joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6adc2510
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1058
call fcn.6adc70f0
sub esp, eax
mov eax, dword [esp + eax]
mov edi, eax
mov ecx, dword [esp + 0x1070]
mov ebx, dword [esp + 0x1074]
mov eax, dword [esp + 0x1078]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
test byte [eax + 0xa], 4
je 0x6adc2610
mov dword [esp + 0x28], edx
lea ebp, [esp + 0x50]
mov esi, 0x1000
mov ebx, ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0x16
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adc2690
cmp eax, 0x80000005
jne 0x6adc25b0
add esi, esi
cmp ebx, ebp
je 0x6adc2600
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.6adaef00
test eax, eax
je 0x6adc26f0
mov ebx, eax
jmp 0x6adc255c
mov edx, dword [esp + 0x28]
jl 0x6add84cb
cmp eax, 0xc0000004
jge 0x6adc25f0
cmp eax, 0xc0000002
jl 0x6add84cb
xor eax, eax
test dword [edx + 0x24], 0x410
je 0x6adc2621
cmp ebx, ebp
jne 0x6adc2675
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xc00000bb
je 0x6adc25cc
jmp 0x6add84cb
mov dword [esp], esi
call fcn.6adaeec0
jmp 0x6adc25a0
xor eax, eax
test dword [edx + 0x24], 0x410
jne 0x6adc25df
lea ebp, [esp + 0x50]
mov ebx, ebp
mov eax, dword [esp + 0x1078]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x40], 0x3a003a
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], edx
mov edx, 7
mov dword [esp], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x440024
mov dword [esp + 0x48], 0x540041
mov dword [esp + 0x4c], 0x41
call fcn.6adc2450
cmp ebx, ebp
je 0x6adc25df
mov dword [esp], ebx
mov dword [esp + 0x28], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x28]
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x3c]
xor eax, eax
test edx, edx
je 0x6adc25d7
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x1078]
mov dword [esp + 0x2c], ebp
jmp 0x6adc26b8
mov edx, dword [ebx]
test edx, edx
je 0x6adc2700
add ebx, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [ebx + 4]
mov dword [esp + 0xc], esi
lea eax, [ebx + 0x18]
mov dword [esp + 8], ecx
mov edi, dword [ebx + 8]
shr edx, 1
mov ebp, dword [ebx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.6adc2450
test eax, eax
je 0x6adc26b0
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc25d7
mov eax, 0x27
jmp 0x6adc25d7
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc25d7
mov ecx, dword [esp + 0x1078]
mov edx, dword [ecx]
mov edx, dword [edx + 0x80]
mov dword [esp], eax
mov dword [esp + 4], str.__ls_:_Failed_to_query_stream_information
add edx, 8
mov dword [esp + 8], edx
call fcn.6add8103
mov eax, 0x32
jmp 0x6adc25d7
Function at 0x6adc5470
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret

