joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b917
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ebx, [esi + 0x1c]
push ebx
push edi
push 4
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005b994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
jne 0x1005b97f
push dword [esi + 0x3c]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
jne 0x1005b983
push eax
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1005b994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x1005b994
push dword [esi + 0x10]
mov byte [esi + 0x39], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005cbc0
Capabilities:
Modify service

Disassembly:
push 0x10
mov eax, 0x100af0e1
call fcn.100a5688
mov ebx, ecx
and dword [ebp - 0x14], 0
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008e796
xor eax, eax
push 0xf003f
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1005cc0c
push 0x1000ff04
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
mov byte [ebp - 4], 1
jmp 0x1005cc7a
push 2
push dword [ebx + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1005cc32
push 0x1001404c
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
mov byte [ebp - 4], 2
jmp 0x1005cc7a
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x1005cc69
mov edi, dword [ebx + 0xc]
push 0x10014158
push 4
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100d0614]
mov ecx, edi
call esi
jmp 0x1005cc92
push 0x10013fa0
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x10]
call fcn.1006f350
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
push 0x100141f8
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1005ca56
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
call fcn.100a5651
ret
Function at 0x1005d943
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov bh, 1
and dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
add eax, 0x3a98
mov dword [ebp - 8], eax
jmp 0x1005d9c2
mov eax, dword [ebp + 0xc]
cmp dword [esi + 4], eax
je 0x1005d9e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 8], eax
jb 0x1005d9db
test bh, bh
je 0x1005d983
mov edi, dword [esi + 4]
xor bh, bh
jmp 0x1005d995
cmp edi, dword [esi + 4]
je 0x1005d98d
mov edi, dword [esi + 4]
jmp 0x1005d995
mov eax, dword [ebp - 4]
cmp dword [esi + 0x14], eax
jb 0x1005d9d7
mov eax, dword [esi + 0x14]
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x18]
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x1005d9b0
mov eax, ecx
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1005d9bb
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne bl
test bl, bl
jne 0x1005d965
jmp 0x1005d9e8
xor bl, bl
jmp 0x1005d9e8
push 0x5b4
xor bl, bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10060b0f
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af8b5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x100c6014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ebx, [esi + 8]
mov dword [esi], 0x1001f6b4
push dword [ebx]
lea ecx, [ebp - 0x1c]
call fcn.1006f4e2
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x100216b4
test eax, eax
je 0x10060b79
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.1008e51a
push eax
push edi
mov ecx, ebx
call fcn.1008e48f
lea ebx, [esi + 0xc]
push dword [ebx]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], ebx
call fcn.1006f4e2
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10060c64
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10060c64
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [eax - 0xc]
lea eax, [esi + 1]
push eax
call fcn.1008e6a9
mov edx, eax
lea edi, [ebp - 0x3c]
xor eax, eax
push 6
pop ecx
mov word [edx + esi*2 + 2], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x414
and dword [ebp - 0x40], 0
and dword [ebp - 0x34], 0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.1008e388
test esi, esi
je 0x10060c4c
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008e796
push esi
push dword [ebx]
lea eax, [ebp - 0x14]
push 0x100153e8
push eax
call fcn.1008e3f3
mov ebx, dword [ebp - 0x18]
add esp, 0x10
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebx + 4]
push esi
push 1
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x100d0614]
mov ecx, ebx
call edi
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov ebx, dword [ebp - 0x20]
mov esi, 0x100216b4
mov ecx, esi
call fcn.1008e51a
push eax
push esi
mov ecx, ebx
call fcn.1008e48f
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.1008ebf5
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.1008ebf5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10060cd0
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x100af8e8
call fcn.100a5688
push dword [ecx + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1006f4e2
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
and dword [ebp - 4], 0
push dword [eax]
call fcn.1006f4e2
xor ebx, ebx
lea ecx, [ebp - 0x14]
inc ebx
mov byte [ebp - 4], bl
call fcn.1006e850
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.1006e97f
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10060d49
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.1006f350
lea ecx, [esi - 0x10]
call fcn.1008ebf5
jmp 0x10060d53
mov ecx, dword [ebp + 0xc]
call fcn.1008e407
xor bl, bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov al, bl
call fcn.100a5651
ret 8
Function at 0x100614e8
Capabilities:
Initialize winhttp library
Prepare http request
Read http header
Receive http response

Disassembly:
push 0x18
mov eax, 0x100afa44
call fcn.100a5688
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10015710
mov bh, al
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
test eax, eax
