities:
Accept command line arguments
Delete file
Delete registry value
Get file attributes
Move file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.100010fc
cmp dword [0x10020664], ebx
je 0x1000691b
push 0x10007689
call fcn.10001ad0
cmp dword [0x1002075c], ebx
jbe 0x10006922
mov dword [ebp - 4], 1
lea eax, [ebp - 0x410]
push 0x100
push eax
push 0x10002769
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x410]
push eax
call fcn.10005454
cmp dword [0x10020664], ebx
je 0x1000699b
push 0xf003f
push 1
push 0x10002c16
push 0x80000002
call fcn.10001b28
mov edi, eax
push fcn.10003bb0
push 0x10006c9e
push edi
call fcn.1000355f
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x1000699b
cmp word [esi], bx
je 0x1000699b
push esi
push 0x100206f8
call dword [fcn.100076d0]
pop ecx
pop ecx
push esi
call fcn.100052f4
push 0x204
call fcn.10005260
push dword [ebp + 0xc]
call fcn.10006380
test eax, eax
je 0x100069ba
call fcn.10005028
test eax, eax
jne fcn.100069c4
mov esi, 0x1f6
jmp 0x10006c6d

Function at 0x10006922
Capabilities:
Accept command line arguments
Delete file
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.100010fc
cmp dword [0x10020664], ebx
je 0x1000691b
push 0x10007689
call fcn.10001ad0
cmp dword [0x1002075c], ebx
jbe 0x10006922
mov dword [ebp - 4], 1
lea eax, [ebp - 0x410]
push 0x100
push eax
push 0x10002769
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x410]
push eax
call fcn.10005454
cmp dword [0x10020664], ebx
je 0x1000699b
push 0xf003f
push 1
push 0x10002c16
push 0x80000002
call fcn.10001b28
mov edi, eax
push fcn.10003bb0
push 0x10006c9e
push edi
call fcn.1000355f
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x1000699b
cmp word [esi], bx
je 0x1000699b
push esi
push 0x100206f8
call dword [fcn.100076d0]
pop ecx
pop ecx
push esi
call fcn.100052f4
push 0x204
call fcn.10005260
push dword [ebp + 0xc]
call fcn.10006380
test eax, eax
je 0x100069ba
call fcn.10005028
test eax, eax
jne fcn.100069c4
mov esi, 0x1f6
jmp 0x10006c6d