Function at 0x6adc5490
Capabilities:
Get memory capacity

Disassembly:
push edi
xor eax, eax
mov ecx, 0xf
push esi
push ebx
sub esp, 0x50
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, edx
cmp ebx, ecx
sbb edi, eax
cmovb eax, edx
cmovb ecx, ebx
xor edi, edi
imul esi, eax, 0x55
mov eax, 0x55
mul ecx
mov ebx, edx
mov ecx, eax
add ebx, esi
mov esi, eax
shrd eax, ebx, 0x14
and esi, 0xfffff
and eax, 0xfffff
add esi, eax
mov eax, ebx
shr eax, 8
and eax, 0xfffff
add esi, eax
mov eax, ebx
shr eax, 0x1c
add esi, eax
mov eax, 0x51eb851f
mul esi
shr edx, 3
lea eax, [edx + edx*4]
mov edx, ebx
lea eax, [eax + eax*4]
sub esi, eax
mov eax, ecx
sub eax, esi
sbb edx, edi
mov edi, 0xc28f5c29
add esp, 0x50
imul ecx, edx, 0xc28f5c29
pop ebx
pop esi
imul edx, eax, 0x8f5c28f5
add ecx, edx
mul edi
pop edi
add edx, ecx
shrd eax, edx, 2
shr edx, 2
ret
Function at 0x6adc5630
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x6adc5668
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
je 0x6adc56a0
call ebx
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, eax
mov eax, esi
call fcn.6adc4ec0
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov ecx, eax
lea eax, [eax + eax + 0x39]
shr eax, 4
shl eax, 4
call fcn.6adc70f0
sub esp, eax
mov dword [esp + 8], ecx
lea esi, [esp + 0x1b]
mov eax, dword [ebp + 0xc]
and esi, 0xfffffff0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6adc7880
mov dword [esp + 8], 5
mov dword [esp + 4], str..orig
mov dword [esp], eax
call fcn.6adc7880
mov dword [esp + 4], 9
mov dword [esp], eax
mov edi, eax
call fcn.6adaf170
xor eax, eax
mov word [edi + 0x12], ax
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x6adc5675
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
je 0x6adc5771
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x6adc565b
call fcn.6adc53f0
mov eax, dword [ebp + 8]
mov dword [esp], str.Atomic_semantics_not_respected_in_failed_rename____new_file_is_at___ls__
mov dword [esp + 4], eax
call fcn.6add5624
mov eax, 1
jmp 0x6adc565d
call fcn.6adc53f0
mov dword [esp + 4], esi
mov dword [esp], str.Failed_to_delete_original_file__moved_to___ls__
call fcn.6add5624
jmp 0x6adc5735
Function at 0x6adc57c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
pop ebx
pop esi
jmp 0x6adc51a0

Function at 0x6adc57f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, 0xffffffff
je 0x6adc58c8
mov ebx, 0x100000
mov esi, eax
mov dword [esp], 0
cmp edi, ebx
cmovbe ebx, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x6adc58a1
mov eax, dword [esp + 0x2c]
cmp ebx, eax
jb 0x6adc5878
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x240
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], str.result___count
call dword [0x6add9074]
mov eax, dword [esp + 0x2c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Error_reading__zu_bytes_from_fd__d
call fcn.6add80b9
mov eax, esi
call fcn.6adc5180
or eax, 0xffffffff
jmp 0x6adc5869

Function at 0x6adc58d0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, 0xffffffff
je 0x6adc59a8
mov ebx, 0x100000
mov esi, eax
mov dword [esp], 0
cmp edi, ebx
cmovbe ebx, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6adc5981
mov eax, dword [esp + 0x2c]
cmp ebx, eax
jb 0x6adc5958
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x258
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], str.result___count
call dword [0x6add9074]
mov eax, dword [esp + 0x2c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Error_writing__zu_bytes_to_fd__d
call fcn.6add80b9
mov eax, esi
call fcn.6adc5180
or eax, 0xffffffff
jmp 0x6adc5949
Function at 0x6adc5db0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
test ebx, ebx
je 0x6adc5de3
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x6add9074]
nop
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ADVAPI32.dll_SystemFunction036
sub esp, 8
test al, al
je 0x6adc5deb
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6adefb58
mov dword [esp], eax
call fcn.6add80b9
mov dword [esp + 8], 0x2f2
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], 0x6adefb9a
call edi
jmp 0x6adc5dd0

Function at 0x6adc65d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6add47a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6add47a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6adc6630
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6ae1f0a4]
test esi, esi
jle 0x6adc6750
mov eax, dword [0x6ae1f0a8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6adc6664
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6adc66e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6adc6650
mov dword [esp], ebx
call fcn.6adc6e10
mov edi, eax
test eax, eax
je 0x6adc6777
mov eax, dword [0x6ae1f0a8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6adc6f50
mov edx, dword [0x6ae1f0a8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6adc6757
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6adc66e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6adc66f0
add dword [0x6ae1f0a4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6ae1f0a8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6adc66e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6adc65d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6adc666e
mov eax, dword [0x6ae1f0a8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6adc65d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6adc65d0
lea esi, [esi]
nop