je 0x10061689
push 0
push 0x50
lea ecx, [ebp + 0x4a]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, eax
lea ecx, [ebp - 0x24]
lea eax, [ebp + 0x1452]
push eax
call fcn.1006f4e2
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp + 0x450]
push eax
lea ecx, [ebp - 0x20]
call fcn.1006f4e2
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1006eb5a
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
test edi, edi
je 0x1006167e
push 0x100
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x1c]
push 0x10015750
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x1006167e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
setne bh
test bh, bh
je 0x1006167e
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne bh
test bh, bh
je 0x1006167e
push 0x32
xor bh, bh
call fcn.1009170d
pop ecx
push 0
mov edi, eax
mov dword [ebp - 0x10], 0x32
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push edi
push 0
push 0x13
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
lea ecx, [ebp - 0x18]
push edi
setne bl
call fcn.1006f4e2
mov byte [ebp - 4], 5
test bl, bl
je 0x10061673
push 0
push 0x10015758
lea ecx, [ebp - 0x18]
call fcn.1006eee7
cmp eax, 0xffffffff
je 0x10061673
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x10], 0x32
rep stosd dword es:[edi], eax
push 0
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push eax
push edi
push 0
push 1
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
lea ecx, [ebp - 0x14]
push edi
setne bl
call fcn.1006f4e2
test bl, bl
je 0x10061668
push 0
push 0x10015760
lea ecx, [ebp - 0x14]
call fcn.1006eee7
cmp eax, 0xffffffff
je 0x10061668
inc bh
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov al, bh
call fcn.100a5651
ret 0x246c
Function at 0x100638c8
Capabilities:
Check os version
Shutdown system

Disassembly:
push 0x138
mov eax, 0x100afed5
call fcn.100a56bc
push 0x110
xor esi, esi
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.10093d90
add esp, 0xc
mov dword [ebp - 0x134], 0x114
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 2
pop ebx
test eax, eax
je 0x10063a16
cmp dword [ebp - 0x124], ebx
jne 0x10063a16
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x13c]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edi, edi
inc edi
test eax, eax
je 0x10063984
lea eax, [ebp - 0x144]
push eax
push 0x10015be8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x144]
push esi
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x140]
push esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x13c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100216b4
lea ecx, [ebp - 0x138]
call fcn.1006f4e2
mov dword [ebp - 4], esi
cmp dword [ebp - 0x130], 5
ja 0x100639d7
jne 0x100639ab
cmp dword [ebp - 0x12c], 0
ja 0x100639d7
mov eax, dword [ebp - 0x138]
cmp dword [eax - 4], edi
jle 0x100639ca
push dword [eax - 0xc]
lea ecx, [ebp - 0x138]
call fcn.1008e57b
mov eax, dword [ebp - 0x138]
push edi
push esi
push esi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
jmp 0x10063a06
mov eax, dword [ebp - 0x138]
cmp dword [eax - 4], edi
jle 0x100639f6
push dword [eax - 0xc]
lea ecx, [ebp - 0x138]
call fcn.1008e57b
mov eax, dword [ebp - 0x138]
push SysReAllocString
push edi
push esi
push esi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
jmp 0x10063a1e
push esi
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.100a5666
ret
Function at 0x1006405b
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x100b0056
call fcn.100a5688
mov esi, edx
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.100308bd
and dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push 0x10016258
lea ecx, [ebp - 0x1c]
call fcn.1006eafe
push 0x10016208
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.1006eafe
push 0x100161a8
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.1006eafe
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov eax, dword [edi]
push dword [ebp - 0x10]
push esi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100d0614]
mov ecx, edi
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x34]
call fcn.1002e7ee
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.1002eb94
test al, al
jne 0x1006411e
push 0
push 0x10007088
lea ecx, [ebp - 0x30]
call fcn.1002e39c
test al, al
jne 0x1006411e
push 0x10
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x34]
call fcn.1002eb70
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
call fcn.100a5651
ret
Function at 0x100642b5
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x100b00a1
call fcn.100a5688
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov dword [ebp - 0x24], esi
xor eax, eax
mov edi, 0x100c9520
push eax
push 0x100c9400
push edi
push eax
push esi
mov dword [ebp - 0x14], eax
call fcn.100a698d
xor ebx, ebx
add esp, 0x14
inc ebx
test eax, eax
je 0x10064305
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.1003ebb2
mov ecx, ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x10064308
mov byte [ebp - 0xd], bl
jmp 0x1006430c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0xd], 0
test bl, cl
je 0x1006431b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
cmp byte [ebp - 0xd], 0
je 0x10064457
push 0
push 0x100c9500
push edi
push 0
push esi
call fcn.100a698d
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1006445f
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008e796
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.10042880
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
mov ecx, dword [ebp - 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.1008ebf5
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.10042880
test esi, esi
je 0x100643ad
