joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18041a8a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815dee0
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18041c7b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.181370e0
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180426b3
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18041b11
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x18041c7b
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x18041b23
mov eax, edi
jmp 0x18041c7d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18041b48
call fcn.1801bab5
mov esi, eax
jmp 0x18041c77
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18083acc
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x18041b7e
call fcn.1801bab5
mov esi, eax
jmp 0x18041c62
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18044206
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18041bf1
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18041bb0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b0f30
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041c45
call fcn.1801bab5
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18041c50
push esi
call fcn.18122ce3
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x18041c7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122438
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18041c90
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18041d34
call fcn.1804278f
test al, al
jne 0x18041d34
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18041cd7
call fcn.1801bab5
mov ebx, eax
jmp 0x18041d30
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083acc
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18041d0c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041d17
call fcn.1801bab5
mov ebx, eax
test esi, esi
je 0x18041d1e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18041d36
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret
Function at 0x18041f5e
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815dee0
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015cbc
test al, al
je 0x1804214f
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.181370e0
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18042b1c
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18041fe5
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x1804214f
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x18041ff7
mov eax, edi
jmp 0x18042151
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1804201c
call fcn.1801bab5
mov esi, eax
jmp 0x1804214b
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18083a0f
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x18042052
call fcn.1801bab5
mov esi, eax
jmp 0x18042136
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18044206
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x180420c5
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18042084
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b0f30
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18042119
call fcn.1801bab5
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18042124
push esi
call fcn.18122ce3
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x18042151
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122438
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18042164
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18042208
call fcn.18042bf8
test al, al
jne 0x18042208
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180421ab
call fcn.1801bab5
mov ebx, eax
jmp 0x18042204
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083a0f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180421e0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x180421eb
call fcn.1801bab5
mov ebx, eax
test esi, esi
je 0x180421f2
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1804220a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret

Function at 0x18042867
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18043524
test al, al
je 0x1804288f
xor eax, eax
jmp 0x18042942
call fcn.18041ddb
mov esi, eax
mov ecx, esi
call fcn.1801cd4c
test esi, esi
jns 0x180428ab
lfence
mov eax, esi
jmp 0x18042942
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180428d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042940
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042940
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083acc
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1804290e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18042927
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042923
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1804292e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret
Function at 0x18042cd0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.180436d2
test al, al
je 0x18042cf8
xor eax, eax
jmp 0x18042dab
call fcn.180422af
mov esi, eax
mov ecx, esi
call fcn.1801cd4c
test esi, esi
jns 0x18042d14
lfence
mov eax, esi
jmp 0x18042dab
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18042d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042da9
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042da9
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083a0f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18042d77
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18042d90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042d8c
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18042d97
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret

Function at 0x18042dba
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x18042dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042e74
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042e74
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083a0f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18043646
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18042e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042e5a
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042e5a
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret
Function at 0x18043be5
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.1800790f
push dword [eax + 4]
push dword [eax]
call fcn.1813e9fb
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x18043c4b
push eax
call fcn.18146781
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x18043c7a
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122438
leave
ret

Function at 0x18043f13
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d7f60
push edi
mov edi, ecx
cmp dword [0x181d7f60], ebx
je 0x18043f54
push ecx
mov ecx, esi
call fcn.1803c975
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x18043fc2
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18043f36
lfence
cmp byte [edi + 0x3c], 0
je 0x18043fd0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18043fc9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18044120
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18043f97
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18043fc9
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043fb9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18043fd8
lfence
mov eax, ebx
jmp 0x18043fe3
mov esi, 0x80004005
jmp 0x18043fdc
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043fe1
call fcn.18043ecf
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret 4
Function at 0x1804403a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d8030
push edi
mov edi, ecx
cmp dword [0x181d8030], ebx
je 0x1804407b
push ecx
mov ecx, esi
call fcn.1803c975
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x180440e9
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x1804405d
lfence
cmp byte [edi + 0x3c], 0
je 0x180440f7
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x180440f0
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18044120
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x180440be
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180440f0
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180440e0
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180440ff
lfence
mov eax, ebx
jmp 0x1804410a
mov esi, 0x80004005
jmp 0x18044103
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18044108
call fcn.18043ff6
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret 4