Function at 0x6adc6e10
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6ad80000], 0x5a4d
jne 0x6adc6e35
mov ecx, dword [0x6ad8003c]
cmp dword [ecx + 0x6ad80000], 0x4550
lea edx, [ecx + 0x6ad80000]
je 0x6adc6e40
ret
cmp word [ecx + 0x6ad80018], 0x10b
jne 0x6adc6e35
push esi
movzx eax, word [ecx + 0x6ad80014]
push ebx
movzx esi, word [ecx + 0x6ad80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6ad80000
test esi, esi
je 0x6adc6e88
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6adc6e7e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6adc6e8a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6adc6e70
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6add6d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, edx
xor edx, edx
push edi
mov edi, ecx
xor ecx, ecx
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
jne 0x6add6d6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.__ls_:_Cant_open_file_for_writing
call fcn.6add80b9
mov eax, 0x2f
jmp 0x6add6df9
mov esi, eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x14
test eax, eax
je 0x6add6daa
cmp dword [esp + 0x2c], edi
je 0x6add6dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__ls_:_Cant_write_file
mov dword [esp], eax
call fcn.6add80b9
mov dword [esp], esi
call ebp
push ecx
jmp 0x6add6df4
mov dword [esp], esi
call ebp
push edx
mov edx, eax
xor eax, eax
test edx, edx
jne 0x6add6df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__ls_:_Cant_close_handle
mov dword [esp], eax
call fcn.6add80b9
mov eax, 0x48
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1c26cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.01c26cc9