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.10030831
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push dword [esi]
push dword [eax]
call fcn.1006e93f
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
jmp 0x100643ba
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.1006f350
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1006444f
push eax
push 0x100c93a0
push 0x100c9520
push eax
push dword [ebp - 0x24]
call fcn.100a698d
add esp, 0x14
test eax, eax
je 0x100643fb
cmp dword [eax + 0x134], 5
je 0x1006444f
push 0x10016358
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.1006eb5a
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 4], 5
push dword [eax]
mov ecx, dword [ebx]
push 0
mov edi, dword [ecx + 4]
mov ecx, edi
call dword [0x100d0614]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x18]
xor bl, bl
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov al, bl
call fcn.100a5651
ret
mov ebx, dword [ebp - 0x1c]
push 0x10016438
push 0
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100d0614]
mov ecx, ebx
call esi
xor al, al
jmp 0x10064459
Function at 0x100649c0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x10064aa8
push 0x10016540
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
jne 0x100649e6
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016550
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
test eax, eax
jne 0x10064a00
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016560
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x10064a1c
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10016578
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10064a38
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001658c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10064a54
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100165a4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x10064a70
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100165b4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x10064a8c
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100165c8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10064aa8
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
ret

Function at 0x10064d08
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x1001af20
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 4]
sub ecx, 0x10
pop esi
jmp fcn.1008ebf5
Function at 0x10065726
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x100b02b6
call fcn.100a5688
mov edi, ecx
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008e796
and dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [ebp - 0x14]
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x10065769
push edx
lea ecx, [ebp - 0x14]
call fcn.1008e652
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.100324d7
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008e796
mov ebx, 0x10006fe0
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.1008e51a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073de3
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.10073de3
mov ecx, ebx
call fcn.1008e51a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073de3
mov ebx, 0x10016794
mov ecx, ebx
call fcn.1008e51a
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.10073de3
mov ecx, dword [edi + 4]
call fcn.1008e51a
push eax
push dword [edi + 4]
lea ecx, [ebp - 0x10]
call fcn.10073de3
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10093d90
mov edi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x70], 0x44
cmp dword [edi - 4], 1
jle 0x10065817
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.1008e57b
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10065862
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 7
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.1008ebf5
lea ecx, [esi - 0x10]
call fcn.1008ebf5
call fcn.100a5651
ret
Function at 0x100662be
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x100b053c
call fcn.100a5688
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0x1001acf0
xor ebx, ebx
mov dword [edi + 4], 0x1002143c
mov dword [edi + 8], ebx
mov byte [edi + 0xc], bl
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x24], ebx
mov byte [edi + 0x28], bl
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x20], 0x100213ec
mov byte [ebp - 4], 1
push 0xc00
mov dword [edi + 0x3c], ebx
call fcn.1009171b
pop ecx
mov dword [ebp - 0x10], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100328eb
mov byte [ebp - 4], 1
mov dword [0x100cfe78], eax
call fcn.1003240a
push 4
call fcn.1009171b
mov dword [ebp - 0x10], eax
mov dword [esp], 0x1002168c
mov dword [eax], 0x1001a7e8
mov dword [0x100cfd74], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10066387
push 0x10018b5c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x10], 0x20000
test esi, esi
je 0x10066387
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call dword [0x100d0614]
call esi
push 0x10073f70
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1002e7ee
mov byte [ebp - 4], 3
call fcn.1007b0b6
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.1002ebc5
mov ecx, dword [0x100cfe78]
neg al
push ebx
sbb al, al
inc al
mov byte [ecx], al
lea ecx, [ebp - 0x28]
mov eax, dword [0x100cfe78]
push 0x10007088
mov dword [eax + 0x990], esi
call fcn.1002e39c
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.1002eb94
mov ecx, dword [0x100cfe78]
mov dword [ecx + 0xbf0], 1
test bl, bl
je 0x10066403
mov dword [ecx + 0xbf0], 3
test al, al
je 0x10066411
mov dword [ecx + 0xbf0], 2
lea ecx, [ebp - 0x2c]
call fcn.1002eb70
mov eax, edi
call fcn.100a5651
ret