Function at 0x1804761b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.18048cd9
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18047645
mov ecx, edi
call fcn.18087a04
push 0x24
push edi
call fcn.18122966
pop ecx
pop ecx
mov ecx, dword [0x181dbefc]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803f08e
Function at 0x1804a10c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
push ebx
push esi
mov byte [ebp - 0x41], cl
mov bh, dl
push edi
lea ecx, [ebp - 0x14]
call fcn.18014e95
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push edi
call fcn.180074fa
mov bl, byte [ebp + 8]
mov eax, str.MicrosoftEdgeComRegisterShellARM64.exe
test bl, bl
jne 0x1804a151
mov eax, str.MicrosoftEdgeUpdateComRegisterShell64.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.1800f7f4
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x1804a16d
call fcn.1801bab5
mov ebx, eax
jmp 0x1804a26f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1804a182
mov ebx, 0x80070002
jmp 0x1804a26f
and dword [ebp - 0xc], 0
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
mov eax, 0x18176bdc
mov edx, eax
test bh, bh
jne 0x1804a1a4
mov edx, str._unregister
cmp byte [ebp - 0x41], 0
mov ecx, eax
jne 0x1804a1b1
mov ecx, str._user
test bl, bl
je 0x1804a1ba
mov eax, str._arm64
push edx
push ecx
push eax
lea eax, [ebp - 0xc]
push str._s__s__s
push eax
call fcn.18016b2d
add esp, 0x14
lea eax, [ebp - 0x40]
push 0x2c
push 0
push eax
call fcn.181370e0
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.180177a2
push 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x40]
call fcn.18017910
mov ebx, eax
test ebx, ebx
jns 0x1804a23c
movzx ecx, byte [0x181dc05a]
neg ecx
sbb ecx, ecx
and ecx, 0x181dbf50
je 0x1804a25c
push 7
pop edx
push 0xfffffffffffffffe
pop eax
lfence
push eax
push edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
call fcn.18008b5d
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push str._Failed_to_start_COM_register_process__0x_x_
push eax
call fcn.18007230
add esp, 0xc
jmp 0x1804a25c
push 0x7530
lea ecx, [ebp - 0x40]
call fcn.18017a64
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x40]
call fcn.180178c8
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea ecx, [esi - 0x10]
call fcn.18006f72
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret
Function at 0x1804b9ba
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.18049ee0
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x1804b9f0
cmp dword [edi], ebx
je 0x1804b9f0
push ecx
mov ecx, edi
call fcn.1803c975
test eax, eax
js 0x1804ba5d
add edi, 0x24
jne 0x1804b9db
lfence
cmp byte [esi + 0x3c], bl
je 0x1804ba69
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x1804ba62
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x1804e4a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1804ba32
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], ebx
test ebx, ebx
je 0x1804ba62
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804ba54
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1804ba71
lfence
jmp 0x1804ba7e
mov edi, 0x80004005
jmp 0x1804ba75
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804ba7c
mov ecx, esi
call fcn.18049ffd
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret 4
Function at 0x1804f63c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x1804f668
mov eax, 0x80070057
jmp 0x1804f6dd
mov dword [ebp - 0xc], esi
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
push dword [edi]
lea eax, [ebp - 0xc]
push str._s_last.dmp
push eax
call fcn.18016b2d
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
add edx, 4
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.1801648c
mov eax, dword [ebp - 8]
add esp, 0x10
cmp dword [eax - 0xc], esi
jne 0x1804f6b0
mov esi, 0x80040709
jmp 0x1804f6c8
push esi
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1804f6c5
call fcn.1801bab5
mov esi, eax
mov eax, dword [ebp - 8]
lea ecx, [eax - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18006f72
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret 8
Function at 0x1804f6ee
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x60]
push 0x14
pop ecx
mov esi, str.____________________________________.dmp
lea edx, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [eax + 4]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.18010903
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x1804f741
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
jmp 0x1804f80e
call fcn.18011f9e
mov edi, dword [ebp - 0x68]
mov ebx, esi
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, edi
sub eax, esi
mov dword [ebp - 0x7c], edx
cmp eax, 4
jb 0x1804f80c
push ecx
xor edi, edi
lea edx, [ebp - 0x74]
push ecx
mov ecx, dword [esi + ebx*4]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
call fcn.18010eea
pop ecx
pop ecx
test eax, eax
js 0x1804f7f6
mov edx, dword [ebp - 0x70]
xor ecx, ecx
or ecx, dword [ebp - 0x74]
or edx, edi
mov eax, dword [ebp - 0x78]
sub eax, ecx
mov dword [ebp - 0x90], edi
mov ecx, dword [ebp - 0x7c]
sbb ecx, edx
mov dword [ebp - 0x88], eax
mov eax, ecx
and ecx, 0x7fffffff
mov dword [ebp - 0x84], ecx
and eax, 0x80000000
fild qword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
push ecx
push ecx
fild qword [ebp - 0x90]
fchs
faddp st(1)
fstp qword [ebp - 0x98]
fld qword [ebp - 0x98]
fstp qword [esp]
call fcn.18144836
fcomp qword [0x181cd640]
fnstsw ax
pop ecx
pop ecx
test ah, 1
jne 0x1804f7f6
mov eax, dword [ebp - 0x6c]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x68]
inc ebx
mov esi, dword [ebp - 0x6c]
mov eax, edi
sub eax, esi
sar eax, 2
cmp ebx, eax
jne 0x1804f761
xor ebx, ebx
test esi, esi
je 0x1804f83b
cmp esi, edi
je 0x1804f82a
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18006f72
add esi, 4
cmp esi, edi
jne 0x1804f816
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
sub ecx, esi
and ecx, 0xfffffffc
push ecx
push esi
call fcn.1800a1ed
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122438
leave
ret