Function at 0x1c32460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x1d03e80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySection
push eax
call edi
mov dword [0x1d33d5c], eax
push str.NtQueryVirtualMemory
push esi
call edi
mov dword [0x1d33d54], eax
push str.NtUnmapViewOfSection
push esi
call edi
mov dword [0x1d33d58], eax
cmp dword [0x1d33d5c], 0
mov esi, 0xd
je 0x1c32566
cmp dword [0x1d33d54], 0
je 0x1c32566
test eax, eax
je 0x1c32566
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x28]
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi], fcn.01cc37a0
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], edi
mov ecx, esi
call fcn.01c41f00
lea esi, [ebp - 0x2c]
mov dword [esi], edi
mov eax, 0x40
push esi
push eax
push eax
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c32579
push 0x1d03e80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x28]
push edi
push 0x40
push section..crthunk
push 0x1c31e20
push edi
push str.NtMapViewOfSection
push 0x1c20000
push eax
call fcn.01c41f20
test eax, eax
js 0x1c32580
push esi
push 0x20
push 0x40
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c97fe3
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebp
ret
mov esi, 0xf
jmp 0x1c32566
mov dword [0x1d33d60], eax
mov esi, 0x10
jmp 0x1c32566
Function at 0x1c3efd0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x220]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
test eax, eax
js 0x1c3f11d
mov dword [ebp - 0x224], eax
mov ebx, 0xff
mov edi, 0x1d34dca
push ebx
push dword [ebp - 0x21c]
push edi
call fcn.01cb1699
add esp, 0xc
push edi
call fcn.01cb0da4
add esp, 4
sub ebx, eax
push ebx
push 0x1d06ed6
push edi
call fcn.01cb1699
add esp, 0xc
push esi
call sub.ntdll.dll_RtlFreeUnicodeString
lea esi, [ebp - 0x218]
push 0x208
push 0
push esi
call fcn.01c9afc0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x104
push esi
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c3f08f
push eax
push esi
push edi
call fcn.01cb16de
add esp, 0xc
test eax, eax
je 0x1c3f139
push 0x104
push esi
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c3f0ba
push eax
push esi
push edi
call fcn.01cb16de
add esp, 0xc
test eax, eax
je 0x1c3f139
xor eax, eax
mov byte [0x1d349c9], al
mov dword [ebp - 0x218], 0
push 0x1d04b5e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1d06f18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1c3f140
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov ecx, edi
call dword [section..00cfg]
push esi
push ebx
call edi
test eax, eax
je 0x1c3f140
cmp dword [ebp - 0x218], 0
setne cl
mov eax, dword [ebp - 0x224]
mov byte [0x1d34fca], cl
mov byte [0x1d349c8], 1
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x1c3f0bc
xor ecx, ecx
jmp 0x1c3f10a
Function at 0x1c3f340
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c3f365
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c3f4bc
bt ebx, 8
jae 0x1c3f380
mov eax, ebx
and eax, 0x200
jne 0x1c3f4bc
cmp edi, 2
mov eax, 0x1d349ca
mov ecx, 0x1d34bca
cmove ecx, eax
cmp word [ecx], 0
jne 0x1c3f4bc
xorps xmm0, xmm0
lea esi, [ebp - 0x34]
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c3f4bc
cmp byte [0x1d34fca], 0
setne al
bt ebx, 8
jb 0x1c3f4bc
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c3f4bc
cmp edi, 2
mov eax, 0x1d06f5c
mov edx, 0x1d06f70
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x1c3f4ce
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
xor esi, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x1c3f44c
push edi
push dword [edx]
push dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], eax
call fcn.01cad733
mov edx, dword [ebp - 0x50]
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x48]
je 0x1c3f457
add edx, 0x14
inc esi
cmp esi, dword [ebp - 0x4c]
jb 0x1c3f425
jmp 0x1c3f4b6
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + edi*2]
mov eax, dword [ebp - 0x48]
cmp ecx, 0x5c
jne 0x1c3f4f8
mov eax, dword [ebp - 0x38]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
jne 0x1c3f484
mov dword [ebp - 0x40], str.WOW6432Node
mov dword [ebp - 0x3c], eax
jmp 0x1c3f489
cmp esi, 1
je 0x1c3f505
cmp cx, 0x5c
mov dword [ebp - 0x44], esi
jne 0x1c3f4a4
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [ebp - 0x38], ecx
mov eax, ecx
je 0x1c3f492
jmp 0x1c3f4a7
mov dword [ebp - 0x38], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4c], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x1c3f450
cmp dword [ebp - 0x44], 0
jne 0x1c3f4d8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x38], eax
mov eax, ecx
jmp 0x1c3f408
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x1c3f4e3
mov eax, dword [eax]
mov edx, dword [ebp - 0x3c]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [ebp - 0x40]
push edx
call fcn.01cd8120
jmp 0x1c3f4bc
test ecx, ecx
jne 0x1c3f44c
jmp 0x1c3f46a
mov dword [ebp - 0x40], str.WOW6432Node_
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edi
jmp 0x1c3f489
Function at 0x1c3fcd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1d349c8], 0
je 0x1c3fd2d
xor esi, esi
lea edi, [ebp - 0x18]
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push edi
call sub.ntdll.dll_RtlInitUnicodeString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
push ebx
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c3efd0
test al, al
jne 0x1c3fcec
xor ebx, ebx
jmp 0x1c3fd19

Function at 0x1c3fd40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1d349c8], 0
je 0x1c3fd9f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
lea ebx, [ebp - 0x18]
mov dword [ebx + 4], edi
mov dword [ebx], edi
push eax
push ebx
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, 4
lea ecx, [ebp + 0x10]
push eax
push ecx
push eax
push edi
push ebx
push esi
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c3efd0
test al, al
jne 0x1c3fd5c
xor ebx, ebx
jmp 0x1c3fd8b

Function at 0x1c40130
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01cc3870
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01cc3870
push esi
push edi
push ebx
call fcn.01c401e0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c4018d
push dword [ebp - 0x34]
call fcn.01c97151
add esp, 4
cmp byte [ebp - 0x1d], 0
js 0x1c401c5
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c403e0
mov dword [0x1d34fd0], eax
cmp byte [esi + 0xb], 0
jns 0x1c401b3
push dword [ebp - 0x1c]
call fcn.01c97151
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x28]
call fcn.01c97151
add esp, 4
jmp 0x1c40193